* [PATCH v4 1/3] ipc/sem: account enlarged sops arrays to memcg
[not found] <cover.1793207025.git.x-professor@outlook.com>
@ 2026-10-28 17:03 ` Yingjie Wang
2026-10-28 18:18 ` Shakeel Butt
2026-10-28 17:03 ` [PATCH v4 2/3] ipc/sem: reject negative SEMOPM values Yingjie Wang
1 sibling, 1 reply; 3+ messages in thread
From: Yingjie Wang @ 2026-10-28 17:03 UTC (permalink / raw)
To: akpm@linux-foundation.org, Manfred Spraul, Alexey Gladkov,
Eric W . Biederman
Cc: Yingjie Wang, Vasily Averin, Johannes Weiner, Shakeel Butt,
Michal Koutný, Michal Hocko, Alejandro Colomar,
linux-kernel@vger.kernel.org, linux-mm@kvack.org,
cgroups@vger.kernel.org, linux-api@vger.kernel.org,
linux-man@vger.kernel.org, linux-hardening@vger.kernel.org,
stable@vger.kernel.org
Commit 6a4746ba0619 ("ipc: remove memcg accounting for sops objects in
do_semtimedop()") removed accounting based on the assumption that sops
arrays would remain small, describing a maximum cost of two pages.
SEMOPM is a UAPI default that can be changed when rebuilding the kernel.
It must not also define the accounting policy, since changing that default
would enlarge the unaccounted range.
Keep the historical small-array range unaccounted with a fixed internal
threshold of 1000 operations, and use GFP_KERNEL_ACCOUNT when the actual
nsops exceeds it. Requests within that range retain the existing allocation
behavior, while larger user-controlled arrays are charged to the caller's
memory cgroup.
Commit 50ec499b9a43 ("sysctl: allow change system v ipc sysctls inside ipc
namespace") later made the per-namespace limit tunable by IPC namespace
owners without capabilities in the initial user namespace.
Link: https://lore.kernel.org/r/20261016152609.2528805-1-x-professor@outlook.com
Fixes: 6a4746ba0619 ("ipc: remove memcg accounting for sops objects in do_semtimedop()")
Cc: stable@vger.kernel.org
Signed-off-by: Yingjie Wang <x-professor@outlook.com>
---
ipc/sem.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/ipc/sem.c b/ipc/sem.c
index 5ec41de7e85b2..a8c9807175520 100644
--- a/ipc/sem.c
+++ b/ipc/sem.c
@@ -176,6 +176,7 @@ static int sysvipc_sem_proc_show(struct seq_file *s, void *it);
#define SEMMSL_FAST 256 /* 512 bytes on stack */
#define SEMOPM_FAST 64 /* ~ 372 bytes on stack */
+#define SEMOPM_NOACCOUNT 1000 /* ~ 2 pages for struct sembuf */
/*
* Switching from the mode suitable for simple ops
@@ -2234,7 +2235,10 @@ static long do_semtimedop(int semid, struct sembuf __user *tsops,
return -EINVAL;
if (nsops > SEMOPM_FAST) {
- sops = kvmalloc_objs(*sops, nsops);
+ gfp_t gfp = nsops > SEMOPM_NOACCOUNT ?
+ GFP_KERNEL_ACCOUNT : GFP_KERNEL;
+
+ sops = kvmalloc_objs(*sops, nsops, gfp);
if (sops == NULL)
return -ENOMEM;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 3+ messages in thread* [PATCH v4 2/3] ipc/sem: reject negative SEMOPM values
[not found] <cover.1793207025.git.x-professor@outlook.com>
2026-10-28 17:03 ` [PATCH v4 1/3] ipc/sem: account enlarged sops arrays to memcg Yingjie Wang
@ 2026-10-28 17:03 ` Yingjie Wang
1 sibling, 0 replies; 3+ messages in thread
From: Yingjie Wang @ 2026-10-28 17:03 UTC (permalink / raw)
To: akpm@linux-foundation.org, Manfred Spraul, Alexey Gladkov,
Eric W . Biederman
Cc: Yingjie Wang, Vasily Averin, Johannes Weiner, Shakeel Butt,
Michal Koutný, Michal Hocko, Alejandro Colomar,
linux-kernel@vger.kernel.org, linux-mm@kvack.org,
cgroups@vger.kernel.org, linux-api@vger.kernel.org,
linux-man@vger.kernel.org, linux-hardening@vger.kernel.org,
stable@vger.kernel.org
The SEMOPM field has been stored as an int while semop() receives an
unsigned operation count since the beginning of Git history. A negative
SEMOPM accepted by proc_dointvec() is converted to a large unsigned value
in the comparison, defeating the intended operation-count limit.
Commit 50ec499b9a43 ("sysctl: allow change system v ipc sysctls inside ipc
namespace") made kernel.sem writable by IPC namespace owners without
capabilities in the initial user namespace.
Parse writes against a temporary copy and validate SEMOPM and SEMMNI
before changing the live settings. Hold a per-namespace mutex from the
snapshot through publication so concurrent sysctl writers cannot publish
stale values for fields they did not supply. Access the live fields with
READ_ONCE() and WRITE_ONCE(), preserving the per-field access semantics of
proc_dointvec(). Read requests continue to use proc_dointvec() directly.
Failed writes leave the live settings unchanged. Successful partial writes
change only the supplied fields relative to the latest locked snapshot.
