Re: [PATCH 1/1] ipc: sem: fix used_sems overflow in newary()

[Yuan Tan]

On Fri, Nov 6, 2026 at 10:18 PM Davidlohr Bueso <dave@xxxxxxxxxxxx> wrote:
>
> On Sat, 31 Oct 2026, Andrew Morton wrote:
>
> >> On Mon, 11 May 2026 18:42:53 +0800 Ren Wei <n05ec@xxxxxxxxxx> wrote:
> >
> >Slight delay, sorry!
> >
> >> From: Ruide Cao <caoruide123@xxxxxxxxx>
> >>
> >> newary() checks namespace-wide semaphore usage before creating a new
> >> array, but the current accounting uses a plain signed addition.
> >>
> >> If the accumulated semaphore count overflows, the limit check can fail
> >> open and allow allocations past sc_semmns, breaking namespace semaphore
> >> resource enforcement and potentially leading to resource exhaustion.
> >>
> >> Fix this by using check_add_overflow() before comparing the new total
> >> against sc_semmns, and reject overflow the same way as a true limit
> >> exceed.
> >
> >LLM review tells me
> >
> >: The fix looks correct. The existing writer lock covers the check and
> >: the later used_sems increment, so that increment needs no further
> >: change.
> >
> >and
> >
> >: Please qualify the changelog. Default SEMMNS and SEMMSL cannot trigger
> >: this overflow. It requires raised limits and substantial existing
> >: allocations: sem_alloc() separately bounds each array's size, so one
> >: enormous request isn't sufficient to demonstrate a successful bypass.
> >:
> >: With sufficient memory, semget() can then succeed instead of returning
> >: ENOSPC, exceed the namespace quota and wrap the semaphore usage reported
> >: by SEM_INFO negative. Additional allocations can increase memory
> >: pressure.
> >
> >So I propose this changelog.  Please check:

This patch is from quite a while ago. Sorry, we forgot to follow up on it.

Should we send a v2 with the updated commit message? Or could you
update the commit message when applying the patch?

> >
> >: newary() checks the namespace-wide semaphore limit using a signed
> >: addition of used_sems and nsems. If that addition overflows, the
> >: comparison can fail to reject a request which exceeds sc_semmns.
> >:
> >: The default semaphore limits cannot trigger this overflow. It requires
> >: raised limits and substantial existing allocations. sem_alloc()
> >: separately bounds each array's allocation size, so a single enormous
> >: request is insufficient to demonstrate a successful quota bypass.
> >:
> >: With enough memory, semget() can succeed instead of returning ENOSPC,
> >: allowing allocations beyond the namespace semaphore quota and increasing
> >: memory pressure. The wrapped used_sems count can also cause SEM_INFO to
> >: report a negative semaphore usage count.
> >:
> >: Use check_add_overflow() before comparing the new total against
> >: sc_semmns, rejecting overflow with ENOSPC. The existing writer lock
> >: covers both the check and the later accounting update.
>
> lgtm
>
> Acked-by: Davidlohr Bueso <dave@xxxxxxxxxxxx>