* [PATCH 1/2] userns: reject uid_map/gid_map values that do not fit in u32
2026-09-28 7:25 [PATCH 0/2] userns: reject out-of-range uid_map/gid_map values Natasha Klaus
@ 2026-09-28 7:25 ` Natasha Klaus
2026-09-28 7:25 ` [PATCH 2/2] selftests/namespaces: add uid_map/gid_map range tests Natasha Klaus
2026-09-28 13:58 ` [PATCH 0/2] userns: reject out-of-range uid_map/gid_map values Eric W. Biederman
2 siblings, 0 replies; 4+ messages in thread
From: Natasha Klaus @ 2026-09-28 7:25 UTC (permalink / raw)
To: Christian Brauner, Kees Cook, Eric W . Biederman
Cc: Shuah Khan, Jeff Layton, linux-kselftest, linux-kernel, Natasha Klaus
map_write() parses each line written to uid_map, gid_map or projid_map
with simple_strtoul() and stores the results in the u32 fields of
struct uid_gid_extent. On 64-bit kernels a value above U32_MAX is
silently truncated modulo 2^32. The coding assistant flagged this
truncation site while reading map_write(), and I confirmed it by hand
on a running kernel, where writing to the uid_map of a fresh user
namespace installs a different mapping than the one requested:
"4294967296 1000 1" -> installed as "0 1000 1"
"4294967297 1000 1" -> installed as "1 1000 1"
"4294967301 1000 1" -> installed as "5 1000 1"
The same happens to the lower_first and count fields. Only a literal of
2^64 or more is rejected, and only because simple_strtoul() saturates
to ULLONG_MAX, which truncates onto the (u32)-1 value map_write()
already refuses.
The write succeeds, so a runtime that computes ranges and gets one
wrong ends up with a different map than it asked for and no error to
tell it so.
Parse each field with simple_strtoull() into unsigned long long locals
and fail the write with -EINVAL if any of them exceeds U32_MAX, before
the existing checks, which are kept unchanged and in the same order.
On 32-bit kernels unsigned long is 32 bits wide and the truncation
happens inside simple_strtoul() itself, so a range check on its return
value would never fire there; that is why the values are parsed as
unsigned long long. simple_strtoull() keeps the end pointer behaviour
the multi-line parser relies on.
This is hardening, not a security fix: the truncated values are valid
ids and every later check still applies to them.
Signed-off-by: Natasha Klaus <natalie.klaus@runtimeverification.com>
Assisted-by: LLM
---
checkpatch warns that simple_strtoull() is obsolete. kstrtoull() does not
fit here: the buffer holds several lines of three space-separated fields,
and the parser relies on the end pointer to step from one field to the
next, which kstrto*() does not provide.
kernel/user_namespace.c | 14 +++++++++++---
1 file changed, 11 insertions(+), 3 deletions(-)
diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
index 0bed462e9b2a..e7ed475c3685 100644
--- a/kernel/user_namespace.c
+++ b/kernel/user_namespace.c
@@ -940,6 +940,7 @@ static ssize_t map_write(struct file *file, const char __user *buf,
struct uid_gid_map new_map;
unsigned idx;
struct uid_gid_extent extent;
+ unsigned long long first, lower_first, cnt;
char *kbuf, *pos, *next_line;
ssize_t ret;
@@ -1001,17 +1002,17 @@ static ssize_t map_write(struct file *file, const char __user *buf,
}
pos = skip_spaces(pos);
- extent.first = simple_strtoul(pos, &pos, 10);
+ first = simple_strtoull(pos, &pos, 10);
if (!isspace(*pos))
goto out;
pos = skip_spaces(pos);
- extent.lower_first = simple_strtoul(pos, &pos, 10);
+ lower_first = simple_strtoull(pos, &pos, 10);
