Merge tag 'namespace-7.4-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull namespace updates from Christian Brauner:

- Reject uid_map, gid_map and projid_map values that don'

Merge tag 'namespace-7.4-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull namespace updates from Christian Brauner:

- Reject uid_map, gid_map and projid_map values that don't fit in a
u32.

map_write() parsed with simple_strtoul() and truncated modulo 2^32 on
64-bit so "4294967301 1000 1" was installed as "5 1000 1" without an
error. Each field is parsed with kstrtou32() now and selftests cover
the out-of-range, negative and in-range cases. This isn't a security
fix. The truncated values were valid ids and every later check still
applied to them.

- Annotate struct uid_gid_map's forward and reverse pointers with
__counted_by_ptr and add a KUnit suite for inserting and sorting
extents.

insert_extent() wrote to forward[nr_extents] before bumping the count
which the annotation flags, so it bumps first now. Two follow-up
fixes rename the now global helpers to uid_gid_map_insert_extent()
and uid_gid_map_sort(), since the btrfs self-tests have their own
insert_extent(), and guard the declarations on CONFIG_KUNIT.

- Drop the BUG_ON() NULL checks in copy_mnt_ns() and copy_utsname().
create_new_namespaces() always passes a valid pointer and the other
copy_*_ns() helpers don't check either.

- Remove a dead key_put() on the create_user_ns() error path.

* tag 'namespace-7.4-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
selftests/namespaces: add uid_map/gid_map range tests
userns: reject uid_map/gid_map values that do not fit in u32
userns: declare the KUnit-visible helpers whenever KUnit is enabled
userns: rename insert_extent() and sort_idmaps()
userns: Add KUnit test suite for uid_gid_map
userns: Add __counted_by_ptr attribute to struct uid_gid_map
fs: namespace: drop BUG_ON() in copy_mnt_ns()
uts: drop BUG_ON() in copy_utsname()
userns: remove dead key_put() on the create_user_ns() error path

show more ...

Merge patch series "userns: reject out-of-range uid_map/gid_map values"

Natasha Klaus <natalie.klaus@runtimeverification.com> says:

map_write() silently truncates uid_map/gid_map/projid_map values

Merge patch series "userns: reject out-of-range uid_map/gid_map values"

Natasha Klaus <natalie.klaus@runtimeverification.com> says:

map_write() silently truncates uid_map/gid_map/projid_map values above
U32_MAX modulo 2^32 on 64-bit kernels, so e.g. "4294967301 1000 1" is
installed as "5 1000 1" without an error. Patch 1 parses each field
with kstrtou32() so such values fail with -EINVAL. Patch 2 adds
selftests for out-of-range and negative values in each field and for
the unchanged in-range path.

This makes the parser more correct; it is not a security fix.

The patch and the selftest were drafted by Claude Code (Claude Opus 5.5)
in an interactive session; I reviewed, built and tested them. The
assistant flagged the truncation while reading map_write(), and I
confirmed it by writing to uid_map on a running kernel.

Tested on v7.3-rc5-37-g551c722f4080 under virtme-ng, x86_64 defconfig
with CONFIG_USER_NS: all 12 selftest cases pass on the patched kernel.
On an unpatched 6.8 host the four above-u32 cases fail as expected,
seven pass and the root-only case is skipped.

Link: https://lore.kernel.org/all/20260928072537.115668-1-natalie.klaus@runtimeverification.com/

* patches from https://patch.msgid.link/20260930112854.373184-1-natalie.klaus@runtimeverification.com:
selftests/namespaces: add uid_map/gid_map range tests
userns: reject uid_map/gid_map values that do not fit in u32

Link: https://patch.msgid.link/20260930112854.373184-1-natalie.klaus@runtimeverification.com
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>

show more ...

selftests/namespaces: add uid_map/gid_map range tests

Check that a uid_map or gid_map line with a value that does not fit in
u32, or with a negative value, is rejected with EINVAL and installs
nothi

selftests/namespaces: add uid_map/gid_map range tests

Check that a uid_map or gid_map line with a value that does not fit in
u32, or with a negative value, is rejected with EINVAL and installs
nothing, for each of the three fields.

Check that in-range lines are still accepted and read back unchanged:
a plain single-id mapping, first id 0, the largest valid first id
4294967294, and a line with extra spaces between the fields. When run
as root in the initial user namespace, also check that the largest
count, "0 0 4294967295", is accepted when written by the parent into
the uid_map of a child namespace; an unprivileged writer can only map
a single id.

Signed-off-by: Natasha Klaus <natalie.klaus@runtimeverification.com>
Link: https://patch.msgid.link/20260930112854.373184-3-natalie.klaus@runtimeverification.com
Acked-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>

show more ...