+ ipc-sem-fix-used_sems-overflow-in-newary.patch added to mm-nonmm-unstable branch

+ ipc-sem-fix-used_sems-overflow-in-newary.patch added to mm-nonmm-unstable branch

[Andrew Morton]

The patch titled
     Subject: ipc: sem: fix used_sems overflow in newary()
has been added to the -mm mm-nonmm-unstable branch.  Its filename is
     ipc-sem-fix-used_sems-overflow-in-newary.patch

This patch will shortly appear at
     https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patches/ipc-sem-fix-used_sems-overflow-in-newary.patch

This patch will later appear in the mm-nonmm-unstable branch at
    git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Before you just go and hit "reply", please:
   a) Consider who else should be cc'ed
   b) Prefer to cc a suitable mailing list as well
   c) Ideally: find the original patch on the mailing list and do a
      reply-to-all to that, adding suitable additional cc's

*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***

The -mm tree is included into linux-next via various
branches at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there most days

------------------------------------------------------
From: Ruide Cao <caoruide123@gmail.com>
Subject: ipc: sem: fix used_sems overflow in newary()
Date: Mon, 11 May 2026 18:42:53 +0800

newary() checks namespace-wide semaphore usage before creating a new
array, but the current accounting uses a plain signed addition.

If the accumulated semaphore count overflows, the limit check can fail
open and allow allocations past sc_semmns, breaking namespace semaphore
resource enforcement and potentially leading to resource exhaustion.

Fix this by using check_add_overflow() before comparing the new total
against sc_semmns, and reject overflow the same way as a true limit
exceed.

Link: https://lore.kernel.org/849fb1fdecd1cc241fd5b032602dbffa90f9dd93.1778477179.git.caoruide123@gmail.com
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Ruide Cao <caoruide123@gmail.com>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: Yuan Tan <yuantan098@gmail.com>
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Reported-by: Xin Liu <bird@lzu.edu.cn>
Tested-by: Ren Wei <enjou1224z@gmail.com>
Cc: David Hildenbrand <david@kernel.org>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Kees Cook <kees@kernel.org>
Cc: Simon Schuster <schuster.simon@siemens-energy.com>
Cc: Davidlohr Bueso <dave@stgolabs.net>
Cc: Manfred Spraul <manfred@colorfullife.com>
Cc: <stable@vger.kernel.org>
---

 ipc/sem.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/ipc/sem.c~ipc-sem-fix-used_sems-overflow-in-newary
+++ a/ipc/sem.c
@@ -535,11 +535,13 @@ static int newary(struct ipc_namespace *
 	key_t key = params->key;
 	int nsems = params->u.nsems;
 	int semflg = params->flg;
+	int total_sems;
 	int i;
 
 	if (!nsems)
 		return -EINVAL;
-	if (ns->used_sems + nsems > ns->sc_semmns)
+	if (check_add_overflow(ns->used_sems, nsems, &total_sems) ||
+	    total_sems > ns->sc_semmns)
 		return -ENOSPC;
 
 	sma = sem_alloc(nsems);
_

Patches currently in -mm which might be from caoruide123@gmail.com are

ipc-sem-fix-used_sems-overflow-in-newary.patch