Changes in Makefile

e86d265826b8dc54178e16c4027d3bd5d0299f12 - Merge tag 'namespace-7.4-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Tue, 20 Oct 2026 04:09:10 +0200

Merge tag 'namespace-7.4-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfsPull namespace updates from Christian Brauner: - Reject uid_map, gid_map and projid_map values that don't fit in a u32. map_write() parsed with simple_strtoul() and truncated modulo 2^32 on 64-bit so "4294967301 1000 1" was installed as "5 1000 1" without an error. Each field is parsed with kstrtou32() now and selftests cover the out-of-range, negative and in-range cases. This isn't a security fix. The truncated values were valid ids and every later check still applied to them. - Annotate struct uid_gid_map's forward and reverse pointers with __counted_by_ptr and add a KUnit suite for inserting and sorting extents. insert_extent() wrote to forward[nr_extents] before bumping the count which the annotation flags, so it bumps first now. Two follow-up fixes rename the now global helpers to uid_gid_map_insert_extent() and uid_gid_map_sort(), since the btrfs self-tests have their own insert_extent(), and guard the declarations on CONFIG_KUNIT. - Drop the BUG_ON() NULL checks in copy_mnt_ns() and copy_utsname(). create_new_namespaces() always passes a valid pointer and the other copy_*_ns() helpers don't check either. - Remove a dead key_put() on the create_user_ns() error path.* tag 'namespace-7.4-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: selftests/namespaces: add uid_map/gid_map range tests userns: reject uid_map/gid_map values that do not fit in u32 userns: declare the KUnit-visible helpers whenever KUnit is enabled userns: rename insert_extent() and sort_idmaps() userns: Add KUnit test suite for uid_gid_map userns: Add __counted_by_ptr attribute to struct uid_gid_map fs: namespace: drop BUG_ON() in copy_mnt_ns() uts: drop BUG_ON() in copy_utsname() userns: remove dead key_put() on the create_user_ns() error path List of files: /linux/tools/testing/selftests/namespaces/Makefile

fbc59bc7f05c62b0c1607b92eaf8175e75ef755d - Merge patch series "userns: reject out-of-range uid_map/gid_map values"

Mon, 12 Oct 2026 11:01:24 +0200

Merge patch series "userns: reject out-of-range uid_map/gid_map values"Natasha Klaus says:map_write() silently truncates uid_map/gid_map/projid_map values aboveU32_MAX modulo 2^32 on 64-bit kernels, so e.g. "4294967301 1000 1" isinstalled as "5 1000 1" without an error. Patch 1 parses each fieldwith kstrtou32() so such values fail with -EINVAL. Patch 2 addsselftests for out-of-range and negative values in each field and forthe unchanged in-range path.This makes the parser more correct; it is not a security fix.The patch and the selftest were drafted by Claude Code (Claude Opus 5.5)in an interactive session; I reviewed, built and tested them. Theassistant flagged the truncation while reading map_write(), and Iconfirmed it by writing to uid_map on a running kernel.Tested on v7.3-rc5-37-g551c722f4080 under virtme-ng, x86_64 defconfigwith CONFIG_USER_NS: all 12 selftest cases pass on the patched kernel.On an unpatched 6.8 host the four above-u32 cases fail as expected,seven pass and the root-only case is skipped.Link: https://lore.kernel.org/all/20260928072537.115668-1-natalie.klaus@runtimeverification.com/* patches from https://patch.msgid.link/20260930112854.373184-1-natalie.klaus@runtimeverification.com: selftests/namespaces: add uid_map/gid_map range tests userns: reject uid_map/gid_map values that do not fit in u32Link: https://patch.msgid.link/20260930112854.373184-1-natalie.klaus@runtimeverification.comSigned-off-by: Christian Brauner (Amutable) List of files: /linux/tools/testing/selftests/namespaces/Makefile

8b7b7739ea6a8797391189c6d07897584b611f7f - selftests/namespaces: add uid_map/gid_map range tests

