Merge branch 'mpi-master' into wip-k-fmlpwip-k-fmlp

Conflicts:
	litmus/sched_cedf.c

10 files changed, 162 insertions, 60 deletions

diff --git a/ipc/compat.c b/ipc/compat.c
index 9dc2c7d3c9e6..845a28738d3a 100644
--- a/ipc/compat.c
+++ b/ipc/compat.c
@@ -241,6 +241,8 @@ long compat_sys_semctl(int first, int second, int third, void __user *uptr)
         struct semid64_ds __user *up64;
         int version = compat_ipc_parse_version(&third);
 
+        memset(&s64, 0, sizeof(s64));
+
         if (!uptr)
                 return -EINVAL;
         if (get_user(pad, (u32 __user *) uptr))
@@ -421,6 +423,8 @@ long compat_sys_msgctl(int first, int second, void __user *uptr)
         int version = compat_ipc_parse_version(&second);
         void __user *p;
 
+        memset(&m64, 0, sizeof(m64));
+
         switch (second & (~IPC_64)) {
         case IPC_INFO:
         case IPC_RMID:
@@ -594,6 +598,8 @@ long compat_sys_shmctl(int first, int second, void __user *uptr)
         int err, err2;
         int version = compat_ipc_parse_version(&second);
 
+        memset(&s64, 0, sizeof(s64));
+
         switch (second & (~IPC_64)) {
         case IPC_RMID:
         case SHM_LOCK:
diff --git a/ipc/compat_mq.c b/ipc/compat_mq.c
index d8d1e9ff4e88..380ea4fe08e7 100644
--- a/ipc/compat_mq.c
+++ b/ipc/compat_mq.c
@@ -53,6 +53,9 @@ asmlinkage long compat_sys_mq_open(const char __user *u_name,
         void __user *p = NULL;
         if (u_attr && oflag & O_CREAT) {
                 struct mq_attr attr;
+
+                memset(&attr, 0, sizeof(attr));
+
                 p = compat_alloc_user_space(sizeof(attr));
                 if (get_compat_mq_attr(&attr, u_attr) ||
                     copy_to_user(p, &attr, sizeof(attr)))
@@ -127,6 +130,8 @@ asmlinkage long compat_sys_mq_getsetattr(mqd_t mqdes,
         struct mq_attr __user *p = compat_alloc_user_space(2 * sizeof(*p));
         long ret;
 
+        memset(&mqstat, 0, sizeof(mqstat));
+
         if (u_mqstat) {
                 if (get_compat_mq_attr(&mqstat, u_mqstat) ||
                     copy_to_user(p, &mqstat, sizeof(mqstat)))
diff --git a/ipc/mqueue.c b/ipc/mqueue.c
index c60e519e2917..14fb6d67e6a3 100644
--- a/ipc/mqueue.c
+++ b/ipc/mqueue.c
@@ -116,6 +116,7 @@ static struct inode *mqueue_get_inode(struct super_block *sb,
 
         inode = new_inode(sb);
         if (inode) {
+                inode->i_ino = get_next_ino();
                 inode->i_mode = mode;
                 inode->i_uid = current_fsuid();
                 inode->i_gid = current_fsgid();
@@ -210,13 +211,13 @@ out:
         return error;
 }
 
-static int mqueue_get_sb(struct file_system_type *fs_type,
+static struct dentry *mqueue_mount(struct file_system_type *fs_type,
                          int flags, const char *dev_name,
-                         void *data, struct vfsmount *mnt)
+                         void *data)
 {
         if (!(flags & MS_KERNMOUNT))
                 data = current->nsproxy->ipc_ns;
-        return get_sb_ns(fs_type, flags, data, mqueue_fill_super, mnt);
+        return mount_ns(fs_type, flags, data, mqueue_fill_super);
 }
 
 static void init_once(void *foo)
@@ -236,11 +237,18 @@ static struct inode *mqueue_alloc_inode(struct super_block *sb)
         return &ei->vfs_inode;
 }
 
-static void mqueue_destroy_inode(struct inode *inode)
+static void mqueue_i_callback(struct rcu_head *head)
 {
+        struct inode *inode = container_of(head, struct inode, i_rcu);
+        INIT_LIST_HEAD(&inode->i_dentry);
         kmem_cache_free(mqueue_inode_cachep, MQUEUE_I(inode));
 }
 
