Natasha Klaus <[email protected]> writes: > map_write() silently truncates uid_map/gid_map/projid_map values above > U32_MAX modulo 2^32 on 64-bit kernels, so e.g. "4294967301 1000 1" is > installed as "5 1000 1" without an error. Patch 1 rejects such values > with -EINVAL. Patch 2 adds a selftest for all three fields and for the > unchanged in-range path. > > This is hardening, not a security fix.
Well error in more cases. *Shrug* I don't think that even really hardens anything but it is moderately more correct. > The patch and the selftest were drafted by Claude Code (Claude Opus 5.5) > in an interactive session; I reviewed, built and tested them. The > assistant flagged the truncation while reading map_write(), and I > confirmed it by writing to uid_map on a running kernel. > > Tested on v7.3-rc4-393-g165768bb7026 under virtme-ng, x86_64 defconfig > with CONFIG_USER_NS: all five selftest cases pass on the patched kernel. > On an unpatched 6.8 host, four of the five fail as expected. Storing an unsigned long into an unsigned long long instead of an unsigned is a mistake in the opposite direction and is more costly. A more targeted fix would be to replace simple_strtoul with kstrtou32. As for tests you probably also want to test some negative values as well, and probably a few good values. Eric > > Natasha Klaus (2): > userns: reject uid_map/gid_map values that do not fit in u32 > selftests/namespaces: add uid_map/gid_map range tests > > kernel/user_namespace.c | 14 +- > tools/testing/selftests/namespaces/.gitignore | 1 + > tools/testing/selftests/namespaces/Makefile | 3 +- > .../selftests/namespaces/uid_map_range_test.c | 155 ++++++++++++++++++ > 4 files changed, 169 insertions(+), 4 deletions(-) > create mode 100644 tools/testing/selftests/namespaces/uid_map_range_test.c > > > base-commit: 165768bb70265b5c38cf0b73fafd75be235f8b14