Wed, 30 Sep 2026 13:28:54 +0200

selftests/namespaces: add uid_map/gid_map range testsCheck that a uid_map or gid_map line with a value that does not fit inu32, or with a negative value, is rejected with EINVAL and installsnothing, for each of the three fields.Check that in-range lines are still accepted and read back unchanged:a plain single-id mapping, first id 0, the largest valid first id4294967294, and a line with extra spaces between the fields. When runas root in the initial user namespace, also check that the largestcount, "0 0 4294967295", is accepted when written by the parent intothe uid_map of a child namespace; an unprivileged writer can only mapa single id.Signed-off-by: Natasha Klaus Link: https://patch.msgid.link/20260930112854.373184-3-natalie.klaus@runtimeverification.comAcked-by: "Eric W. Biederman" Signed-off-by: Christian Brauner (Amutable) List of files: /linux/tools/testing/selftests/namespaces/Makefile

8edf8b09fc44990977b3fbcb708035b1740d0b7e - Merge drm/drm-next into drm-intel-gt-next

Tue, 12 May 2026 10:16:35 +0200

Merge drm/drm-next into drm-intel-gt-nextBackmerging to pull in commit 5401b9adebc9 ("i915: don't usea vma that didn't match the context VM") to revert it.Signed-off-by: Joonas Lahtinen List of files: /linux/tools/testing/selftests/namespaces/Makefile

f4b369c6fe0ceaba2da2daff8c9eb415f85926dd - Merge branch 'next' into for-linus

Mon, 20 Apr 2026 03:28:57 +0200

Merge branch 'next' into for-linusPrepare input updates for 7.1 merge window. List of files: /linux/tools/testing/selftests/namespaces/Makefile

0421ccdfad0d92713a812a5aeb7d07b0ea7213c8 - Merge tag 'v7.0-rc3' into next

Thu, 12 Mar 2026 18:44:42 +0100

Merge tag 'v7.0-rc3' into nextSync up with the mainline to brig up the latest changes, specificallychanges to ALPS driver. List of files: /linux/tools/testing/selftests/namespaces/Makefile

cc4adab164b772a34b3340d644b7c4728498581e - Merge tag 'v6.19-rc1' into msm-next

Tue, 20 Jan 2026 23:06:55 +0100

Merge tag 'v6.19-rc1' into msm-nextMerge Linux 6.19-rc1 in order to catch up with other changes (e.g. UBWCconfig database defining UBWC_6).Signed-off-by: Dmitry Baryshkov List of files: /linux/tools/testing/selftests/namespaces/Makefile

5add3c3c280a35f7e258e9cef7607db5a2e56fdc - Merge drm/drm-next into drm-xe-next

Fri, 19 Dec 2025 11:51:22 +0100

Merge drm/drm-next into drm-xe-nextBackmerging to bring in 6.19-rc1. An important upstream bugfix andto help unblock PTL CI.Signed-off-by: Thomas Hellström List of files: /linux/tools/testing/selftests/namespaces/Makefile

b8304863a3990d0f18c38e5b94191830a63ee1af - Merge drm/drm-next into drm-intel-next

Mon, 15 Dec 2025 14:24:02 +0100

Merge drm/drm-next into drm-intel-nextSync-up some display code needed for Async flips refactor.Signed-off-by: Rodrigo Vivi List of files: /linux/tools/testing/selftests/namespaces/Makefile

7f790dd21a931c61167f7bdc327aecf2cebad327 - Merge drm/drm-next into drm-misc-next

Mon, 15 Dec 2025 09:27:39 +0100

Merge drm/drm-next into drm-misc-nextLet's kickstart the v6.20 (7.0?) release cycle.Signed-off-by: Maxime Ripard List of files: /linux/tools/testing/selftests/namespaces/Makefile

a4a508df2aa34f8650afde54ea804321c618f45f - Merge tag 'v6.18' into next

Sat, 13 Dec 2025 10:18:20 +0100

Merge tag 'v6.18' into nextSync up with the mainline to bring in the latest APIs. List of files: /linux/tools/testing/selftests/namespaces/Makefile

