Re: [PATCH] ipc/sem: account enlarged sops arrays to memcg

[Wang Yingjie]

Hi Manfred,

On Sun, Oct 18, 2026 at 12:46 PM Manfred Spraul wrote:
> This would mean workloads with higher SEMOPM values cannot run in
> containers, correct?

Yes. A fixed limit of 1000 for non-initial IPC namespaces would prevent
a workload requiring a larger SEMOPM from running there. Commit
e4243b8062c1 ("ipc/sem: play nicer with large nsops allocations")
deliberately made larger nsops allocations work, so a new ceiling could
be a compatibility regression.

I will not include the fixed 1000 ceiling in v2 without agreement. The
parts that appear independent are:

- reject non-positive SEMOPM values while preserving the existing
  positive range;
- validate the complete kernel.sem vector before installing any value;
- keep memcg accounting for arrays above the default SEMOPM as a
  separate patch.

This leaves the case where memcg is disabled or unlimited without a hard
global ceiling, as Andrew noted. I do not see a compatibility-safe fixed
ceiling that can be selected from the existing ABI alone.

Andrew, Manfred, would you prefer a v2 with the validation fix and the
separate memcg follow-up, but no new fixed namespace ceiling, or should
I hold the reroll until the namespace limit policy is settled?

Thanks,
Yingjie