[PATCH v3 0/3] ipc/sem: account enlarged sops arrays and validate SEMOPM

[Yingjie Wang]

Andrew, Manfred, thanks for the review.

This version separates the accounting threshold from the UAPI default.
SEMOPM can be changed when rebuilding the kernel, so it should not also
determine which operation arrays are accounted. The new internal
SEMOPM_NOACCOUNT threshold is fixed at 1000 operations. Allocations above
it use GFP_KERNEL_ACCOUNT; requests at or below it keep their existing
behavior.

The sysctl handler now parses writes into a temporary array while holding a
per-IPC-namespace mutex. The mutex covers the snapshot, validation, and
publication, so a failed write leaves the live settings unchanged and a
partial write cannot restore fields from an older snapshot. The snapshot and
publication use READ_ONCE() and WRITE_ONCE(), and reads continue through
proc_dointvec(). The unused sem_check_semmni() helper has also been removed.

The UAPI warning about physical fragmentation is obsolete now that the
operation array uses kvmalloc(). The header now describes SEMOPM as the
compiled-in default and retains the uniform <= INT_MAX range comment.

The series is based on 7be4bc52fd9e ("Merge tag 'driver-core-7.4-rc1' of
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core").

Validation completed:

- W=1 builds of the changed objects and a full x86-64 bzImage build;
- a W=1 i386 build of ipc/sem.o, ipc/ipc_sysctl.o, and ipc/namespace.o;
- initial and user-owned non-initial IPC namespaces rejected negative SEMOPM,
  invalid SEMMNI, and malformed writes without changing live settings;
- zero and positive SEMOPM values remained valid, with the configured
  operation-count boundary enforced;
- the operation-count boundary was checked at 1000 and 1001 operations;
- concurrent partial, full, rejected, and successful sysctl writes completed
  without stale-snapshot overwrites;
- successful, EAGAIN, EFAULT, signal-interruption, and IPC_RMID paths released
  operation-array allocations;
- a constrained memcg run with enlarged operation arrays entered the
  GFP_KERNEL_ACCOUNT limit path and returned allocation profiling to baseline;
- strict checkpatch (with the intentional CONST_STRUCT diagnostic ignored)
  and patch application checks passed.

Changes since v2:

- use a fixed internal SEMOPM_NOACCOUNT=1000 threshold instead of the
  rebuildable UAPI SEMOPM value for the accounting decision;
- remove sem_check_semmni() and inline the SEMMNI and SEMOPM range checks;
- restore the uniform <= INT_MAX SEMOPM comment form in the UAPI header;
- retain Manfred Spraul's Reviewed-by tags on the two patches revised
  according to his comments.

V2:
https://www.spinics.net/lists/kernel/msg6527052.html

Manfred's v2 review of 2/3:
https://www.spinics.net/lists/kernel/msg6528247.html

Manfred's v2 review of 3/3:
https://www.spinics.net/lists/kernel/msg6528679.html

An AI coding assistant assisted with implementation review, commit-message
drafting, and test planning.

Yingjie Wang (3):
  ipc/sem: account enlarged sops arrays to memcg
  ipc/sem: reject negative SEMOPM values
  ipc/sem: remove obsolete SEMOPM fragmentation warning

 include/linux/ipc_namespace.h |  3 +++
 include/uapi/linux/sem.h      |  7 +++----
 ipc/ipc_sysctl.c              | 35 ++++++++++++++++++++++++++---------
 ipc/sem.c                     |  7 ++++++-
 ipc/util.h                    |  9 ---------
 5 files changed, 38 insertions(+), 23 deletions(-)


base-commit: 7be4bc52fd9e0e55dc9a2e0232b89427d2c4b614
-- 
2.43.0