linux.git/kernel/ucount.c, branch v7.3-rc2

binfmt_misc: correctly account pre-opened interpreters

2026-08-03T21:36:18+00:00

An 'F' entry, and every interpreter a 'B' entry binds, holds a file open
from registration until the entry goes away, pinning the file, its inode,
the mount it came from and that mount's superblock. Nothing bounds how
many of those a user namespace can hold. An entry binds at most
BINFMT_MISC_INTERP_MAX interpreters, but nothing caps the entries.

Charge each binding to the user namespace and uid that makes it against a
new UCOUNT_BINFMT_MISC_INTERPRETERS. Going over budget causes -ENOSPC.

A per-instance cap would suck. Instances are keyed on the user
namespace. So any constant is multiplied by the number of namespaces the
caller creates. Creating those is virtually free. A ucount charges the
namespace and every one of its ancestors. And a namespace can raise only
its own limit. So nesting buys nothing.

The knob is /proc/sys/user/max_binfmt_misc_interpreters. Leave it at the
max_threads/2 default fork_init() gives a new type. No existing
configuration comes close to that.

binfmt_misc is tristate, which makes it the first ucount user that can be
built as a module. Export inc_ucount() and dec_ucount(); without them
CONFIG_BINFMT_MISC=m fails to link. Export them to binfmt_misc alone:
charging a ucount type is not something a module has any business doing
in general, and the list is trivial to extend if a second user shows up.
init_user_ns and init_binfmt_misc are already exported for the same
module.

Link: https://patch.msgid.link/20260803-work-binfmt_misc-interplimit-v1-1-4a2435500bd9@kernel.org
Signed-off-by: Christian Brauner (Amutable)

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-22T01:09:51+00:00

This was done entirely with mindless brute force, using

    git grep -l '\

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21T09:02:28+00:00

This is the result of running the Coccinelle script from
scripts/coccinelle/api/kmalloc_objs.cocci. The script is designed to
avoid scalar types (which need careful case-by-case checking), and
instead replace kmalloc-family calls that allocate struct or union
object instances:

Single allocations:	kmalloc(sizeof(TYPE), ...)
are replaced with:	kmalloc_obj(TYPE, ...)

Array allocations:	kmalloc_array(COUNT, sizeof(TYPE), ...)
are replaced with:	kmalloc_objs(TYPE, COUNT, ...)

Flex array allocations:	kmalloc(struct_size(PTR, FAM, COUNT), ...)
are replaced with:	kmalloc_flex(*PTR, FAM, COUNT, ...)

(where TYPE may also be *VAR)

The resulting allocations no longer return "void *", instead returning
"TYPE *".

Signed-off-by: Kees Cook

ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit()

2026-02-01T00:16:08+00:00

The user.* sysctls implement the ctl_table_root::permissions hook and they
override the file access mode based on the CAP_SYS_RESOURCE capability (at
most rwx if capable, at most r-- if not).  The capability is being checked
unconditionally, so if an LSM denies the capability, an audit record may
be logged even when access is in fact granted.

Given the logic in the set_permissions() function in kernel/ucount.c and
the unfortunate way the permission checking is implemented, it doesn't
seem viable to avoid false positive denials by deferring the capability
check.  Thus, do the same as in net_ctl_permissions() (net/sysctl_net.c) -
switch from ns_capable() to ns_capable_noaudit(), so that the check never
logs an audit record.

Link: https://lkml.kernel.org/r/20260122140745.239428-1-omosnace@redhat.com
Fixes: dbec28460a89 ("userns: Add per user namespace sysctls.")
Signed-off-by: Ondrej Mosnacek 
Reviewed-by: Paul Moore 
Acked-by: Serge Hallyn 
Cc: Eric Biederman 
Cc: Alexey Gladkov 
Signed-off-by: Andrew Morton

ucount: use atomic_long_try_cmpxchg() in atomic_long_inc_below()

2025-08-02T19:01:38+00:00

Use atomic_long_try_cmpxchg() instead of
atomic_long_cmpxchg (*ptr, old, new) == old in atomic_long_inc_below().
x86 CMPXCHG instruction returns success in ZF flag, so this change saves
a compare after cmpxchg (and related move instruction in front of cmpxchg).

Also, atomic_long_try_cmpxchg implicitly assigns old *ptr value to "old"
when cmpxchg fails, enabling further code simplifications.

No functional change intended.

Link: https://lkml.kernel.org/r/20250721174610.28361-2-ubizjak@gmail.com
Signed-off-by: Uros Bizjak 
Reviewed-by: Alexey Gladkov 
Cc: Sebastian Andrzej Siewior 
Cc: "Paul E. McKenney" 
Cc: Alexey Gladkov 
Cc: Roman Gushchin 
Cc: MengEn Sun 
Cc: "Thomas Weißschuh" 
Signed-off-by: Andrew Morton

ucount: fix atomic_long_inc_below() argument type

2025-08-02T19:01:38+00:00

The type of u argument of atomic_long_inc_below() should be long to avoid
unwanted truncation to int.

The patch fixes the wrong argument type of an internal function to
prevent unwanted argument truncation.  It fixes an internal locking
primitive; it should not have any direct effect on userspace.

