Natasha Klaus <[email protected]> writes: > map_write() silently truncates uid_map/gid_map/projid_map values above > U32_MAX modulo 2^32 on 64-bit kernels, so e.g. "4294967301 1000 1" is > installed as "5 1000 1" without an error. Patch 1 parses each field > with kstrtou32() so such values fail with -EINVAL. Patch 2 adds > selftests for out-of-range and negative values in each field and for > the unchanged in-range path. > > This makes the parser more correct; it is not a security fix. > > The patch and the selftest were drafted by Claude Code (Claude Opus 5.5) > in an interactive session; I reviewed, built and tested them. The > assistant flagged the truncation while reading map_write(), and I > confirmed it by writing to uid_map on a running kernel. > > Tested on v7.3-rc5-37-g551c722f4080 under virtme-ng, x86_64 defconfig > with CONFIG_USER_NS: all 12 selftest cases pass on the patched kernel. > On an unpatched 6.8 host the four above-u32 cases fail as expected, > seven pass and the root-only case is skipped.
I don't see anything to object to in this one. Acked-by: "Eric W. Biederman" <[email protected]> > > Changes in v2: > - Parse each field with kstrtou32() instead of simple_strtoull() plus a > separate U32_MAX check (Eric W. Biederman). > - Selftest: add negative values in each field, "0 <uid> 1", the > largest valid first id, a line with extra spaces between fields, and > the largest count written by a privileged parent (Eric W. Biederman). > - Describe patch 1 as making the parser more correct, not as hardening. > - Rebased onto v7.3-rc5-37-g551c722f4080. > > Link: > https://lore.kernel.org/all/[email protected]/ > > Natasha Klaus (2): > userns: reject uid_map/gid_map values that do not fit in u32 > selftests/namespaces: add uid_map/gid_map range tests > > kernel/user_namespace.c | 29 +- > tools/testing/selftests/namespaces/.gitignore | 1 + > tools/testing/selftests/namespaces/Makefile | 3 +- > .../selftests/namespaces/uid_map_range_test.c | 299 ++++++++++++++++++ > 4 files changed, 328 insertions(+), 4 deletions(-) > create mode 100644 tools/testing/selftests/namespaces/uid_map_range_test.c > > > base-commit: 551c722f40809618230001baccf219193e22fc5a
