Re: [PATCH v2 0/2] userns: reject out-of-range uid_map/gid_map values

[Eric W. Biederman]

Natasha Klaus <natalie.klaus@xxxxxxxxxxxxxxxxxxxxxxx> writes:

> map_write() silently truncates uid_map/gid_map/projid_map values above
> U32_MAX modulo 2^32 on 64-bit kernels, so e.g. "4294967301 1000 1" is
> installed as "5 1000 1" without an error. Patch 1 parses each field
> with kstrtou32() so such values fail with -EINVAL. Patch 2 adds
> selftests for out-of-range and negative values in each field and for
> the unchanged in-range path.
>
> This makes the parser more correct; it is not a security fix.
>
> The patch and the selftest were drafted by Claude Code (Claude Opus 5.5)
> in an interactive session; I reviewed, built and tested them. The
> assistant flagged the truncation while reading map_write(), and I
> confirmed it by writing to uid_map on a running kernel.
>
> Tested on v7.3-rc5-37-g551c722f4080 under virtme-ng, x86_64 defconfig
> with CONFIG_USER_NS: all 12 selftest cases pass on the patched kernel.
> On an unpatched 6.8 host the four above-u32 cases fail as expected,
> seven pass and the root-only case is skipped.

I don't see anything to object to in this one.

Acked-by: "Eric W. Biederman" <ebiederm@xxxxxxxxxxxx>

>
> Changes in v2:
> - Parse each field with kstrtou32() instead of simple_strtoull() plus a
>   separate U32_MAX check (Eric W. Biederman).
> - Selftest: add negative values in each field, "0 <uid> 1", the
>   largest valid first id, a line with extra spaces between fields, and
>   the largest count written by a privileged parent (Eric W. Biederman).
> - Describe patch 1 as making the parser more correct, not as hardening.
> - Rebased onto v7.3-rc5-37-g551c722f4080.
>
> Link: https://lore.kernel.org/all/20260928072537.115668-1-natalie.klaus@xxxxxxxxxxxxxxxxxxxxxxx/
>
> Natasha Klaus (2):
>   userns: reject uid_map/gid_map values that do not fit in u32
>   selftests/namespaces: add uid_map/gid_map range tests
>
>  kernel/user_namespace.c                       |  29 +-
>  tools/testing/selftests/namespaces/.gitignore |   1 +
>  tools/testing/selftests/namespaces/Makefile   |   3 +-
>  .../selftests/namespaces/uid_map_range_test.c | 299 ++++++++++++++++++
>  4 files changed, 328 insertions(+), 4 deletions(-)
>  create mode 100644 tools/testing/selftests/namespaces/uid_map_range_test.c
>
>
> base-commit: 551c722f40809618230001baccf219193e22fc5a