DF-3120 — unsynchronized UFS quotaon/quotaoff state machine

Unsynchronized ufs_quotaon() / ufs_quotaoff() double-execution race in sys/vfs/ufs/ufs_quota.c. Two threads holding SYSCAP_NOQUOTA_WR (any quotactl-capable principal, e.g. root or a delegated quota manager) that both pass the um_quotas[type] == NULLVP check at ufs_quota.c:503 run the whole quotaoff teardown twice:

• double vn_close(qvp) at :519 → vnode refcount underflow / UAF (INVARIANTS: KKASSERT in vrele, sys/kern/vfs_lock.c:354)
• loser's crfree(ump->um_cred[type]) at :521 after the winner stored NOCRED ((struct ucred *)0, sys/sys/ucred.h:82) at :522 → NULL pointer deref in crfree (sys/kern/kern_prot.c)
• loser's scan-side dqrele→dqsync after um_quotas[type] cleared at :520 → panic("dqsync: file") (ufs_quota.c:909) or VOP_WRITE on a closed quota file
• loser's um_quotas[type] = NULLVP store can clobber a concurrent re-quotaon's live quota-file pointer (leaked vp + later dqsync: file)

There is no lock: QTF_CLOSING is set at :505 but read only by ufs_dqget (:762) — ufs_quotaoff itself never tests it, and vfs_busy() in ufs_quotactl (sys/vfs/ufs/ufs_vfsops.c:141) is a shared unmount pin, not mutual exclusion.

PoC

qt_race.c — 6 quotactl threads (2×Q_QUOTAON rotating 8 quota files, 4×Q_QUOTAOFF, each using a distinct control path), plus unprivileged children (uid 65534) doing Q_SYNC/Q_GETQUOTA and file churn so dquots exist and stay dirty. The distinct control paths matter: when every thread nlookup()ed the same control file, the shared namecache entry serialized the whole syscall and the race could not manifest (measured: 1.5M quotactls, zero overlaps, instrumented kernel). With distinct paths the overlap happens within seconds.

Build (in guest, as root)

cc -O -pthread -o /root/qt_race /root/qt_race.c

Guest setup (stock kernel has no options QUOTA — a QUOTA kernel

must be built first, see VERDICT.md "not_testable on stock config" note)

dd if=/dev/zero of=/qt.img bs=1m count=64
vnconfig -c /dev/vn0 /qt.img
newfs -m 0 /dev/vn0
mkdir -p /qtmnt && mount -t ufs /dev/vn0 /qtmnt
(PoC creates /qtmnt/ctrlN and /qtmnt/q0..q7 itself)

Run

/root/qt_race 100

Expected

Kernel panic on the serial console within ~10-100 s:

Fatal trap 12: page fault while in kernel mode
fault virtual address = 0x0
Stopped at crfree+0xc: cmpq $0,(%rdi)

(the crfree(NOCRED) NULL-deref). SSH dies / vm.sh status => down. With the INVARIANTS vrele assert or a dq-holding interleaving you can also see panic("dqsync: file") / vrele KKASSERT variants.

DF-3120 VERDICT — unsynchronized UFS quotaon/quotaoff state machine

Bottom line

REPRODUCED (kernel panic, race double-execution of ufs_quotaoff) on a DragonFly 6.5-DEVELOPMENT x86_64 kernel built with options QUOTA (stock X86_64_GENERIC has no options QUOTA, so the surface is compiled out of the default kernel — ufs_quotactl returns EOPNOTSUPP, sys/vfs/ufs/ufs_vfsops.c:77-78). With the QUOTA option the race panics the kernel within ~45 s of hammering; the fix serializes quotaon/quotaoff per-mount and survives the identical hammer.

The corruption is gated behind caps_priv_check(SYSCAP_NOQUOTA_WR) (both racing threads must be quota-admin-capable, normally root), so this is a Medium "privileged-admin → kernel memory corruption/panic" finding, not an unprivileged escalation. There is no unprivileged trigger path: every entry into ufs_quotaon/ufs_quotaoff is via quotactl(2) (privilege-checked) or unmount (ffs_flushfiles, ffs_vfsops.c:891, serialized against quotactl by MNTK_UNMOUNT / vfs_busy). The realistic impact ceiling is a capability-delegated quota manager (jail/helper holding only SYSCAP_NOQUOTA_WR) converting its narrow privilege into kernel UAF → host takeover.

