[PATCH v2 0/3] ipc/sem: account enlarged sops arrays and validate SEMOPM

[Yingjie Wang <x-professor@outlook.com>]

Andrew, Manfred, thanks for the review.

This revision keeps the memcg accounting fix independently applicable,
makes the SEMOPM validation safe under concurrent sysctl writers, and moves
the UAPI comment cleanup to a separate follow-up patch.

Patch 1 charges operation arrays to the caller's memory cgroup only when
the actual nsops exceeds the compiled-in SEMOPM default. Requests within
the default limit retain the existing allocation behavior.

Patch 2 rejects negative SEMOPM values. Writes are parsed and validated in
temporary storage while a per-IPC-namespace mutex serializes writers from
the initial snapshot through publication. Shared settings are accessed
with READ_ONCE() and WRITE_ONCE(). Failed writes leave the live settings
unchanged, and a partial write cannot restore fields from a stale snapshot.
Readers retain the existing per-field visibility.

Patch 3 removes the obsolete UAPI warning about physical fragmentation for
SEMOPM values above 1000. The operation array has used kvmalloc() since
commit e4243b8062c1 ("ipc/sem: play nicer with large nsops allocations").

The series is based on 7be4bc52fd9e ("Merge tag 'driver-core-7.4-rc1' of
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core").

Validation completed:

- W=1 builds of the changed objects and full x86-64 bzImage builds for
  patch 1 alone and the final series;
- a W=1 i386 build of ipc/sem.o, ipc/ipc_sysctl.o, and ipc/namespace.o;
- initial and user-owned non-initial IPC namespaces rejected negative
  SEMOPM, invalid SEMMNI, and malformed writes without changing live
  settings, accepted zero and positive SEMOPM values, and enforced the
  configured operation-count boundary;
- both namespaces completed 10,000 rounds of concurrent partial and full
  writes and 10,000 rounds of concurrent rejected and successful writes;
  the same test reproduced the stale-snapshot overwrite on the superseded
  implementation in round 1;
- SEMOPM limits of 500 and 501 accepted requests at their exact boundary
  and rejected the immediately larger request;
- allocation profiling returned to its baseline after successful semop(),
  EAGAIN, EFAULT, signal interruption, and IPC_RMID wakeup paths;
- with patch 1 alone, a test using sixteen 1,000,000-operation calls in a
  32 MiB memory cgroup observed memory.peak reach 33,554,432 bytes, one
  memcg OOM kill, and allocation profiling return to its baseline after
  the caller exited.

Strict checkpatch reported only the CONST_STRUCT warning for the local
ctl_table copy in patch 2. That copy must remain writable because its data
pointer is redirected to the temporary array.

Changes since v1:

- account only requests whose actual nsops exceeds the compiled-in SEMOPM
  default and place this independently applicable fix first;
- reject negative SEMOPM values before changing live settings;
- serialize kernel.sem writers across snapshot, parsing, validation, and
  publication, while preserving per-field READ_ONCE()/WRITE_ONCE() access;
- attribute the long-standing signed/unsigned limit bug to the initial Git
  commit and retain commit 50ec499b9a43 as the reachability explanation;
- move the UAPI comment cleanup into a separate follow-up patch;
- add concurrent-writer, accounting-boundary, cleanup-path, and i386 build
  validation.

An AI coding assistant assisted with implementation review, commit-message
drafting, and test planning.

V1:
https://lore.kernel.org/r/20261016152609.2528805-1-x-professor@outlook.com

Andrew's review:
https://lore.kernel.org/r/20261016155905.2a659b7bb7d61f33467a3263@linux-foundation.org

Manfred's review:
https://lore.kernel.org/r/51c93c19-f1dd-455f-8698-6b1ee30eb630@colorfullife.com

Yingjie Wang (3):
  ipc/sem: account enlarged sops arrays to memcg
  ipc/sem: reject negative SEMOPM values
  ipc/sem: remove obsolete SEMOPM fragmentation warning

 include/linux/ipc_namespace.h |  3 +++
 include/uapi/linux/sem.h      |  7 +++----
 ipc/ipc_sysctl.c              | 38 ++++++++++++++++++++++++++---------
 ipc/sem.c                     |  5 ++++-
 ipc/util.h                    |  7 +++----
 5 files changed, 42 insertions(+), 18 deletions(-)


base-commit: 7be4bc52fd9e0e55dc9a2e0232b89427d2c4b614
-- 
2.43.0