+static void mqueue_destroy_inode(struct inode *inode)
+{
+        call_rcu(&inode->i_rcu, mqueue_i_callback);
+}
+
 static void mqueue_evict_inode(struct inode *inode)
 {
         struct mqueue_inode_info *info;
@@ -769,7 +777,7 @@ SYSCALL_DEFINE1(mq_unlink, const char __user *, u_name)
 
         inode = dentry->d_inode;
         if (inode)
-                atomic_inc(&inode->i_count);
+                ihold(inode);
         err = mnt_want_write(ipc_ns->mq_mnt);
         if (err)
                 goto out_err;
@@ -1219,6 +1227,7 @@ static const struct file_operations mqueue_file_operations = {
         .flush = mqueue_flush_file,
         .poll = mqueue_poll_file,
         .read = mqueue_read_file,
+        .llseek = default_llseek,
 };
 
 static const struct super_operations mqueue_super_ops = {
@@ -1230,7 +1239,7 @@ static const struct super_operations mqueue_super_ops = {
 
 static struct file_system_type mqueue_fs_type = {
         .name = "mqueue",
-        .get_sb = mqueue_get_sb,
+        .mount = mqueue_mount,
         .kill_sb = kill_litter_super,
 };
 
diff --git a/ipc/msg.c b/ipc/msg.c
index 747b65507a91..7385de25788a 100644
--- a/ipc/msg.c
+++ b/ipc/msg.c
@@ -421,7 +421,7 @@ static int msgctl_down(struct ipc_namespace *ns, int msqid, int cmd,
                         return -EFAULT;
         }
 
-        ipcp = ipcctl_pre_down(&msg_ids(ns), msqid, cmd,
+        ipcp = ipcctl_pre_down(ns, &msg_ids(ns), msqid, cmd,
                                &msqid64.msg_perm, msqid64.msg_qbytes);
         if (IS_ERR(ipcp))
                 return PTR_ERR(ipcp);
@@ -539,7 +539,7 @@ SYSCALL_DEFINE3(msgctl, int, msqid, int, cmd, struct msqid_ds __user *, buf)
                         success_return = 0;
                 }
                 err = -EACCES;
-                if (ipcperms(&msq->q_perm, S_IRUGO))
+                if (ipcperms(ns, &msq->q_perm, S_IRUGO))
                         goto out_unlock;
 
                 err = security_msg_queue_msgctl(msq, cmd);
@@ -664,7 +664,7 @@ long do_msgsnd(int msqid, long mtype, void __user *mtext,
                 struct msg_sender s;
 
                 err = -EACCES;
-                if (ipcperms(&msq->q_perm, S_IWUGO))
+                if (ipcperms(ns, &msq->q_perm, S_IWUGO))
                         goto out_unlock_free;
 
                 err = security_msg_queue_msgsnd(msq, msg, msgflg);
@@ -704,7 +704,7 @@ long do_msgsnd(int msqid, long mtype, void __user *mtext,
         msq->q_stime = get_seconds();
 
         if (!pipelined_send(msq, msg)) {
-                /* noone is waiting for this message, enqueue it */
+                /* no one is waiting for this message, enqueue it */
                 list_add_tail(&msg->m_list, &msq->q_messages);
                 msq->q_cbytes += msgsz;
                 msq->q_qnum++;
@@ -774,7 +774,7 @@ long do_msgrcv(int msqid, long *pmtype, void __user *mtext,
                 struct list_head *tmp;
 
                 msg = ERR_PTR(-EACCES);
-                if (ipcperms(&msq->q_perm, S_IRUGO))
+                if (ipcperms(ns, &msq->q_perm, S_IRUGO))
                         goto out_unlock;
 
                 msg = ERR_PTR(-EAGAIN);
@@ -842,7 +842,7 @@ long do_msgrcv(int msqid, long *pmtype, void __user *mtext,
                  * Disable preemption.  We don't hold a reference to the queue
                  * and getting a reference would defeat the idea of a lockless
                  * operation, thus the code relies on rcu to guarantee the
-                 * existance of msq:
+                 * existence of msq:
                  * Prior to destruction, expunge_all(-EIRDM) changes r_msg.
                  * Thus if r_msg is -EAGAIN, then the queue not yet destroyed.
                  * rcu_read_lock() prevents preemption between reading r_msg
diff --git a/ipc/msgutil.c b/ipc/msgutil.c
index f095ee268833..8b5ce5d3f3ef 100644
--- a/ipc/msgutil.c
+++ b/ipc/msgutil.c
@@ -32,6 +32,7 @@ struct ipc_namespace init_ipc_ns = {
         .mq_msg_max      = DFLT_MSGMAX,
         .mq_msgsize_max  = DFLT_MSGSIZEMAX,
 #endif
+        .user_ns = &init_user_ns,
 };
 
 atomic_t nr_ipc_ns = ATOMIC_INIT(1);
diff --git a/ipc/namespace.c b/ipc/namespace.c
index a1094ff0befa..ce0a647869b1 100644
--- a/ipc/namespace.c
+++ b/ipc/namespace.c
@@ -11,10 +11,13 @@
 #include <linux/slab.h>
 #include <linux/fs.h>
 #include <linux/mount.h>
+#include <linux/user_namespace.h>
+#include <linux/proc_fs.h>
 