Root cause (path:line)

• sys/vfs/ufs/ufs_quota.c:495-531 — ufs_quotaoff(): entry test if ((qvp = ump->um_quotas[type]) == NULLVP) return (0); at :503, QTF_CLOSING set at :505 but never tested here — the only reader is ufs_dqget at :762. Teardown: ufs_dqflush(qvp) :517, vn_close(qvp) :519, um_quotas[type] = NULLVP :520, crfree(um_cred[type]) :521, um_cred[type] = NOCRED :522.
• sys/vfs/ufs/ufs_quota.c:412-475 — ufs_quotaon(): state swap if (*vpp != vp) ufs_quotaoff(mp, type) at :437-438, *vpp = vp :442, um_cred[type] = crhold(cred) :448 — same absence of locks.
• sys/vfs/ufs/ufs_vfsops.c:141 — vfs_busy(mp, LK_NOWAIT) is a shared pin against unmount, not mutual exclusion between quotactls.
• Consequence: N threads passing :503 together execute the teardown N times → double vn_close (vnode refcount/opencount underflow), crfree(NOCRED) with NOCRED == (struct ucred *)0 (sys/sys/ucred.h:82) → NULL write-deref in crfree (sys/kern/kern_prot.c, cr->cr_ref at +0x10), stale-tail dqrele→dqsync seeing um_quotas[type] cleared → panic("dqsync: file") ufs_quota.c:909 / VOP_WRITE on a closed quota file, and clobbering of a concurrent re-quotaon's live um_quotas[type]/um_cred[type] pointers (leak + later panic).

Reproduction timeline (all on dfbsd-qemu guest, 6 vCPU)

1. Stock kernel: quotactl(Q_QUOTAON) = EOPNOTSUPP (no QUOTA option in X86_64_GENERIC). Built X86_64_QUOTA (cp X86_64_GENERIC + options QUOTA) with make nativekernel.
2. Instrumented kernel (diag counters only, no semantic change): PoC with a shared control path never overlapped (1.5M quotactls, 0 window entries — the shared namecache entry of the single ctrl file serialized the syscalls by accident). PoC v3 with distinct control paths per thread (/qtmnt/ctrl0..5): panic in <60 s — panic.diag.txt: DF3120-DIAG: race window entered (in-flight=1) immediately followed by Fatal trap 12 ... fault virtual address = 0x0, Stopped at crfree+0xc: cmpq $0,(%rdi) — the predicted crfree(NOCRED) NULL-deref at ufs_quota.c:521.
3. Clean baseline kernel (pristine ufs_quota.c, only options QUOTA added, INVARIANTS on): identical PoC panicked in ≤45 s — panic.txt: panic: VOP_STDCLOSE: BAD OPENCOUNT with stack vop_stdclose ← vop_close ← vn_close ← ufs_quotaoff ← ufs_quotactl — the double-vn_close(qvp) manifestation of the same race (ufs_quota.c:519 executed twice).
4. Fix v1 (fix.diff, um_quota_lock around quotaon/quotaoff): no panic, but my own validation caught a fix deadlock — quotaon originally took um_quota_lock while still holding the quota-file vp lock returned by vn_open (before vn_unlock(vp)), inverting against quotaoff's um_quota_lock → vget() order. All quotactl threads stuck in D state, wchan ncplk. Fixed by unlocking the vp before taking the lock (documented in fix.diff comment).
5. Fix v2 (final fix.diff): identical PoC, 300 s + repeat runs: guest up, no panic, mount healthy (see run logs). Baseline panicked ≤45 s; patched survived every run — behavior change demonstrated.

Exploitability assessment

Memory-corruption class, but both racing threads must pass SYSCAP_NOQUOTA_WR; no unprivileged entry exists. Escalation ceiling: a delegated quota-capable process (not uid 0) double-closing the quota vnode → refcount desync → premature vnode recycle while um_quotas[type]/dquot cache still reference it → UAF on later dqsync I/O. Not pursued to uid=0 because the entry gate already requires the privilege the escalation would grant (root-vs-root has no boundary to cross); the panic is the honest demonstrated impact.

Fix

fix.diff — per-mount um_quota_lock (lockmgr) serializing ufs_quotaon/ufs_quotaoff (ufs_quotaoff wraps a ufs_quotaoff_locked body so quotaon's internal swap-call does not self-deadlock); lockinit in ffs_mountfs; vn_unlock(vp) before taking the lock in quotaon (deadlock note). Validated on-guest.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.