DF-2705 — vop_write quota accounting skips unlinked-open files → complete quota enforcement bypass (when vfs.quota_enabled=1)

File: sys/kern/vfs_vopops.c (pass 2, GLM 5.3) Severity: Low (feature default-off, boot-tunable only) — Confidence: certain (logic), conditional on config

What

The generic write-path quota glue in vop_write() (sys/kern/vfs_vopops.c:470-497):

if (vfs_quota_enabled && (vp->v_type == VREG)) {
        ...
        size_before = va.va_size;
        /* this file may already have been removed */
        if (va.va_nlink > 0)
                do_accounting = 1;                      /* :477-478 */
        ...
        if (!vq_write_ok(mp, va.va_uid, va.va_gid, delta)) {   /* :489 check */
                error = EDQUOT;
                goto done;
        }
}
DO_OPS(ops, error, &ap, vop_write);
if ((error == 0) && do_accounting) {                    /* :495-497 */
        VFS_ACCOUNT(mp, va.va_uid, va.va_gid, size_after - size_before);
}

Charging (VFS_ACCOUNT → vfs_stdaccount, sys/kern/vfs_quota.c:150-171) is skipped whenever va_nlink == 0, but the limit check (vq_write_ok) still runs against a usage counter that will never be charged for this file's growth. Combined with vop_nremove() (sys/kern/vfs_vopops.c:1665-1668), which subtracts the whole file size from usage when the last link is removed, the enforcement is fully bypassable:

1. f = open("/q/f", O_CREAT|O_WRONLY); write up to the uid limit (charged, checks enforce).
2. unlink("/q/f") while keeping f open — vop_nremove subtracts the entire size (VFS_ACCOUNT(..., -va.va_size)) and the inode's nlink drops to 0.
3. Keep writing through f forever: every write's delta is checked against a uid usage that stays ~0 (0 + delta <= limit passes for any single write that fits the limit once), and do_accounting stays 0, so nothing is ever charged. → unbounded growth on a quota-limited mount.

Secondary weaknesses in the same glue (same lines):

• Concurrent-writer TOCTOU: size_before/uid/gid are read pre-write; two concurrent writers on two files both pass vq_write_ok for deltas computed against the same stale uid usage, then both charge — usage can exceed the limit by up to (threads-1) × limit.
• uid/gid snapshot TOCTOU (chown between check and charge charges the wrong uid).

All of it is gated on vfs_quota_enabled (sys/kern/vfs_quota.c:111-113): default 0, CTLFLAG_RD sysctl — settable only via the vfs.quota_enabled boot tunable, so the whole class is conditional on a non-default admin configuration. The feature is a fairness/accounting mechanism (vquotactl limits), not a hard security boundary; impact is disk-exhaustion across users on mounts where it was enabled.

Recommended fix

Charge unlinked-open files too (they still consume blocks until the last close) — i.e. drop the va_nlink > 0 condition, or charge nlink==0 files against a separate "unlinked usage" bucket; and re-read size/uid after the write for the delta (or account inside the FS on block allocation, which is the accurate basis).

--- a/sys/kern/vfs_vopops.c
+++ b/sys/kern/vfs_vopops.c
@@ -474,9 +474,7 @@
        size_before = va.va_size;
-       /* this file may already have been removed */
-       if (va.va_nlink > 0)
-           do_accounting = 1;
+       do_accounting = 1;  /* unlinked-open files still consume space */

(the symmetric subtraction in vop_nremove already handles last-link removal)

Reproduction status

Not executed on the guest (Phase V skipped): demonstrating requires booting the guest with the non-default vfs.quota_enabled=1 boot tunable plus vquota/ vquotactl limit setup — a configuration change to the shared baseline image — for a Low-severity accounting bypass. The logic chain above is complete and each line was verified against source in this pass.

VERDICT — DF-2705

status: untested (Phase V deliberately skipped: Low severity; reproduction requires reconfiguring the shared guest's boot tunables + vquota limit setup, disproportionate for an accounting-bypass finding).

Complete logic chain (all lines verified this pass)

1. Feature gate: int vfs_quota_enabled = 0; with TUNABLE_INT and SYSCTL_INT (..., CTLFLAG_RD, ...) — sys/kern/vfs_quota.c:111-113. Boot-time only, default off. Everything below is conditional on the admin enabling it.
2. Charging skip: sys/kern/vfs_vopops.c:476-478 — do_accounting only when va.va_nlink > 0; :495-497 charge gated on do_accounting.
3. Check still runs: :489 vq_write_ok(mp, va.va_uid, va.va_gid, delta) — implementation sys/kern/vfs_quota.c:411-461 compares space + delta against per-uid/gid/mount limits, where space is the charged usage (vfs_stdaccount :150-171 is the only writer, called via VFS_ACCOUNT).
4. Removal refund: sys/kern/vfs_vopops.c:1665-1668 — on last-link remove the full va.va_size is subtracted from usage.
5. Bypass: unlink an open fd (usage drops to ~0, nlink becomes 0) → subsequent writes through the fd are checked against usage that never grows (their own growth is never charged) and each individual write's delta only has to fit the limit once → unbounded growth past any per-uid/mount limit.
6. TOCTOU (secondary): concurrent writers on separate files both compute delta against the same stale space inside vq_write_ok; the check-then-charge gap spans the entire write, so N concurrent writers can overshoot the limit by (N-1)×limit.
7. Cross-refs surveyed for completeness: ftruncate/chown are accounted at the syscall layer (sys/kern/vfs_syscalls.c:3560-3561, 4048, 4124; sys/kern/vfs_vnops.c:326) — the nlink==0 skip in vop_write is the gap.

Honest classification

• Certain as a code-level logic flaw; exploitable only where an admin enabled vfs.quota_enabled=1 at boot.
• Impact ceiling: quota enforcement bypass → disk exhaustion on the quota'd mount (multi-user DoS); no memory-safety consequence (VFS_ACCOUNT with this delta feeds int64 counters only).
• Cross-file note for the orchestrator (belongs to the vfs_quota.c row, not this finding): vfs_stdaccount calls unode_insert/gnode_insert (sys/kern/vfs_quota.c:153-165) which do kmalloc(..., M_ZERO|M_WAITOK) while mp->mnt_acct.ac_spin is held — blocking allocation under a spinlock; same pattern in cmd_set_usage_all/cmd_set_limit_uid/gid (:236-306). Recommend a separate finding against sys/kern/vfs_quota.c.