24f171c7e145f43b9f187578e89b0982ce87e54c - Merge tag 'asoc-fix-v6.19-rc1' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus

Sun, 21 Dec 2025 11:11:11 +0100

Merge tag 'asoc-fix-v6.19-rc1' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linusASoC: Fixes for v6.19We've been quite busy with fixes since the merge window, though not inany particularly exciting ways - the standout thing is the fix for _SXcontrols which were broken by a change to how we do clamping, otherwiseit's all fairly run of the mill fixes and quirks. List of files: /linux/tools/testing/selftests/namespaces/Makefile

84318277d6334c6981ab326d4acc87c6a6ddc9b8 - Merge remote-tracking branch 'drm/drm-fixes' into drm-misc-fixes

Mon, 15 Dec 2025 12:53:27 +0100

Merge remote-tracking branch 'drm/drm-fixes' into drm-misc-fixesPull in rc1 to include all changes since the merge window closed,and grab all fixes and changes from drm/drm-next.Signed-off-by: Maarten Lankhorst List of files: /linux/tools/testing/selftests/namespaces/Makefile

cb9f145f638d7afa633632a9290d6ad06caeb8ee - Merge remote-tracking branch 'drm/drm-next' into msm-next-robclark

Sat, 01 Nov 2025 13:47:30 +0100

Merge remote-tracking branch 'drm/drm-next' into msm-next-robclarkBack-merge drm-next to get caught up.Signed-off-by: Rob Clark List of files: /linux/tools/testing/selftests/namespaces/Makefile

82ee50252dc891e3f3b32d923bb4f656d300b772 - Merge drm/drm-next into drm-xe-next

Tue, 14 Oct 2025 11:31:49 +0200

Merge drm/drm-next into drm-xe-nextBackmerging to bring in 6.18-rc1.Signed-off-by: Thomas Hellström List of files: /linux/tools/testing/selftests/namespaces/Makefile

2acee98fcc61052d63fab4539fcb6ee677555645 - Merge drm/drm-next into drm-intel-next

Tue, 14 Oct 2025 09:37:11 +0200

Merge drm/drm-next into drm-intel-nextSync to v6.18-rc1.Signed-off-by: Jani Nikula List of files: /linux/tools/testing/selftests/namespaces/Makefile

9b966ae42235a88eaea714be09ff3d698535bdfe - Merge drm/drm-next into drm-misc-next

Mon, 13 Oct 2025 09:19:19 +0200

Merge drm/drm-next into drm-misc-nextUpdating drm-misc-next to the state of v6.18-rc1.Signed-off-by: Thomas Zimmermann List of files: /linux/tools/testing/selftests/namespaces/Makefile

2ace52718376fdb56aca863da2eebe70d7e2ddb1 - Merge branch 'objtool/core'

Fri, 21 Nov 2025 11:21:20 +0100

Merge branch 'objtool/core'Bring in the UDB and objtool data annotations to avoid conflicts while further extending the bug exceptions.Signed-off-by: Peter Zijlstra List of files: /linux/tools/testing/selftests/namespaces/Makefile

415d34b92c1f921a9ff3c38f56319cbc5536f642 - Merge tag 'namespace-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Mon, 01 Dec 2025 18:47:41 +0100