if (!isspace(*pos))
goto out;
pos = skip_spaces(pos);
- extent.count = simple_strtoul(pos, &pos, 10);
+ cnt = simple_strtoull(pos, &pos, 10);
if (*pos && !isspace(*pos))
goto out;
@@ -1020,6 +1021,13 @@ static ssize_t map_write(struct file *file, const char __user *buf,
if (*pos != '\0')
goto out;
+ /* Verify the values fit in the u32 fields of the extent */
+ if (first > U32_MAX || lower_first > U32_MAX || cnt > U32_MAX)
+ goto out;
+ extent.first = first;
+ extent.lower_first = lower_first;
+ extent.count = cnt;
+
/* Verify we have been given valid starting values */
if ((extent.first == (u32) -1) ||
(extent.lower_first == (u32) -1))
--
2.34.1
^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH 2/2] selftests/namespaces: add uid_map/gid_map range tests
2026-09-28 7:25 [PATCH 0/2] userns: reject out-of-range uid_map/gid_map values Natasha Klaus
2026-09-28 7:25 ` [PATCH 1/2] userns: reject uid_map/gid_map values that do not fit in u32 Natasha Klaus
@ 2026-09-28 7:25 ` Natasha Klaus
2026-09-28 13:58 ` [PATCH 0/2] userns: reject out-of-range uid_map/gid_map values Eric W. Biederman
2 siblings, 0 replies; 4+ messages in thread
From: Natasha Klaus @ 2026-09-28 7:25 UTC (permalink / raw)
To: Christian Brauner, Kees Cook, Eric W . Biederman
Cc: Shuah Khan, Jeff Layton, linux-kselftest, linux-kernel, Natasha Klaus
Check that a uid_map or gid_map line with a value that does not fit in
u32 is rejected with EINVAL and installs nothing, for each of the three
fields, and that an in-range line is still accepted and reads back
unchanged.
Signed-off-by: Natasha Klaus <natalie.klaus@runtimeverification.com>
Assisted-by: LLM
---
tools/testing/selftests/namespaces/.gitignore | 1 +
tools/testing/selftests/namespaces/Makefile | 3 +-
.../selftests/namespaces/uid_map_range_test.c | 155 ++++++++++++++++++
3 files changed, 158 insertions(+), 1 deletion(-)
create mode 100644 tools/testing/selftests/namespaces/uid_map_range_test.c
diff --git a/tools/testing/selftests/namespaces/.gitignore b/tools/testing/selftests/namespaces/.gitignore
index 0989e80da457..995b082357fa 100644
--- a/tools/testing/selftests/namespaces/.gitignore
+++ b/tools/testing/selftests/namespaces/.gitignore
@@ -10,3 +10,4 @@ cred_change_test
stress_test
listns_pagination_bug
regression_pidfd_setns_test
+uid_map_range_test
diff --git a/tools/testing/selftests/namespaces/Makefile b/tools/testing/selftests/namespaces/Makefile
index fbb821652c17..9b22d12708e1 100644
--- a/tools/testing/selftests/namespaces/Makefile
+++ b/tools/testing/selftests/namespaces/Makefile
@@ -13,7 +13,8 @@ TEST_GEN_PROGS := nsid_test \
cred_change_test \
stress_test \
listns_pagination_bug \
- regression_pidfd_setns_test
+ regression_pidfd_setns_test \
+ uid_map_range_test
include ../lib.mk
diff --git a/tools/testing/selftests/namespaces/uid_map_range_test.c b/tools/testing/selftests/namespaces/uid_map_range_test.c
new file mode 100644
index 000000000000..9da02005a09c
--- /dev/null
+++ b/tools/testing/selftests/namespaces/uid_map_range_test.c
@@ -0,0 +1,155 @@
+// SPDX-License-Identifier: GPL-2.0
+#define _GNU_SOURCE
+#include <errno.h>
+#include <fcntl.h>
+#include <sched.h>
+#include <stdio.h>
+#include <string.h>
+#include <unistd.h>
+#include "../kselftest_harness.h"
+
+/*
+ * The fields of a uid_map/gid_map line are stored in u32. Values that
+ * do not fit must be rejected with EINVAL instead of being silently
+ * truncated modulo 2^32, and in-range values must still be accepted.
