[GIT PULL 03/19 for v7.4] namespace misc

[Christian Brauner]

Hey Linus,

/* Summary */

- Reject uid_map, gid_map and projid_map values that don't fit in a
  u32. map_write() parsed with simple_strtoul() and truncated modulo
  2^32 on 64-bit so "4294967301 1000 1" was installed as "5 1000 1"
  without an error. Each field is parsed with kstrtou32() now and
  selftests cover the out-of-range, negative and in-range cases. This
  isn't a security fix. The truncated values were valid ids and every
  later check still applied to them.

- Annotate struct uid_gid_map's forward and reverse pointers with
  __counted_by_ptr and add a KUnit suite for inserting and sorting
  extents. insert_extent() wrote to forward[nr_extents] before bumping
  the count which the annotation flags, so it bumps first now. Two
  follow-up fixes rename the now global helpers to
  uid_gid_map_insert_extent() and uid_gid_map_sort(), since the btrfs
  self-tests have their own insert_extent(), and guard the declarations
  on CONFIG_KUNIT.

- Drop the BUG_ON() NULL checks in copy_mnt_ns() and copy_utsname().
  create_new_namespaces() always passes a valid pointer and the other
  copy_*_ns() helpers don't check either.

- Remove a dead key_put() on the create_user_ns() error path.

/* Testing */

No build failures or warnings were observed.

/* Conflicts */

Merge conflicts with mainline
=============================

No known conflicts.

Merge conflicts with other trees
================================

No known conflicts.

The following changes since commit cee9395acd8043be0644b25c34bfa86623f2b935:

  Linux 7.3-rc1 (2026-08-30 13:34:40 -0700)

are available in the Git repository at:

  git@xxxxxxxxxxxxxxxxxxx:pub/scm/linux/kernel/git/vfs/vfs tags/namespace-7.4-rc1.misc

for you to fetch changes up to fbc59bc7f05c62b0c1607b92eaf8175e75ef755d:

  Merge patch series "userns: reject out-of-range uid_map/gid_map values" (2026-10-12 11:01:24 +0200)

----------------------------------------------------------------
namespace-7.4-rc1.misc

Please consider pulling these changes from the signed namespace-7.4-rc1.misc tag.

Thanks!
Christian

----------------------------------------------------------------
Bill Wendling (2):
      userns: Add __counted_by_ptr attribute to struct uid_gid_map
      userns: Add KUnit test suite for uid_gid_map

Christian Brauner (6):
      Merge patch series "drop BUG_ON() NULL checks in namespace copy helpers"
      Merge patch series "userns: Add __counted_by_ptr attribute to struct uid_gid_map"
      userns: rename insert_extent() and sort_idmaps()
      userns: declare the KUnit-visible helpers whenever KUnit is enabled
      Merge patch series "Minor bugfixes for kunit userns tests"
      Merge patch series "userns: reject out-of-range uid_map/gid_map values"

Natasha Klaus (2):
      userns: reject uid_map/gid_map values that do not fit in u32
      selftests/namespaces: add uid_map/gid_map range tests

Shaojie Sun (2):
      uts: drop BUG_ON() in copy_utsname()
      fs: namespace: drop BUG_ON() in copy_mnt_ns()

Tao Cui (1):
      userns: remove dead key_put() on the create_user_ns() error path

 fs/namespace.c                                     |   2 -
 include/linux/user_namespace.h                     |  11 +-
 init/Kconfig                                       |  11 +
 kernel/Makefile                                    |   1 +
 kernel/tests/.kunitconfig                          |   4 +
 kernel/tests/user_ns_map_kunit.c                   |  98 +++++++
 kernel/user_namespace.c                            |  61 +++--
 kernel/utsname.c                                   |   1 -
 tools/testing/selftests/namespaces/.gitignore      |   1 +
 tools/testing/selftests/namespaces/Makefile        |   3 +-
 .../selftests/namespaces/uid_map_range_test.c      | 299 +++++++++++++++++++++
 11 files changed, 470 insertions(+), 22 deletions(-)
 create mode 100644 kernel/tests/.kunitconfig
 create mode 100644 kernel/tests/user_ns_map_kunit.c
 create mode 100644 tools/testing/selftests/namespaces/uid_map_range_test.c