 #include "util.h"
 
-static struct ipc_namespace *create_ipc_ns(void)
+static struct ipc_namespace *create_ipc_ns(struct task_struct *tsk,
+                                           struct ipc_namespace *old_ns)
 {
         struct ipc_namespace *ns;
         int err;
@@ -43,14 +46,19 @@ static struct ipc_namespace *create_ipc_ns(void)
         ipcns_notify(IPCNS_CREATED);
         register_ipcns_notifier(ns);
 
+        ns->user_ns = get_user_ns(task_cred_xxx(tsk, user)->user_ns);
+
         return ns;
 }
 
-struct ipc_namespace *copy_ipcs(unsigned long flags, struct ipc_namespace *ns)
+struct ipc_namespace *copy_ipcs(unsigned long flags,
+                                struct task_struct *tsk)
 {
+        struct ipc_namespace *ns = tsk->nsproxy->ipc_ns;
+
         if (!(flags & CLONE_NEWIPC))
                 return get_ipc_ns(ns);
-        return create_ipc_ns();
+        return create_ipc_ns(tsk, ns);
 }
 
 /*
@@ -97,7 +105,6 @@ static void free_ipc_ns(struct ipc_namespace *ns)
         sem_exit_ns(ns);
         msg_exit_ns(ns);
         shm_exit_ns(ns);
-        kfree(ns);
         atomic_dec(&nr_ipc_ns);
 
         /*
@@ -105,6 +112,8 @@ static void free_ipc_ns(struct ipc_namespace *ns)
          * order to have a correct value when recomputing msgmni.
          */
         ipcns_notify(IPCNS_REMOVED);
+        put_user_ns(ns->user_ns);
+        kfree(ns);
 }
 
 /*
@@ -132,3 +141,39 @@ void put_ipc_ns(struct ipc_namespace *ns)
                 free_ipc_ns(ns);
         }
 }
+
+static void *ipcns_get(struct task_struct *task)
+{
+        struct ipc_namespace *ns = NULL;
+        struct nsproxy *nsproxy;
+
+        rcu_read_lock();
+        nsproxy = task_nsproxy(task);
+        if (nsproxy)
+                ns = get_ipc_ns(nsproxy->ipc_ns);
+        rcu_read_unlock();
+
+        return ns;
+}
+
+static void ipcns_put(void *ns)
+{
+        return put_ipc_ns(ns);
+}
+
+static int ipcns_install(struct nsproxy *nsproxy, void *ns)
+{
+        /* Ditch state from the old ipc namespace */
+        exit_sem(current);
+        put_ipc_ns(nsproxy->ipc_ns);
+        nsproxy->ipc_ns = get_ipc_ns(ns);
+        return 0;
+}
+
+const struct proc_ns_operations ipcns_operations = {
+        .name           = "ipc",
+        .type           = CLONE_NEWIPC,
+        .get            = ipcns_get,
+        .put            = ipcns_put,
+        .install        = ipcns_install,
+};
diff --git a/ipc/sem.c b/ipc/sem.c
index 0e0d49bbb867..34193ed69fbe 100644
--- a/ipc/sem.c
+++ b/ipc/sem.c
@@ -817,7 +817,7 @@ static int semctl_nolock(struct ipc_namespace *ns, int semid,
                 }
 
                 err = -EACCES;
-                if (ipcperms (&sma->sem_perm, S_IRUGO))
+                if (ipcperms(ns, &sma->sem_perm, S_IRUGO))
                         goto out_unlock;
 
                 err = security_sem_semctl(sma, cmd);
@@ -862,7 +862,8 @@ static int semctl_main(struct ipc_namespace *ns, int semid, int semnum,
         nsems = sma->sem_nsems;
 
         err = -EACCES;
-        if (ipcperms (&sma->sem_perm, (cmd==SETVAL||cmd==SETALL)?S_IWUGO:S_IRUGO))
+        if (ipcperms(ns, &sma->sem_perm,
+                        (cmd == SETVAL || cmd == SETALL) ? S_IWUGO : S_IRUGO))
                 goto out_unlock;
 
         err = security_sem_semctl(sma, cmd);
@@ -1047,7 +1048,8 @@ static int semctl_down(struct ipc_namespace *ns, int semid,
                         return -EFAULT;
         }
 
-        ipcp = ipcctl_pre_down(&sem_ids(ns), semid, cmd, &semid64.sem_perm, 0);
+        ipcp = ipcctl_pre_down(ns, &sem_ids(ns), semid, cmd,
+                               &semid64.sem_perm, 0);
         if (IS_ERR(ipcp))
                 return PTR_ERR(ipcp);
 
