[PATCH v5 0/3] ipc/sem: account dynamic sops arrays and validate SEMOPM

[Yingjie Wang]

Shakeel, thanks for the suggestion.

Patch 1 now uses GFP_KERNEL_ACCOUNT for every dynamically allocated sops
array. The first 64 operations still use the existing stack buffer. The
fixed 1000-operation exemption and its conditional allocation flags have
been removed.

I compared this version with v4 in a 4-vCPU KVM guest. The benchmark process
was pinned to one vCPU. Each number is the median of 21 samples from three
fresh boots of each kernel. In a leaf memory cgroup, the changes were:

                                      65       500      1000
  successful semop()                   +3.2%     +3.2%     +2.3%
  allocation-focused invalid semid     +5.6%     +9.1%    +11.9%

The invalid-sem-id case allocates and copies the operation array before
returning EINVAL, so it emphasizes allocation overhead. The 64-operation
stack controls changed by 0.9% and 0.5%, respectively. The already-accounted
1001-operation controls changed by 1.0% and -0.2%. Successful calls in the
root cgroup changed by at most 2.3%, including the controls.

The sysctl handler parses writes into a temporary array while holding a
per-IPC-namespace mutex. The mutex covers the snapshot, validation, and
publication, so a failed write leaves the live settings unchanged and a
partial write cannot restore fields from an older snapshot. The snapshot and
publication use READ_ONCE() and WRITE_ONCE(), and reads continue through
proc_dointvec(). The unused sem_check_semmni() helper is also removed.

The UAPI warning about physical fragmentation is obsolete now that the
operation array uses kvmalloc(). The header describes SEMOPM as the
compiled-in default and retains the uniform <= INT_MAX range comment.

Patches 2 and 3 are unchanged from v4 and retain Manfred's Reviewed-by tags.
The series is based on 7be4bc52fd9e ("Merge tag 'driver-core-7.4-rc1' of
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core").

Validation completed on v5:

- a W=1 full x86-64 bzImage build;
- W=1 i386 builds of ipc/sem.o and ipc/ipc_sysctl.o;
- three paired boots of v4 and v5 for the root/leaf memcg benchmark, with
  seven samples for every path, cgroup, and operation count in each boot;
- initial and user-owned non-initial IPC namespaces rejected negative SEMOPM,
  invalid SEMMNI, and malformed writes without changing live settings;
- zero and positive SEMOPM values remained valid, including the 1000/1001
  operation boundary;
- concurrent partial, full, rejected, and successful sysctl writes completed
  without stale-snapshot overwrites;
- successful, EAGAIN, EFAULT, signal-interruption, and IPC_RMID paths released
  operation-array allocations;
- no BUG, WARNING, KASAN, UBSAN, or lock dependency report appeared;
- strict checkpatch with the intentional CONST_STRUCT diagnostic ignored,
  and patch application checks passed.

Changes since v4:

- account every dynamically allocated sops array with GFP_KERNEL_ACCOUNT, as
  Shakeel suggested;
- remove the separate 1000-operation accounting threshold;
- add root and leaf memory-cgroup benchmark results for 64, 65, 500, 1000,
  and 1001 operations.

V4:
https://lore.kernel.org/r/cover.1793207025.git.x-professor@xxxxxxxxxxx

Review of v4 1/3 by Shakeel:
https://lore.kernel.org/r/565d855cbd81e0f49018da21df00ff0308f646b1.1793207025.git.x-professor@xxxxxxxxxxx

Yingjie Wang (3):
  ipc/sem: account dynamically allocated sops arrays to memcg
  ipc/sem: reject negative SEMOPM values
  ipc/sem: remove obsolete SEMOPM fragmentation warning

 include/linux/ipc_namespace.h |  3 +++
 include/uapi/linux/sem.h      |  7 +++----
 ipc/ipc_sysctl.c              | 35 ++++++++++++++++++++++++++---------
 ipc/sem.c                     |  3 ++-
 ipc/util.h                    |  9 ---------
 5 files changed, 34 insertions(+), 23 deletions(-)


base-commit: 7be4bc52fd9e0e55dc9a2e0232b89427d2c4b614
-- 
2.43.0