Changes in uid_map_range_test.c

e86d265826b8dc54178e16c4027d3bd5d0299f12 - Merge tag 'namespace-7.4-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Tue, 20 Oct 2026 04:09:10 +0200

Merge tag 'namespace-7.4-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfsPull namespace updates from Christian Brauner: - Reject uid_map, gid_map and projid_map values that don't fit in a u32. map_write() parsed with simple_strtoul() and truncated modulo 2^32 on 64-bit so "4294967301 1000 1" was installed as "5 1000 1" without an error. Each field is parsed with kstrtou32() now and selftests cover the out-of-range, negative and in-range cases. This isn't a security fix. The truncated values were valid ids and every later check still applied to them. - Annotate struct uid_gid_map's forward and reverse pointers with __counted_by_ptr and add a KUnit suite for inserting and sorting extents. insert_extent() wrote to forward[nr_extents] before bumping the count which the annotation flags, so it bumps first now. Two follow-up fixes rename the now global helpers to uid_gid_map_insert_extent() and uid_gid_map_sort(), since the btrfs self-tests have their own insert_extent(), and guard the declarations on CONFIG_KUNIT. - Drop the BUG_ON() NULL checks in copy_mnt_ns() and copy_utsname(). create_new_namespaces() always passes a valid pointer and the other copy_*_ns() helpers don't check either. - Remove a dead key_put() on the create_user_ns() error path.* tag 'namespace-7.4-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: selftests/namespaces: add uid_map/gid_map range tests userns: reject uid_map/gid_map values that do not fit in u32 userns: declare the KUnit-visible helpers whenever KUnit is enabled userns: rename insert_extent() and sort_idmaps() userns: Add KUnit test suite for uid_gid_map userns: Add __counted_by_ptr attribute to struct uid_gid_map fs: namespace: drop BUG_ON() in copy_mnt_ns() uts: drop BUG_ON() in copy_utsname() userns: remove dead key_put() on the create_user_ns() error path List of files: /linux/tools/testing/selftests/namespaces/uid_map_range_test.c

fbc59bc7f05c62b0c1607b92eaf8175e75ef755d - Merge patch series "userns: reject out-of-range uid_map/gid_map values"

Mon, 12 Oct 2026 11:01:24 +0200

Merge patch series "userns: reject out-of-range uid_map/gid_map values"Natasha Klaus says:map_write() silently truncates uid_map/gid_map/projid_map values aboveU32_MAX modulo 2^32 on 64-bit kernels, so e.g. "4294967301 1000 1" isinstalled as "5 1000 1" without an error. Patch 1 parses each fieldwith kstrtou32() so such values fail with -EINVAL. Patch 2 addsselftests for out-of-range and negative values in each field and forthe unchanged in-range path.This makes the parser more correct; it is not a security fix.The patch and the selftest were drafted by Claude Code (Claude Opus 5.5)in an interactive session; I reviewed, built and tested them. Theassistant flagged the truncation while reading map_write(), and Iconfirmed it by writing to uid_map on a running kernel.Tested on v7.3-rc5-37-g551c722f4080 under virtme-ng, x86_64 defconfigwith CONFIG_USER_NS: all 12 selftest cases pass on the patched kernel.On an unpatched 6.8 host the four above-u32 cases fail as expected,seven pass and the root-only case is skipped.Link: https://lore.kernel.org/all/20260928072537.115668-1-natalie.klaus@runtimeverification.com/* patches from https://patch.msgid.link/20260930112854.373184-1-natalie.klaus@runtimeverification.com: selftests/namespaces: add uid_map/gid_map range tests userns: reject uid_map/gid_map values that do not fit in u32Link: https://patch.msgid.link/20260930112854.373184-1-natalie.klaus@runtimeverification.comSigned-off-by: Christian Brauner (Amutable) List of files: /linux/tools/testing/selftests/namespaces/uid_map_range_test.c

8b7b7739ea6a8797391189c6d07897584b611f7f - selftests/namespaces: add uid_map/gid_map range tests

Wed, 30 Sep 2026 13:28:54 +0200

selftests/namespaces: add uid_map/gid_map range testsCheck that a uid_map or gid_map line with a value that does not fit inu32, or with a negative value, is rejected with EINVAL and installsnothing, for each of the three fields.Check that in-range lines are still accepted and read back unchanged:a plain single-id mapping, first id 0, the largest valid first id4294967294, and a line with extra spaces between the fields. When runas root in the initial user namespace, also check that the largestcount, "0 0 4294967295", is accepted when written by the parent intothe uid_map of a child namespace; an unprivileged writer can only mapa single id.Signed-off-by: Natasha Klaus Link: https://patch.msgid.link/20260930112854.373184-3-natalie.klaus@runtimeverification.comAcked-by: "Eric W. Biederman" Signed-off-by: Christian Brauner (Amutable) List of files: /linux/tools/testing/selftests/namespaces/uid_map_range_test.c