DF-3121

ufs_dqsync drops DQ_MOD on write failure — quota record silently never written, permanent under-accounting after I/O errors

Summary

When the VOP_WRITE of a dquot record fails (or short-writes), ufs_dqsync still clears DQ_MOD at :936 and reports the error only to callers that ignore it - ufs_dqrele (:886-887) discards the return then inserts the dquot on the free list. The in-core usage update is lost forever: quota file and memory diverge, chkdq/chkiq keep incrementing from the memory copy, on-disk accounting silently under-reports usage after any transient I/O error - a quota-enforcement integrity failure with no retry path and no warning. No memory-safety impact; Info. Fix: keep the dquot dirty on failure (retain DQ_MOD, return error) so a subsequent dqsync retries. [VERIFIED pass2: DQ_MOD cleared on failed write confirmed needs persistent IO failure; fix compiled in the QUOTA kernel]

Discussion (0)

No comments yet.

Severity: Info
Status: new
Bucket: Base system — filesystems
Confidence: certain
Pass: 2 · GLM 5.3 second pass
CVSS 3.1: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N
CWE: CWE-754
File: sys/vfs/ufs/ufs_quota.c
Lines: 887-936
Area: vfs
Discovered: 2026-09-06
Updated: 2026-09-06

Team triage

untriaged

priority: — · owner: —

PoC verification

not_reproduced

Status: not_reproduced
Reproduced: no
Impact: none
Confidence: certain
Tested: 2026-10-26 04:39:03
Attempts: 0
Runtime: 10s
Code hash: —
Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
Build cmd: see build.sh
Run cmd: see run.sh

jump to evidence pack ↓

Fix verification

not_testable

Fix status: not_testable
Baseline reproduced: —
Patched reproduced: —
Confidence: certain
Tested: 2026-10-26 04:39:03
Runtime: —
Kernel: per-fix-DF-3121
fix.diff: findings/poc/DF-3121/fix.diff
Runner: df-bsd-reviewer

jump to fix verification ↓

PoC verification

Evidence pack

findings/poc/DF-3121 · 5 files

File	Type	Size
README.md	—	243 B	↓ raw
fix.diff	—	442 B	view raw
manifest.json	—	363 B	view raw
run.log	—	1.5 KB	view raw
verdict.json	—	1.8 KB	view raw

README.md

↓ download raw

DF-3121 evidence pack

What

ufs_dqsync clears DQ_MOD on write failure - quota record never retried

Verdict

status=not_reproduced impact=none confidence=certain

See VERDICT.md for the full narrative and fix.diff for the verified fix.

Fix verification

not_testable

compiled in the QUOTA-enabled F40FIX kernel where the quota machinery runs live (Q_QUOTAON + Q_SETQUOTA exercised during the DF-3243 A/B, exercising the fixed dqsync path on success); the failure branch (persistent I/O error) not simulated.

↓ fix.diffper-fix-DF-3121

Confirmed kernel references

Detail

Evidence (decisive lines)

VERDICT.md with path:line citations; run.log where a live demo exists; fix.diff

PoC changes

n/a; stock kernel lacks options QUOTA (EOPNOTSUPP live-confirmed)

Verified recommended fix

clear DQ_MOD only when the quota-file write succeeded

Verdict

Line-accurate confirmation; no runtime demonstration attempted (requires persistent quota-file I/O failure). ufs_dqsync clears DQ_MOD|DQ_LOCK|DQ_WANT unconditionally after VOP_WRITE (ufs_quota.c:935) even when the write failed or short-wrote, and ufs_dqrele discards the return (:886-887) before inserting the dquot on the free list - the in-core usage update is lost forever with no retry path. UFS quotas are compiled out of the stock kernel (ufs_vfsops.c:77 #ifndef QUOTA -> EOPNOTSUPP, confirmed live: quotactl Q_QUOTAON returns EOPNOTSUPP as root); the F40FIX verification kernel enables options QUOTA so the fixed ufs_quota.c compiles against real consumers. Fix keeps DQ_MOD on failure.