Re: [PATCH 05/44] ipc/msg: Fix saturation of percpu counts in msgctl_info()

[Andrew Morton]

> On Wed, 19 Nov 2025 22:41:01 +0000 david.laight.linux@xxxxxxxxx wrote:

It seems but yesterday.

> While the percpu_counter_sum() values are unlikely to be large the code
> tries to saturate them using min_t(int, percpu_counter_sum(), INT_MAX)
> This just doesn't work since the high bits are all masked and then the
> (possibly negative) value assigned.
> 
> Replace the min_t() with a plain min().
> 
> Fixes: 72d1e611082ed ("ipc/msg: mitigate the lock contention with percpu counter")
> Signed-off-by: David Laight <david.laight.linux@xxxxxxxxx>
> ---
>  ipc/msg.c | 6 ++----
>  1 file changed, 2 insertions(+), 4 deletions(-)
> 
> diff --git a/ipc/msg.c b/ipc/msg.c
> index ee6af4fe52bf..34e607add006 100644
> --- a/ipc/msg.c
> +++ b/ipc/msg.c
> @@ -501,11 +501,9 @@ static int msgctl_info(struct ipc_namespace *ns, int msqid,
>  	max_idx = ipc_get_maxidx(&msg_ids(ns));
>  	up_read(&msg_ids(ns).rwsem);
>  	if (cmd == MSG_INFO) {
> -		msginfo->msgmap = min_t(int,
> -				     percpu_counter_sum(&ns->percpu_msg_hdrs),
> +		msginfo->msgmap = min(percpu_counter_sum(&ns->percpu_msg_hdrs),
>  				     INT_MAX);
> -		msginfo->msgtql = min_t(int,
> -		                     percpu_counter_sum(&ns->percpu_msg_bytes),
> +		msginfo->msgtql = min(percpu_counter_sum(&ns->percpu_msg_bytes),
>  				     INT_MAX);
>  	} else {
>  		msginfo->msgmap = MSGMAP;

Added, thanks.

As always, bug fixes should include a clear description of the
worst-case userspace-visible runtime effects.  LLM said:

: When aggregate System V message queue usage exceeds INT_MAX, MSG_INFO
: returns wrapped statistics instead of saturating them.  At 2 GiB of
: queued data the byte count becomes negative, and at 4 GiB it becomes
: zero.  Consequently, ipcs -q -u can display an enormous used-space
: value or report no queued data despite substantial usage.  Monitoring
: programs using this interface can therefore substantially underreport
: or overreport resource consumption.  The bug affects statistics; it
: does not corrupt queued messages or alter queue-limit enforcement.

So I'll add a cc:stable to this.