+ */
+
+static int write_file(const char *path, const char *buf)
+{
+ ssize_t len = strlen(buf);
+ ssize_t ret;
+ int fd;
+
+ fd = open(path, O_WRONLY | O_CLOEXEC);
+ if (fd < 0)
+ return -errno;
+ ret = write(fd, buf, len);
+ if (ret < 0)
+ ret = -errno;
+ close(fd);
+ if (ret < 0)
+ return ret;
+ return ret == len ? 0 : -EIO;
+}
+
+static ssize_t read_file(const char *path, char *buf, size_t size)
+{
+ ssize_t ret;
+ int fd;
+
+ fd = open(path, O_RDONLY | O_CLOEXEC);
+ if (fd < 0)
+ return -errno;
+ ret = read(fd, buf, size - 1);
+ if (ret < 0)
+ ret = -errno;
+ else
+ buf[ret] = '\0';
+ close(fd);
+ return ret;
+}
+
+/* Enter a fresh user namespace, remembering the outer ids. */
+static int enter_userns(uid_t *uid, gid_t *gid)
+{
+ *uid = geteuid();
+ *gid = getegid();
+ if (unshare(CLONE_NEWUSER) < 0)
+ return -errno;
+ /* Required before an unprivileged gid_map write. */
+ return write_file("/proc/self/setgroups", "deny");
+}
+
+static void expect_rejected(struct __test_metadata *_metadata,
+ const char *path, const char *line)
+{
+ char buf[256];
+
+ TH_LOG("writing \"%s\" to %s", line, path);
+ EXPECT_EQ(write_file(path, line), -EINVAL);
+ /* Nothing may have been installed. */
+ EXPECT_EQ(read_file(path, buf, sizeof(buf)), 0) {
+ TH_LOG("installed: %s", buf);
+ }
+}
+
+TEST(uid_map_first_above_u32)
+{
+ char line[64];
+ uid_t uid;
+ gid_t gid;
+ int ret;
+
+ ret = enter_userns(&uid, &gid);
+ if (ret)
+ SKIP(return, "cannot set up user namespace: %s", strerror(-ret));
+ snprintf(line, sizeof(line), "4294967301 %u 1", uid);
+ expect_rejected(_metadata, "/proc/self/uid_map", line);
+}
+
+TEST(uid_map_lower_first_above_u32)
+{
+ char line[64];
+ uid_t uid;
+ gid_t gid;
+ int ret;
+
+ ret = enter_userns(&uid, &gid);
+ if (ret)
+ SKIP(return, "cannot set up user namespace: %s", strerror(-ret));
+ snprintf(line, sizeof(line), "0 %llu 1", (1ULL << 32) + uid);
+ expect_rejected(_metadata, "/proc/self/uid_map", line);
+}
+
+TEST(uid_map_count_above_u32)
+{
+ char line[64];
+ uid_t uid;
+ gid_t gid;
+ int ret;
+
+ ret = enter_userns(&uid, &gid);
+ if (ret)
+ SKIP(return, "cannot set up user namespace: %s", strerror(-ret));
+ snprintf(line, sizeof(line), "0 %u 4294967297", uid);
+ expect_rejected(_metadata, "/proc/self/uid_map", line);
+}
+
+TEST(gid_map_first_above_u32)
+{
+ char line[64];
+ uid_t uid;
+ gid_t gid;
+ int ret;
+
+ ret = enter_userns(&uid, &gid);
+ if (ret)
+ SKIP(return, "cannot set up user namespace: %s", strerror(-ret));
+ snprintf(line, sizeof(line), "4294967301 %u 1", gid);
+ expect_rejected(_metadata, "/proc/self/gid_map", line);
+}
+
+TEST(uid_map_in_range)
+{
+ unsigned int first, lower_first, count;
+ char line[64], buf[256];
+ uid_t uid;
+ gid_t gid;
+ int ret;
+
+ ret = enter_userns(&uid, &gid);
+ if (ret)
+ SKIP(return, "cannot set up user namespace: %s", strerror(-ret));
+ snprintf(line, sizeof(line), "5 %u 1", uid);
+ ASSERT_EQ(write_file("/proc/self/uid_map", line), 0);
+
+ ASSERT_GT(read_file("/proc/self/uid_map", buf, sizeof(buf)), 0);
+ ASSERT_EQ(sscanf(buf, "%u %u %u", &first, &lower_first, &count), 3);
+ EXPECT_EQ(first, 5U);
+ EXPECT_EQ(lower_first, uid);
+ EXPECT_EQ(count, 1U);
+ /* Exactly one extent. */
+ EXPECT_EQ(strchr(buf, '\n'), buf + strlen(buf) - 1);
+}
+
+TEST_HARNESS_MAIN
--
2.34.1
^ permalink raw reply [flat|nested] 4+ messages in thread