Merge tag 'namespace-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfsPull namespace updates from Christian Brauner: "This contains substantial namespace infrastructure changes including a new system call, active reference counting, and extensive header cleanups. The branch depends on the shared kbuild branch for -fms-extensions support. Features: - listns() system call Add a new listns() system call that allows userspace to iterate through namespaces in the system. This provides a programmatic interface to discover and inspect namespaces, addressing longstanding limitations: Currently, there is no direct way for userspace to enumerate namespaces. Applications must resort to scanning /proc/*/ns/ across all processes, which is: - Inefficient - requires iterating over all processes - Incomplete - misses namespaces not attached to any running process but kept alive by file descriptors, bind mounts, or parent references - Permission-heavy - requires access to /proc for many processes - No ordering or ownership information - No filtering per namespace type The listns() system call solves these problems: ssize_t listns(const struct ns_id_req *req, u64 *ns_ids, size_t nr_ns_ids, unsigned int flags); struct ns_id_req { __u32 size; __u32 spare; __u64 ns_id; struct /* listns */ { __u32 ns_type; __u32 spare2; __u64 user_ns_id; }; }; Features include: - Pagination support for large namespace sets - Filtering by namespace type (MNT_NS, NET_NS, USER_NS, etc.) - Filtering by owning user namespace - Permission checks respecting namespace isolation - Active Reference Counting Introduce an active reference count that tracks namespace visibility to userspace. A namespace is visible in the following cases: - The namespace is in use by a task - The namespace is persisted through a VFS object (namespace file descriptor or bind-mount) - The namespace is a hierarchical type and is the parent of child namespaces The active reference count does not regulate lifetime (that's still done by the normal reference count) - it only regulates visibility to namespace file handles and listns(). This prevents resurrection of namespaces that are pinned only for internal kernel reasons (e.g., user namespaces held by file->f_cred, lazy TLB references on idle CPUs, etc.) which should not be accessible via (1)-(3). - Unified Namespace Tree Introduce a unified tree structure for all namespaces with: - Fixed IDs assigned to initial namespaces - Lookup based solely on inode number - Maintained list of owned namespaces per user namespace - Simplified rbtree comparison helpers Cleanups - Header Reorganization: - Move namespace types into separate header (ns_common_types.h) - Decouple nstree from ns_common header - Move nstree types into separate header - Switch to new ns_tree_{node,root} structures with helper functions - Use guards for ns_tree_lock - Initial Namespace Reference Count Optimization - Make all reference counts on initial namespaces a nop to avoid pointless cacheline ping-pong for namespaces that can never go away - Drop custom reference count initialization for initial namespaces - Add NS_COMMON_INIT() macro and use it for all namespaces - pid: rely on common reference count behavior - Miscellaneous Cleanups - Rename exit_task_namespaces() to exit_nsproxy_namespaces() - Rename is_initial_namespace() and make argument const - Use boolean to indicate anonymous mount namespace - Simplify owner list iteration in nstree - nsfs: raise SB_I_NODEV, SB_I_NOEXEC, and DCACHE_DONTCACHE explicitly - nsfs: use inode_just_drop() - pidfs: raise DCACHE_DONTCACHE explicitly - pidfs: simplify PIDFD_GET__NAMESPACE ioctls - libfs: allow to specify s_d_flags - cgroup: add cgroup namespace to tree after owner is set - nsproxy: fix free_nsproxy() and simplify create_new_namespaces() Fixes: - setns(pidfd, ...) race condition Fix a subtle race when using pidfds with setns(). When the target task exits after prepare_nsset() but before commit_nsset(), the namespace's active reference count might have been dropped. If setns() then installs the namespaces, it would bump the active reference count from zero without taking the required reference on the owner namespace, leading to underflow when later decremented. The fix resurrects the ownership chain if necessary - if the caller succeeded in grabbing passive references, the setns() should succeed even if the target task exits or gets reaped. - Return EFAULT on put_user() error instead of success - Make sure references are dropped outside of RCU lock (some namespaces like mount namespace sleep when putting the last reference) - Don't skip active reference count initialization for network namespace - Add asserts for active refcount underflow - Add asserts for initial namespace reference counts (both passive and active) - ipc: enable is_ns_init_id() assertions - Fix kernel-doc comments for internal nstree functions - Selftests - 15 active reference count tests - 9 listns() functionality tests - 7 listns() permission tests - 12 inactive namespace resurrection tests - 3 threaded active reference count tests - commit_creds() active reference tests - Pagination and stress tests - EFAULT handling test - nsid tests fixes"* tag 'namespace-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (103 commits) pidfs: simplify PIDFD_GET__NAMESPACE ioctls nstree: fix kernel-doc comments for internal functions nsproxy: fix free_nsproxy() and simplify create_new_namespaces() selftests/namespaces: fix nsid tests ns: drop custom reference count initialization for initial namespaces pid: rely on common reference count behavior ns: add asserts for initial namespace active reference counts ns: add asserts for initial namespace reference counts ns: make all reference counts on initial namespace a nop ipc: enable is_ns_init_id() assertions fs: use boolean to indicate anonymous mount namespace ns: rename is_initial_namespace() ns: make is_initial_namespace() argument const nstree: use guards for ns_tree_lock nstree: simplify owner list iteration nstree: switch to new structures nstree: add helper to operate on struct ns_tree_{node,root} nstree: move nstree types into separate header nstree: decouple from ns_common header ns: move namespace types into separate header ... List of files: /linux/tools/testing/selftests/namespaces/Makefile

