DF-3244

ufs_quotactl returns success (0) without performing the operation when vfs_busy(mp, LK_NOWAIT) fails — Q_QUOTAON/Q_SETQUOTA/Q_QUOTAOFF silently no-op during unmount contention, a security-control fail-open

Summary

If the mount is being unmounted (MNTK_UNMOUNT) or the busy fails, ufs_quotactl returns 0 (:141-142) - the caller (quotaon(8), edquota, replication tooling) believes quotas were enabled/limits were set while nothing happened. 4.4BSD heritage; modern FreeBSD propagates the error. Admin tooling gets false confirmation that a quota control was applied; all callers privileged, no privilege boundary crossed. Fix: return EBUSY. [VERIFIED pass2: vfs_busy failure returns 0 silent no-op confirmed; EBUSY fix authored compiled with QUOTA]

Discussion (0)

No comments yet.

Severity: Info
Status: new
Bucket: Base system — filesystems
Confidence: certain
Pass: 2 · GLM 5.3 second pass
CVSS 3.1: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
CWE: CWE-252
File: sys/vfs/ufs/ufs_vfsops.c
Lines: 141-142
Area: vfs
Discovered: 2026-09-09
Updated: 2026-09-09

Team triage

untriaged

priority: — · owner: —

PoC verification

not_reproduced

Status: not_reproduced
Reproduced: no
Impact: none
Confidence: certain
Tested: 2026-10-26 04:39:04
Attempts: 0
Runtime: 5s
Code hash: —
Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
Build cmd: see build.sh
Run cmd: see run.sh

jump to evidence pack ↓

Fix verification

not_testable

Fix status: not_testable
Baseline reproduced: —
Patched reproduced: —
Confidence: certain
Tested: 2026-10-26 04:39:04
Runtime: —
Kernel: per-fix-DF-3244
fix.diff: findings/poc/DF-3244/fix.diff
Runner: df-bsd-reviewer

jump to fix verification ↓

PoC verification

Evidence pack

findings/poc/DF-3244 · 4 files

File	Type	Size
README.md	—	247 B	↓ raw
fix.diff	—	565 B	view raw
manifest.json	—	352 B	view raw
verdict.json	—	1.4 KB	view raw

README.md

↓ download raw

DF-3244 evidence pack

What

ufs_quotactl returns success without performing the op when vfs_busy fails

Verdict

status=not_reproduced impact=none confidence=certain

See VERDICT.md for the full narrative and fix.diff for the verified fix.

Fix verification

not_testable

compiled in the QUOTA-enabled F40FIX kernel; not runtime-exercised (vfs_busy contention window not attempted). Code-certain two-liner: return EBUSY instead of silently succeeding.

↓ fix.diffper-fix-DF-3244

Confirmed kernel references

Detail

Evidence (decisive lines)

VERDICT.md with path:line citations; run.log where a live demo exists; fix.diff

PoC changes

n/a - see DF-3243

Verified recommended fix

return EBUSY instead of 0 when vfs_busy(LK_NOWAIT) fails

Verdict

Same kernel-availability constraint as DF-3243 (stock: EOPNOTSUPP, #ifndef QUOTA). Line-accurate confirmation: ufs_quotactl executes if (vfs_busy(mp, LK_NOWAIT)) return (0); (ufs_vfsops.c:141-142) - Q_QUOTAON/Q_SETQUOTA/Q_QUOTAOFF silently no-op during unmount contention while quotaon(8)/replication tooling receives success. 4.4BSD heritage; FreeBSD propagates the error. Fix returns EBUSY; compiled in the F40FIX kernel (options QUOTA).