DF-2669 — kern_truncate()/kern_ftruncate() call VFS_ACCOUNT() even when VOP_SETATTR failed

Impact (quota accounting corruption; non-default config)

When VFS quota accounting is active (vfs.quota_enabled=1 tunable plus a mount whose vfs_acinit wired vfs_account, e.g. quota-enabled UFS or HAMMER2), a truncate request that fails (EFBIG, EPERM, EDQUOT, ENOSPC …) still moves the per-uid/gg byte accounting by length - old_size even though the file size did not change. Repeated failed truncates let a user drive its own (or another uid's) accounting arbitrarily negative or positive → quota bypass (unlimited usage) or spurious EDQUOT denial for other users. Requires quota support enabled (non-default), unprivileged once enabled.

Root cause (line-accurate)

sys/kern/vfs_syscalls.c:4044-4049 (kern_truncate):

    if ((error = vn_writechk(vp)) == 0) {
        VATTR_NULL(&vattr);
        vattr.va_size = length;
        error = VOP_SETATTR(vp, &vattr, nd->nl_cred);
        VFS_ACCOUNT(nd->nl_nch.mount, uid, gid, length - old_size);   /* :4048 — runs even if error != 0 */
    }

sys/kern/vfs_syscalls.c:4119-4125 (kern_ftruncate):

    if ((error = vn_writechk(vp)) == 0) {
        VATTR_NULL(&vattr);
        vattr.va_size = length;
        error = VOP_SETATTR_FP(vp, &vattr, fp->f_cred, fp);
        mp = vq_vptomp(vp);
        VFS_ACCOUNT(mp, uid, gid, length - old_size);                  /* :4124 — same */
    }

The sibling code path setfown() guards the accounting correctly: if (error == 0) { ... VFS_ACCOUNT ... } (:3555-3562). The two truncate paths are missing the same guard.

Not verified on the guest

Impact requires VFS quota accounting to be enabled (vfs_quota_enabled tunable at boot + per-mount vfs_acinit); the stock guest kernel/mounts do not wire vfs_account (VFS_ACCOUNT is a no-op there), and setting up a quota-enabled mount would not change the code-level conclusion. Filed as certain-by-inspection logic bug; PoC left untested. A one-line guard makes the behavior correct either way.

Recommended fix

--- a/sys/kern/vfs_syscalls.c
+++ b/sys/kern/vfs_syscalls.c
@@ kern_truncate()
    if ((error = vn_writechk(vp)) == 0) {
        VATTR_NULL(&vattr);
        vattr.va_size = length;
        error = VOP_SETATTR(vp, &vattr, nd->nl_cred);
-       VFS_ACCOUNT(nd->nl_nch.mount, uid, gid, length - old_size);
+       if (error == 0)
+           VFS_ACCOUNT(nd->nl_nch.mount, uid, gid,
+                   length - old_size);
    }
@@ kern_ftruncate()
    if ((error = vn_writechk(vp)) == 0) {
        VATTR_NULL(&vattr);
        vattr.va_size = length;
        error = VOP_SETATTR_FP(vp, &vattr, fp->f_cred, fp);
        mp = vq_vptomp(vp);
-       VFS_ACCOUNT(mp, uid, gid, length - old_size);
+       if (error == 0)
+           VFS_ACCOUNT(mp, uid, gid, length - old_size);
    }