Mark said

: AFAICT there's no problem in practice because atomic_long_inc_below()
: is only used by inc_ucount(), and it looks like the value is
: constrained between 0 and INT_MAX.
: 
: In inc_ucount() the limit value is taken from
: user_namespace::ucount_max[], and AFAICT that's only written by
: sysctls, to the table setup by setup_userns_sysctls(), where
: UCOUNT_ENTRY() limits the value between 0 and INT_MAX.
: 
: This is certainly a cleanup, but there might be no functional issue in
: practice as above.

Link: https://lkml.kernel.org/r/20250721174610.28361-1-ubizjak@gmail.com
Fixes: f9c82a4ea89c ("Increase size of ucounts to atomic_long_t")
Signed-off-by: Uros Bizjak 
Reviewed-by: "Eric W. Biederman" 
Cc: Sebastian Andrzej Siewior 
Cc: "Paul E. McKenney" 
Cc: Alexey Gladkov 
Cc: Roman Gushchin 
Cc: MengEn Sun 
Cc: "Thomas Weißschuh" 
Cc: Mark Rutland 
Signed-off-by: Andrew Morton

ucount: use rcuref_t for reference counting

2025-03-17T05:30:50+00:00

Use rcuref_t for reference counting.  This eliminates the cmpxchg loop in
the get and put path.  This also eliminates the need to acquire the lock
in the put path because once the final user returns the reference, it can
no longer be obtained anymore.

Use rcuref_t for reference counting.

Link: https://lkml.kernel.org/r/20250203150525.456525-5-bigeasy@linutronix.de
Signed-off-by: Sebastian Andrzej Siewior 
Reviewed-by: Paul E. McKenney 
Cc: Thomas Gleixner 
Cc: Boqun Feng 
Cc: Joel Fernandes 
Cc: Josh Triplett 
Cc: Lai jiangshan 
Cc: Mathieu Desnoyers 
Cc: Mengen Sun 
Cc: Steven Rostedt 
Cc: "Uladzislau Rezki (Sony)" 
Cc: YueHong Wu 
Cc: Zqiang 
Signed-off-by: Andrew Morton

ucount: use RCU for ucounts lookups

2025-03-17T05:30:50+00:00

The ucounts element is looked up under ucounts_lock.  This can be
optimized by using RCU for a lockless lookup and return and element if the
reference can be obtained.

Replace hlist_head with hlist_nulls_head which is RCU compatible.  Let
find_ucounts() search for the required item within a RCU section and
return the item if a reference could be obtained.  This means
alloc_ucounts() will always return an element (unless the memory
allocation failed).  Let put_ucounts() RCU free the element if the
reference counter dropped to zero.

Link: https://lkml.kernel.org/r/20250203150525.456525-4-bigeasy@linutronix.de
Signed-off-by: Sebastian Andrzej Siewior 
Reviewed-by: Paul E. McKenney 
Cc: Thomas Gleixner 
Cc: Boqun Feng 
Cc: Joel Fernandes 
Cc: Josh Triplett 
Cc: Lai jiangshan 
Cc: Mathieu Desnoyers 
Cc: Mengen Sun 
Cc: Steven Rostedt 
Cc: "Uladzislau Rezki (Sony)" 
Cc: YueHong Wu 
Cc: Zqiang 
Signed-off-by: Andrew Morton

ucount: replace get_ucounts_or_wrap() with atomic_inc_not_zero()

2025-03-17T05:30:50+00:00

get_ucounts_or_wrap() increments the counter and if the counter is
negative then it decrements it again in order to reset the previous
increment.  This statement can be replaced with atomic_inc_not_zero() to
only increment the counter if it is not yet 0.

This simplifies the get function because the put (if the get failed) can
be removed.  atomic_inc_not_zero() is implement as a cmpxchg() loop which
can be repeated several times if another get/put is performed in parallel.
This will be optimized later.

Increment the reference counter only if not yet dropped to zero.

Link: https://lkml.kernel.org/r/20250203150525.456525-3-bigeasy@linutronix.de
Signed-off-by: Sebastian Andrzej Siewior 
Reviewed-by: Paul E. McKenney 
Cc: Thomas Gleixner 
Cc: Boqun Feng 
Cc: Joel Fernandes 
Cc: Josh Triplett 
Cc: Lai jiangshan 
Cc: Mathieu Desnoyers 
Cc: Mengen Sun 
Cc: Steven Rostedt 
Cc: "Uladzislau Rezki (Sony)" 
Cc: YueHong Wu 
Cc: Zqiang 
Signed-off-by: Andrew Morton

ucounts: move kfree() out of critical zone protected by ucounts_lock

2025-01-13T04:21:00+00:00

Although kfree is a non-sleep function, it is possible to enter a long
chain of calls probabilistically, so it looks better to move kfree from
alloc_ucounts() out of the critical zone of ucounts_lock.

Link: https://lkml.kernel.org/r/1733458427-11794-1-git-send-email-mengensun@tencent.com
Signed-off-by: MengEn Sun 
Reviewed-by: YueHong Wu 
Reviewed-by: Andrew Morton 
Cc: Andrei Vagin 
Cc: Joel Granados 
Cc: Thomas Weißschuh 
Signed-off-by: Andrew Morton