[PATCH v3 1/3] ipc/sem: account enlarged sops arrays to memcg

[Yingjie Wang]

Commit 6a4746ba0619 ("ipc: remove memcg accounting for sops objects in
do_semtimedop()") removed accounting based on the assumption that sops
arrays would remain small, describing a maximum cost of two pages.

SEMOPM is a UAPI default that can be changed when rebuilding the kernel.
It must not also define the accounting policy, since changing that default
would enlarge the unaccounted range.

Keep the historical small-array range unaccounted with a fixed internal
threshold of 1000 operations, and use GFP_KERNEL_ACCOUNT when the actual
nsops exceeds it. Requests within that range retain the existing allocation
behavior, while larger user-controlled arrays are charged to the caller's
memory cgroup.

Commit 50ec499b9a43 ("sysctl: allow change system v ipc sysctls inside ipc
namespace") later made the per-namespace limit tunable by IPC namespace
owners without capabilities in the initial user namespace.

Link: https://lore.kernel.org/r/20261016152609.2528805-1-x-professor@xxxxxxxxxxx
Fixes: 6a4746ba0619 ("ipc: remove memcg accounting for sops objects in do_semtimedop()")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Yingjie Wang <x-professor@xxxxxxxxxxx>
---
 ipc/sem.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/ipc/sem.c b/ipc/sem.c
index 5ec41de7e85b2..a8c9807175520 100644
--- a/ipc/sem.c
+++ b/ipc/sem.c
@@ -176,6 +176,7 @@ static int sysvipc_sem_proc_show(struct seq_file *s, void *it);
 
 #define SEMMSL_FAST	256 /* 512 bytes on stack */
 #define SEMOPM_FAST	64  /* ~ 372 bytes on stack */
+#define SEMOPM_NOACCOUNT	1000 /* ~ 2 pages for struct sembuf */
 
 /*
  * Switching from the mode suitable for simple ops
@@ -2234,7 +2235,10 @@ static long do_semtimedop(int semid, struct sembuf __user *tsops,
 		return -EINVAL;
 
 	if (nsops > SEMOPM_FAST) {
-		sops = kvmalloc_objs(*sops, nsops);
+		gfp_t gfp = nsops > SEMOPM_NOACCOUNT ?
+			GFP_KERNEL_ACCOUNT : GFP_KERNEL;
+
+		sops = kvmalloc_objs(*sops, nsops, gfp);
 		if (sops == NULL)
 			return -ENOMEM;
 	}
-- 
2.43.0