ae901e5e2e9b079761d26a366e0c80530d8aad22 - Merge patch series "ns: fixes for namespace iteration and active reference counting"

Mon, 10 Nov 2025 10:21:00 +0100

Merge patch series "ns: fixes for namespace iteration and active reference counting"Christian Brauner says:* Make sure to initialize the active reference count for the initial network namespace and prevent __ns_common_init() from returning too early.* Make sure that passive reference counts are dropped outside of rcu read locks as some namespaces such as the mount namespace do in fact sleep when putting the last reference.* The setns() system call supports: (1) namespace file descriptors (nsfd) (2) process file descriptors (pidfd) When using nsfds the namespaces will remain active because they are pinned by the vfs. However, when pidfds are used things are more complicated. When the target task exits and passes through exit_nsproxy_namespaces() or is reaped and thus also passes through exit_cred_namespaces() after the setns()'ing task has called prepare_nsset() but before the active reference count of the set of namespaces it wants to setns() to might have been dropped already: P1 P2 pid_p1 = clone(CLONE_NEWUSER | CLONE_NEWNET | CLONE_NEWNS) pidfd = pidfd_open(pid_p1) setns(pidfd, CLONE_NEWUSER | CLONE_NEWNET | CLONE_NEWNS) prepare_nsset() exit(0) // ns->__ns_active_ref == 1 // parent_ns->__ns_active_ref == 1 -> exit_nsproxy_namespaces() -> exit_cred_namespaces() // ns_active_ref_put() will also put // the reference on the owner of the // namespace. If the only reason the // owning namespace was alive was // because it was a parent of @ns // it's active reference count now goes // to zero... -------------------------------- // | // ns->__ns_active_ref == 0 | // parent_ns->__ns_active_ref == 0 | | commit_nsset() -----------------> // If setns() // now manages to install the namespaces // it will call ns_active_ref_get() // on them thus bumping the active reference // count from zero again but without also // taking the required reference on the owner. // Thus we get: // // ns->__ns_active_ref == 1 // parent_ns->__ns_active_ref == 0 When later someone does ns_active_ref_put() on @ns it will underflow parent_ns->__ns_active_ref leading to a splat from our asserts thinking there are still active references when in fact the counter just underflowed. So resurrect the ownership chain if necessary as well. If the caller succeeded to grab passive references to the set of namespaces the setns() should simply succeed even if the target task exists or gets reaped in the meantime. The race is rare and can only be triggered when using pidfs to setns() to namespaces. Also note that active reference on initial namespaces are nops. Since we now always handle parent references directly we can drop ns_ref_active_get_owner() when adding a namespace to a namespace tree. This is now all handled uniformly in the places where the new namespaces actually become active.* patches from https://patch.msgid.link/20251109-namespace-6-19-fixes-v1-0-ae8a4ad5a3b3@kernel.org: selftests/namespaces: test for efault selftests/namespaces: add active reference count regression test ns: add asserts for active refcount underflow ns: handle setns(pidfd, ...) cleanly ns: return EFAULT on put_user() error ns: make sure reference are dropped outside of rcu lock ns: don't increment or decrement initial namespaces ns: don't skip active reference count initializationLink: https://patch.msgid.link/20251109-namespace-6-19-fixes-v1-0-ae8a4ad5a3b3@kernel.orgSigned-off-by: Christian Brauner List of files: /linux/tools/testing/selftests/namespaces/Makefile