[PATCH] ipc/sem: account enlarged sops arrays to memcg

[Wang Yingjie]

Commit 50ec499b9a43 ("sysctl: allow change system v ipc sysctls
inside ipc namespace") lets an IPC namespace owner change kernel.sem.
The SEMOPM field defaults to 500 but has no semantic range check.

do_semtimedop() allocates nsops * sizeof(struct sembuf) with
GFP_KERNEL. A blocking operation retains that buffer, so a user can
raise SEMOPM and hold large attacker-selected amounts of host kernel
memory without charging the calling task memcg.

On the current mainline base, one 10,000,000-operation call retained
60,936,448 bytes while a 32 MiB cgroup peaked at 909,312 bytes and
reported no limit event. Sixteen 1,000,000-operation calls retained
100,860,416 bytes while the cgroup peaked at 1,310,720 bytes.

Commit 6a4746ba0619 ("ipc: remove memcg accounting for sops objects in
do_semtimedop()") removed accounting on the premise that the buffer was
at most two pages. Preserve that default-sized path, but account arrays
larger than the default SEMOPM value.

With this change, both test configurations reach the 32 MiB cgroup
limit and the caller is terminated by the memcg OOM killer before it
can retain the enlarged arrays.

The sysctl also accepts negative SEMOPM values. Since nsops is unsigned,
SEMOPM=-1 bypasses the intended operation-count check. This change still
accounts any admitted array larger than the default, while leaving
SEMOPM range policy for separate review.

Fixes: 50ec499b9a43 ("sysctl: allow change system v ipc sysctls inside ipc namespace")
Signed-off-by: Yingjie Wang <x-professor@xxxxxxxxxxx>
---
 ipc/sem.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/ipc/sem.c b/ipc/sem.c
index 5ec41de7e85b2b..8c9edecc160763 100644
--- a/ipc/sem.c
+++ b/ipc/sem.c
@@ -2234,7 +2234,9 @@ static long do_semtimedop(int semid, struct sembuf __user *tsops,
 		return -EINVAL;
 
 	if (nsops > SEMOPM_FAST) {
-		sops = kvmalloc_objs(*sops, nsops);
+		gfp_t gfp = nsops > SEMOPM ? GFP_KERNEL_ACCOUNT : GFP_KERNEL;
+
+		sops = kvmalloc_objs(*sops, nsops, gfp);
 		if (sops == NULL)
 			return -ENOMEM;
 	}

base-commit: 2f2f7eeef8b0a1a9b9ca998231419873ccae8d4e
-- 
2.43.0