Re: [PATCH v2 2/3] ipc/sem: reject negative SEMOPM values

[Manfred Spraul]

Hi Yingjie,

On 10/23/26 5:19 AM, Yingjie Wang wrote:
>   
> diff --git a/ipc/ipc_sysctl.c b/ipc/ipc_sysctl.c
> index d038d944257f6..2a542f838a530 100644
> --- a/ipc/ipc_sysctl.c
> +++ b/ipc/ipc_sysctl.c
[...]
> +
> +	if (sem_ctls[2] < 0) {
> +		ret = -ERANGE;
> +		goto out_unlock;
> +	}
> +
> +	ret = sem_check_semmni(sem_ctls[3]);
> +	if (ret)
> +		goto out_unlock;
> +

The mixture of an inline sem_check_semmni() function and inline logic 
for semopm looks strange.

I would remove sem_check_semmni().


Reviewed-By: Manfred Spraul <manfred@xxxxxxxxxxxxxxxx>

diff --git a/ipc/ipc_sysctl.c b/ipc/ipc_sysctl.c
index 2a542f838a53..6bfc68f04353 100644
--- a/ipc/ipc_sysctl.c
+++ b/ipc/ipc_sysctl.c
@@ -72,15 +72,17 @@ static int proc_ipc_sem_dointvec(const struct ctl_table *table, int write,
 	if (ret)
 		goto out_unlock;
 
-	if (sem_ctls[2] < 0) {
-		ret = -ERANGE;
+	ret = -ERANGE;
+	// Check semopm range [0, INT_MAX]
+	if (sem_ctls[2] < 0)
 		goto out_unlock;
-	}
 
-	ret = sem_check_semmni(sem_ctls[3]);
-	if (ret)
+	// Check semmni range [0, ipc_mni]
+	if (sem_ctls[3] < 0 || sem_ctls[3] > ipc_mni)
 		goto out_unlock;
 
+	// The values are valid. Apply the changes.
+	ret=0;
 	for (i = 0; i < ARRAY_SIZE(sem_ctls); i++)
 		WRITE_ONCE(ns->sem_ctls[i], sem_ctls[i]);
 
diff --git a/ipc/util.h b/ipc/util.h
index b148b5e15fc6..51b4efa3d6db 100644
--- a/ipc/util.h
+++ b/ipc/util.h
@@ -245,14 +245,6 @@ int ipcget(struct ipc_namespace *ns, struct ipc_ids *ids,
 void free_ipcs(struct ipc_namespace *ns, struct ipc_ids *ids,
 		void (*free)(struct ipc_namespace *, struct kern_ipc_perm *));
 
-static inline int sem_check_semmni(int semmni)
-{
-	/*
-	 * Check semmni range [0, ipc_mni]
-	 */
-	return semmni < 0 || semmni > ipc_mni ? -ERANGE : 0;
-}
-
 #ifdef CONFIG_COMPAT
 #include <linux/compat.h>
 struct compat_ipc_perm {