Re: [PATCH v2] ipc/msg: prevent msg_qbytes limit bypass in IPC_SET

[Andrew Morton]

On Tue, 27 Oct 2026 23:42:51 -0700 "Shubhang Kaushik (Ampere)" <sh@xxxxxxxxxx> wrote:

> The msg_qbytes field in the msqid64_ds userspace ABI is an unsigned
> long. Commit 889b331724c82 ("ipc/msg.c: consolidate all xxxctl_down()
> functions") passed that value to msgctl_down() as an int.
> 
> An unprivileged owner can set msg_qbytes to UINT_MAX. The narrowing
> conversion produces -1 on supported Linux targets, so the check against
> the int-valued msg_ctlmnb sysctl does not reject the request:
> 
> 	if (msg_qbytes > ns->msg_ctlmnb &&
> 	    !capable(CAP_SYS_RESOURCE))
> 
> The value is then assigned to the unsigned long q_qbytes field, setting
> it to ULONG_MAX. This bypasses the CAP_SYS_RESOURCE requirement for
> increasing a queue above MSGMNB.
> 
> It also bypasses the effective per-queue message-count limit: zero-length
> messages consume kernel memory but not queue bytes. An unprivileged queue
> owner can therefore cause memory pressure or exhaustion beyond the
> configured per-queue allowance, subject to other resource limits.
> 
> Keep msg_qbytes as unsigned long through validation and assignment.
> Also preserve its type in ipcctl_obtain_check(), which supplies it to
> the unsigned-long audit field.
> 
> Add a regression test which drops CAP_SYS_RESOURCE and verifies that
> IPC_SET with UINT_MAX fails with EPERM. Skip the test when capabilities
> or System V message queues are unavailable.

Thanks.  Sashiko AI review asked a thing:

https://sashiko.dev/#/patchset/20261027-ipc-msg-qbytes-v2-1-48d8f72f1359@xxxxxxxxxx