executor: restrict ipc resource usage

For context see:
https://groups.google.com/d/msg/syzkaller-bugs/ZaBzAJbn6i8/Py9FVlAqDQAJ

1 files changed, 25 insertions, 1 deletions

diff --git a/executor/common_linux.h b/executor/common_linux.h
index 5528257ac..56d5e15ab 100644
--- a/executor/common_linux.h
+++ b/executor/common_linux.h
@@ -902,7 +902,8 @@ static long syz_kvm_setup_cpu(long a0, long a1, long a2, long a3, long a4, long
 #endif
 #endif
 
-#if SYZ_EXECUTOR || SYZ_FAULT_INJECTION || SYZ_SANDBOX_NAMESPACE || SYZ_ENABLE_CGROUPS
+#if SYZ_EXECUTOR || SYZ_FAULT_INJECTION || SYZ_ENABLE_CGROUPS || SYZ_SANDBOX_NONE || \
+    SYZ_SANDBOX_SETUID || SYZ_SANDBOX_NAMESPACE || SYZ_SANDBOX_ANDROID_UNTRUSTED_APP
 #include <errno.h>
 #include <fcntl.h>
 #include <stdarg.h>
@@ -1557,6 +1558,29 @@ static void sandbox_common()
 	if (unshare(CLONE_SYSVSEM)) {
 		debug("unshare(CLONE_SYSVSEM): %d\n", errno);
 	}
+	// These sysctl's restrict ipc resource usage (by default it's possible
+	// to eat all system memory by creating e.g. lots of large sem sets).
+	// These sysctl's are per-namespace, so we need to set them inside
+	// of the test ipc namespace (after CLONE_NEWIPC).
+	typedef struct {
+		const char* name;
+		const char* value;
+	} sysctl_t;
+	static const sysctl_t sysctls[] = {
+	    {"/proc/sys/kernel/shmmax", "16777216"},
+	    {"/proc/sys/kernel/shmall", "536870912"},
+	    {"/proc/sys/kernel/shmmni", "1024"},
+	    {"/proc/sys/kernel/msgmax", "8192"},
+	    {"/proc/sys/kernel/msgmni", "1024"},
+	    {"/proc/sys/kernel/msgmnb", "1024"},
+	    {"/proc/sys/kernel/sem", "1024 1048576 500 1024"},
+	};
+	unsigned i;
+	for (i = 0; i < sizeof(sysctls) / sizeof(sysctls[0]); i++) {
+		if (!write_file(sysctls[i].name, sysctls[i].value)) {
+			debug("failed to set sysctl %s=%s\n", sysctls[i].name, sysctls[i].value);
+		}
+	}
 }
 
 int wait_for_loop(int pid)