[PATCH v4 0/3] ipc/sem: account enlarged sops arrays and validate SEMOPM

[Yingjie Wang]

Alejandro, thanks for the review.

This version replaces the memcpy() used for the local ctl_table copy in
patch 2 with direct structure assignment. This is the only code change from
v3; the locking and validation behavior are unchanged.

The series separates the accounting threshold from the UAPI default.
SEMOPM can be changed when rebuilding the kernel, so it should not also
determine which operation arrays are accounted. The internal
SEMOPM_NOACCOUNT threshold is fixed at 1000 operations. Allocations above
it use GFP_KERNEL_ACCOUNT; requests at or below it keep their existing
behavior.

The sysctl handler parses writes into a temporary array while holding a
per-IPC-namespace mutex. The mutex covers the snapshot, validation, and
publication, so a failed write leaves the live settings unchanged and a
partial write cannot restore fields from an older snapshot. The snapshot and
publication use READ_ONCE() and WRITE_ONCE(), and reads continue through
proc_dointvec(). The unused sem_check_semmni() helper is also removed.

The UAPI warning about physical fragmentation is obsolete now that the
operation array uses kvmalloc(). The header describes SEMOPM as the
compiled-in default and retains the uniform <= INT_MAX range comment.

The series is based on 7be4bc52fd9e ("Merge tag 'driver-core-7.4-rc1' of
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core").

Validation completed on v4:

- a W=1 full x86-64 bzImage build;
- a W=1 i386 build of ipc/ipc_sysctl.o;
- initial and user-owned non-initial IPC namespaces rejected negative SEMOPM,
  invalid SEMMNI, and malformed writes without changing live settings;
- zero and positive SEMOPM values remained valid, including the 1000/1001
  operation boundary;
- concurrent partial, full, rejected, and successful sysctl writes completed
  without stale-snapshot overwrites;
- successful, EAGAIN, EFAULT, signal-interruption, and IPC_RMID paths released
  operation-array allocations;
- no BUG, WARNING, KASAN, UBSAN, or lock dependency report appeared;
- strict checkpatch with the intentional CONST_STRUCT diagnostic ignored,
  and patch application checks passed.

Patch 1 is unchanged from v3. Its previous 32 MiB memcg test with sixteen
one-million-operation calls reached the accounted limit and returned
allocation profiling to baseline; that test was not repeated for the
structure-copy cleanup.

Changes since v3:

- use structure assignment instead of memcpy() for the local ctl_table copy
  in patch 2, as Alejandro suggested;
- add linux-hardening to Cc.

V3:
https://lore.kernel.org/r/cover.1792808260.git.x-professor@xxxxxxxxxxx

Review of v3 2/3 by Alejandro:
https://lore.kernel.org/r/atyvbQ5xxtxcxBZE@debian

Yingjie Wang (3):
  ipc/sem: account enlarged sops arrays to memcg
  ipc/sem: reject negative SEMOPM values
  ipc/sem: remove obsolete SEMOPM fragmentation warning

 include/linux/ipc_namespace.h |  3 +++
 include/uapi/linux/sem.h      |  7 +++----
 ipc/ipc_sysctl.c              | 35 ++++++++++++++++++++++++++---------
 ipc/sem.c                     |  7 ++++++-
 ipc/util.h                    |  9 ---------
 5 files changed, 38 insertions(+), 23 deletions(-)


base-commit: 7be4bc52fd9e0e55dc9a2e0232b89427d2c4b614
-- 
2.43.0