Merge tag 'namespace-7.4-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull namespace updates from Christian Brauner:

- Reject uid_map, gid_map and projid_map values that don'

Merge tag 'namespace-7.4-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull namespace updates from Christian Brauner:

- Reject uid_map, gid_map and projid_map values that don't fit in a
u32.

map_write() parsed with simple_strtoul() and truncated modulo 2^32 on
64-bit so "4294967301 1000 1" was installed as "5 1000 1" without an
error. Each field is parsed with kstrtou32() now and selftests cover
the out-of-range, negative and in-range cases. This isn't a security
fix. The truncated values were valid ids and every later check still
applied to them.

- Annotate struct uid_gid_map's forward and reverse pointers with
__counted_by_ptr and add a KUnit suite for inserting and sorting
extents.

insert_extent() wrote to forward[nr_extents] before bumping the count
which the annotation flags, so it bumps first now. Two follow-up
fixes rename the now global helpers to uid_gid_map_insert_extent()
and uid_gid_map_sort(), since the btrfs self-tests have their own
insert_extent(), and guard the declarations on CONFIG_KUNIT.

- Drop the BUG_ON() NULL checks in copy_mnt_ns() and copy_utsname().
create_new_namespaces() always passes a valid pointer and the other
copy_*_ns() helpers don't check either.

- Remove a dead key_put() on the create_user_ns() error path.

* tag 'namespace-7.4-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
selftests/namespaces: add uid_map/gid_map range tests
userns: reject uid_map/gid_map values that do not fit in u32
userns: declare the KUnit-visible helpers whenever KUnit is enabled
userns: rename insert_extent() and sort_idmaps()
userns: Add KUnit test suite for uid_gid_map
userns: Add __counted_by_ptr attribute to struct uid_gid_map
fs: namespace: drop BUG_ON() in copy_mnt_ns()
uts: drop BUG_ON() in copy_utsname()
userns: remove dead key_put() on the create_user_ns() error path

show more ...

Merge patch series "userns: Add __counted_by_ptr attribute to struct uid_gid_map"

Add kunit tests for user namespace idmappings.

* patches from https://patch.msgid.link/20260908222734.3048684-1-mor

Merge patch series "userns: Add __counted_by_ptr attribute to struct uid_gid_map"

Add kunit tests for user namespace idmappings.

* patches from https://patch.msgid.link/20260908222734.3048684-1-morbo@google.com:
userns: Add KUnit test suite for uid_gid_map
userns: Add __counted_by_ptr attribute to struct uid_gid_map

Link: https://patch.msgid.link/20260908222734.3048684-1-morbo@google.com
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>

show more ...

userns: Add KUnit test suite for uid_gid_map

Add a KUnit test suite to verify the insertion and sorting of mappings
in struct uid_gid_map. This test suite validates both base extent
insertion (<= 5

userns: Add KUnit test suite for uid_gid_map

Add a KUnit test suite to verify the insertion and sorting of mappings
in struct uid_gid_map. This test suite validates both base extent
insertion (<= 5 mappings) and extended extent insertion (> 5 mappings,
which triggers the allocation of the forward and reverse pointers).

This is especially useful for verifying that the __counted_by_ptr
attribute added to 'forward' and 'reverse' pointers works correctly
without causing any runtime bounds-checking panics or traps.

Signed-off-by: Bill Wendling <morbo@google.com>
Link: https://patch.msgid.link/20260908222734.3048684-2-morbo@google.com
Tested-by: Bradley Morgan <brads@mainlining.org>
Reviewed-by: Bradley Morgan <brads@mainlining.org>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>

show more ...