DF-2923 — vq_vptomp() check-then-use race on vp->v_pfsmp → mount UAF

Code

sys/kern/vfs_quota.c:420-433:

if ((vp->v_pfsmp != NULL) && (mountlist_exists(vp->v_pfsmp))) {
    return vp->v_pfsmp;          /* NO reference taken */
}
return vp->v_mount;

Callers immediately dereference the result: * sys/kern/vfs_syscalls.c:4123-4124 kern_ftruncate: mp = vq_vptomp(vp); VFS_ACCOUNT(mp, ...) -> MP->mnt_op->vfs_account(MP,...) (sys/sys/mount.h:657) * sys/kern/vfs_vnops.c:325-326 vn_open O_TRUNC path, same pattern.

v_pfsmp is set once, forever, when the vnode is first resolved through a nullfs mount (sys/kern/vfs_cache.c:1386-1389) and is never cleared. The nullfs mount can be unmounted afterwards; dounmount() then frees the mount structure WITHOUT waiting for our thread (we hold no mnt_refs — vfs_syscalls.c:1107-1118 only waits on mnt_refs) because the racing fd holds a vnode of the underlying fs, not of the null layer.

The mountlist_exists() check takes no reference: between the check and the caller's MP->mnt_op dereference, a concurrent dounmount() can mountlist_remove() + kfree() the mount -> use-after-free, including an indirect call through freed memory (vfs_account) and a spin_lock on the freed mount's ac_spin.

Post-free, the stale v_pfsmp pointer also survives forever: if the freed mount memory is reused by a new mount, mountlist_exists() returns TRUE for the WRONG mount and accounting is silently redirected (accounting integrity, no crash).

Harness

vqpfsrace.c — root-side mount_null/umount churn (~135 cycles/s) racing an ftruncate loop on a file opened through the null view (the ftruncate side alone is unprivileged).

Result

20,000+ mount/unmount cycles, no hit: the vulnerable window is the few instructions between mountlist_exists() and the mnt_op dereference (~10 ns) inside a ~7 ms cycle => p(hit) ~ 1e-5/cycle. The race is real by construction but was not landed within the time budget.

Fix

Take a reference before trusting v_pfsmp: e.g. loop lwkt_gettoken(&mountlist_token); re-check mountlist_exists under the token; mount_hold(mp); lwkt_reltoken; ... mount_drop(mp) after use — or clear vp->v_pfsmp during nullfs unmount (VFS_UNMOUNT of the layer walking vnodes is not possible for foreign vnodes; the reference is the workable fix).