The writer mutex retains the existing per-field visibility for readers.
Keep zero and positive SEMOPM values valid. Zero continues to reject every
non-empty semop() request.
Suggested-by: Andrew Morton <akpm@linux-foundation.org>
Link: https://lore.kernel.org/r/20261016155905.2a659b7bb7d61f33467a3263@linux-foundation.org
Link: https://lore.kernel.org/r/51c93c19-f1dd-455f-8698-6b1ee30eb630@colorfullife.com
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Reviewed-by: Manfred Spraul <manfred@colorfullife.com>
Signed-off-by: Yingjie Wang <x-professor@outlook.com>
---
include/linux/ipc_namespace.h | 3 +++
ipc/ipc_sysctl.c | 35 ++++++++++++++++++++++++++---------
ipc/sem.c | 1 +
ipc/util.h | 9 ---------
4 files changed, 30 insertions(+), 18 deletions(-)
diff --git a/include/linux/ipc_namespace.h b/include/linux/ipc_namespace.h
index 12faca29bbb9c..c06568ccfca88 100644
--- a/include/linux/ipc_namespace.h
+++ b/include/linux/ipc_namespace.h
@@ -4,6 +4,7 @@
#include <linux/err.h>
#include <linux/idr.h>
+#include <linux/mutex.h>
#include <linux/rwsem.h>
#include <linux/notifier.h>
#include <linux/nsproxy.h>
@@ -31,6 +32,8 @@ struct ipc_ids {
struct ipc_namespace {
struct ipc_ids ids[3];
+ /* Serialize kernel.sem writers. */
+ struct mutex sem_ctls_mutex;
int sem_ctls[4];
int used_sems;
diff --git a/ipc/ipc_sysctl.c b/ipc/ipc_sysctl.c
index d038d944257f6..0e3608258fe29 100644
--- a/ipc/ipc_sysctl.c
+++ b/ipc/ipc_sysctl.c
@@ -51,21 +51,38 @@ static int proc_ipc_auto_msgmni(const struct ctl_table *table, int write,
static int proc_ipc_sem_dointvec(const struct ctl_table *table, int write,
void *buffer, size_t *lenp, loff_t *ppos)
{
+ struct ctl_table ipc_table;
struct ipc_namespace *ns =
container_of(table->data, struct ipc_namespace, sem_ctls);
- int ret, semmni;
+ int sem_ctls[ARRAY_SIZE(ns->sem_ctls)];
+ size_t i;
+ int ret;
+
+ if (!write)
+ return proc_dointvec(table, write, buffer, lenp, ppos);
- semmni = ns->sem_ctls[3];
- ret = proc_dointvec(table, write, buffer, lenp, ppos);
+ mutex_lock(&ns->sem_ctls_mutex);
+ for (i = 0; i < ARRAY_SIZE(sem_ctls); i++)
+ sem_ctls[i] = READ_ONCE(ns->sem_ctls[i]);
- if (!ret)
- ret = sem_check_semmni(ns);
+ ipc_table = *table;
+ ipc_table.data = sem_ctls;
- /*
- * Reset the semmni value if an error happens.
- */
+ ret = proc_dointvec(&ipc_table, write, buffer, lenp, ppos);
if (ret)
- ns->sem_ctls[3] = semmni;
+ goto out_unlock;
+
+ if (sem_ctls[2] < 0 ||
+ sem_ctls[3] < 0 || sem_ctls[3] > ipc_mni) {
+ ret = -ERANGE;
+ goto out_unlock;
+ }
+
+ for (i = 0; i < ARRAY_SIZE(sem_ctls); i++)
+ WRITE_ONCE(ns->sem_ctls[i], sem_ctls[i]);
+
+out_unlock:
+ mutex_unlock(&ns->sem_ctls_mutex);
return ret;
}
diff --git a/ipc/sem.c b/ipc/sem.c
index a8c9807175520..0f7d32c12993f 100644
--- a/ipc/sem.c
+++ b/ipc/sem.c
@@ -249,6 +249,7 @@ static int sysvipc_sem_proc_show(struct seq_file *s, void *it);
void sem_init_ns(struct ipc_namespace *ns)
{
+ mutex_init(&ns->sem_ctls_mutex);
ns->sc_semmsl = SEMMSL;
ns->sc_semmns = SEMMNS;
ns->sc_semopm = SEMOPM;
diff --git a/ipc/util.h b/ipc/util.h
index a55d6cebe6d3b..51b4efa3d6db0 100644
--- a/ipc/util.h
+++ b/ipc/util.h
@@ -245,15 +245,6 @@ int ipcget(struct ipc_namespace *ns, struct ipc_ids *ids,
void free_ipcs(struct ipc_namespace *ns, struct ipc_ids *ids,
void (*free)(struct ipc_namespace *, struct kern_ipc_perm *));
-static inline int sem_check_semmni(struct ipc_namespace *ns) {
- /*
- * Check semmni range [0, ipc_mni]
- * semmni is the last element of sem_ctls[4] array
- */
- return ((ns->sem_ctls[3] < 0) || (ns->sem_ctls[3] > ipc_mni))
- ? -ERANGE : 0;
-}
-
#ifdef CONFIG_COMPAT
#include <linux/compat.h>
struct compat_ipc_perm {
--
2.43.0
^ permalink raw reply related [flat|nested] 3+ messages in thread