[PATCH v2 1/3] ipc/sem: account enlarged sops arrays to memcg

[Yingjie Wang]

Commit 6a4746ba0619 ("ipc: remove memcg accounting for sops objects in
do_semtimedop()") removed accounting based on the assumption that sops
arrays would remain small, describing a maximum cost of two pages.

SEMOPM was already tunable. Commit 50ec499b9a43 ("sysctl: allow change
system v ipc sysctls inside ipc namespace") later made that tuning
available to IPC namespace owners without capabilities in the initial
user namespace. A blocking semop() retains its operation array, so
raising SEMOPM permits enlarged arrays to consume user-controlled kernel
memory outside the calling task's memory cgroup.

Use GFP_KERNEL_ACCOUNT when the actual nsops exceeds the compiled-in
SEMOPM default. This preserves the existing allocation behavior for
requests within the default limit while accounting the enlarged arrays.

Link: https://lore.kernel.org/r/20261016152609.2528805-1-x-professor@xxxxxxxxxxx
Fixes: 6a4746ba0619 ("ipc: remove memcg accounting for sops objects in do_semtimedop()")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Yingjie Wang <x-professor@xxxxxxxxxxx>
---
 ipc/sem.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/ipc/sem.c b/ipc/sem.c
index 5ec41de7e85b2..8c9edecc16076 100644
--- a/ipc/sem.c
+++ b/ipc/sem.c
@@ -2234,7 +2234,9 @@ static long do_semtimedop(int semid, struct sembuf __user *tsops,
 		return -EINVAL;
 
 	if (nsops > SEMOPM_FAST) {
-		sops = kvmalloc_objs(*sops, nsops);
+		gfp_t gfp = nsops > SEMOPM ? GFP_KERNEL_ACCOUNT : GFP_KERNEL;
+
+		sops = kvmalloc_objs(*sops, nsops, gfp);
 		if (sops == NULL)
 			return -ENOMEM;
 	}
-- 
2.43.0