Re: [PATCH 1/1] ipc: sem: fix used_sems overflow in newary()

[Davidlohr Bueso]

On Sat, 31 Oct 2026, Andrew Morton wrote:

> > On Mon, 11 May 2026 18:42:53 +0800 Ren Wei <n05ec@xxxxxxxxxx> wrote:
>
> Slight delay, sorry!
>
> > From: Ruide Cao <caoruide123@xxxxxxxxx>
> >
> > newary() checks namespace-wide semaphore usage before creating a new
> > array, but the current accounting uses a plain signed addition.
> >
> > If the accumulated semaphore count overflows, the limit check can fail
> > open and allow allocations past sc_semmns, breaking namespace semaphore
> > resource enforcement and potentially leading to resource exhaustion.
> >
> > Fix this by using check_add_overflow() before comparing the new total
> > against sc_semmns, and reject overflow the same way as a true limit
> > exceed.
>
> LLM review tells me
>
> : The fix looks correct. The existing writer lock covers the check and
> : the later used_sems increment, so that increment needs no further
> : change.
>
> and
>
> : Please qualify the changelog. Default SEMMNS and SEMMSL cannot trigger
> : this overflow. It requires raised limits and substantial existing
> : allocations: sem_alloc() separately bounds each array's size, so one
> : enormous request isn't sufficient to demonstrate a successful bypass.
> :
> : With sufficient memory, semget() can then succeed instead of returning
> : ENOSPC, exceed the namespace quota and wrap the semaphore usage reported
> : by SEM_INFO negative. Additional allocations can increase memory
> : pressure.
>
> So I propose this changelog.  Please check:
>
> : newary() checks the namespace-wide semaphore limit using a signed
> : addition of used_sems and nsems. If that addition overflows, the
> : comparison can fail to reject a request which exceeds sc_semmns.
> :
> : The default semaphore limits cannot trigger this overflow. It requires
> : raised limits and substantial existing allocations. sem_alloc()
> : separately bounds each array's allocation size, so a single enormous
> : request is insufficient to demonstrate a successful quota bypass.
> :
> : With enough memory, semget() can succeed instead of returning ENOSPC,
> : allowing allocations beyond the namespace semaphore quota and increasing
> : memory pressure. The wrapped used_sems count can also cause SEM_INFO to
> : report a negative semaphore usage count.
> :
> : Use check_add_overflow() before comparing the new total against
> : sc_semmns, rejecting overflow with ENOSPC. The existing writer lock
> : covers both the check and the later accounting update.

lgtm

Acked-by: Davidlohr Bueso <dave@xxxxxxxxxxxx>