Re: [PATCH 0/2] userns: reject out-of-range uid_map/gid_map values

["Eric W. Biederman" <ebiederm@xmission.com>]

Natasha Klaus <natalie.klaus@runtimeverification.com> writes:

> map_write() silently truncates uid_map/gid_map/projid_map values above
> U32_MAX modulo 2^32 on 64-bit kernels, so e.g. "4294967301 1000 1" is
> installed as "5 1000 1" without an error. Patch 1 rejects such values
> with -EINVAL. Patch 2 adds a selftest for all three fields and for the
> unchanged in-range path.
>
> This is hardening, not a security fix.

Well error in more cases.  *Shrug* I don't think that even really
hardens anything but it is moderately more correct.

> The patch and the selftest were drafted by Claude Code (Claude Opus 5.5)
> in an interactive session; I reviewed, built and tested them. The
> assistant flagged the truncation while reading map_write(), and I
> confirmed it by writing to uid_map on a running kernel.
>
> Tested on v7.3-rc4-393-g165768bb7026 under virtme-ng, x86_64 defconfig
> with CONFIG_USER_NS: all five selftest cases pass on the patched kernel.
> On an unpatched 6.8 host, four of the five fail as expected.

Storing an unsigned long into an unsigned long long instead of an
unsigned is a mistake in the opposite direction and is more costly.

A more targeted fix would be to replace simple_strtoul with
kstrtou32.

As for tests you probably also want to test some negative values as
well, and probably a few good values.

Eric

>
> Natasha Klaus (2):
>   userns: reject uid_map/gid_map values that do not fit in u32
>   selftests/namespaces: add uid_map/gid_map range tests
>
>  kernel/user_namespace.c                       |  14 +-
>  tools/testing/selftests/namespaces/.gitignore |   1 +
>  tools/testing/selftests/namespaces/Makefile   |   3 +-
>  .../selftests/namespaces/uid_map_range_test.c | 155 ++++++++++++++++++
>  4 files changed, 169 insertions(+), 4 deletions(-)
>  create mode 100644 tools/testing/selftests/namespaces/uid_map_range_test.c
>
>
> base-commit: 165768bb70265b5c38cf0b73fafd75be235f8b14