@@ -1360,7 +1362,7 @@ SYSCALL_DEFINE4(semtimedop, int, semid, struct sembuf __user *, tsops,
          * semid identifiers are not unique - find_alloc_undo may have
          * allocated an undo structure, it was invalidated by an RMID
          * and now a new array with received the same id. Check and fail.
-         * This case can be detected checking un->semid. The existance of
+         * This case can be detected checking un->semid. The existence of
          * "un" itself is guaranteed by rcu.
          */
         error = -EIDRM;
@@ -1386,7 +1388,7 @@ SYSCALL_DEFINE4(semtimedop, int, semid, struct sembuf __user *, tsops,
                 goto out_unlock_free;
 
         error = -EACCES;
-        if (ipcperms(&sma->sem_perm, alter ? S_IWUGO : S_IRUGO))
+        if (ipcperms(ns, &sma->sem_perm, alter ? S_IWUGO : S_IRUGO))
                 goto out_unlock_free;
 
         error = security_sem_semop(sma, sops, nsops, alter);
diff --git a/ipc/shm.c b/ipc/shm.c
index 52ed77eb9713..ab3385a21b27 100644
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -108,7 +108,11 @@ void __init shm_init (void)
 {
         shm_init_ns(&init_ipc_ns);
         ipc_init_proc_interface("sysvipc/shm",
-                                "       key      shmid perms       size  cpid  lpid nattch   uid   gid  cuid  cgid      atime      dtime      ctime\n",
+#if BITS_PER_LONG <= 32
+                                "       key      shmid perms       size  cpid  lpid nattch   uid   gid  cuid  cgid      atime      dtime      ctime        rss       swap\n",
+#else
+                                "       key      shmid perms                  size  cpid  lpid nattch   uid   gid  cuid  cgid      atime      dtime      ctime                   rss                  swap\n",
+#endif
                                 IPC_SHM_IDS, sysvipc_shm_proc_show);
 }
 
@@ -298,6 +302,7 @@ static const struct file_operations shm_file_operations = {
 #ifndef CONFIG_MMU
         .get_unmapped_area      = shm_get_unmapped_area,
 #endif
+        .llseek         = noop_llseek,
 };
 
 static const struct file_operations shm_file_operations_huge = {
@@ -305,6 +310,7 @@ static const struct file_operations shm_file_operations_huge = {
         .fsync          = shm_fsync,
         .release        = shm_release,
         .get_unmapped_area      = shm_get_unmapped_area,
+        .llseek         = noop_llseek,
 };
 
 int is_file_shm_hugepages(struct file *file)
@@ -341,7 +347,7 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params)
         struct file * file;
         char name[13];
         int id;
-        int acctflag = 0;
+        vm_flags_t acctflag = 0;
 
         if (size < SHMMIN || size > ns->shm_ctlmax)
                 return -EINVAL;
@@ -473,6 +479,7 @@ static inline unsigned long copy_shmid_to_user(void __user *buf, struct shmid64_
             {
                 struct shmid_ds out;
 
+                memset(&out, 0, sizeof(out));
                 ipc64_perm_to_ipc_perm(&in->shm_perm, &out.shm_perm);
                 out.shm_segsz   = in->shm_segsz;
                 out.shm_atime   = in->shm_atime;
@@ -542,6 +549,34 @@ static inline unsigned long copy_shminfo_to_user(void __user *buf, struct shminf
 }
 
 /*
+ * Calculate and add used RSS and swap pages of a shm.
+ * Called with shm_ids.rw_mutex held as a reader
+ */
+static void shm_add_rss_swap(struct shmid_kernel *shp,
+        unsigned long *rss_add, unsigned long *swp_add)
+{
+        struct inode *inode;
+
+        inode = shp->shm_file->f_path.dentry->d_inode;
+
+        if (is_file_hugepages(shp->shm_file)) {
+                struct address_space *mapping = inode->i_mapping;
+                struct hstate *h = hstate_file(shp->shm_file);
+                *rss_add += pages_per_huge_page(h) * mapping->nrpages;
+        } else {
+#ifdef CONFIG_SHMEM
+                struct shmem_inode_info *info = SHMEM_I(inode);
+                spin_lock(&info->lock);
+                *rss_add += inode->i_mapping->nrpages;
+                *swp_add += info->swapped;
+                spin_unlock(&info->lock);
+#else
+                *rss_add += inode->i_mapping->nrpages;
+#endif
+        }
+}
+
+/*
  * Called with shm_ids.rw_mutex held as a reader
  */
 static void shm_get_stat(struct ipc_namespace *ns, unsigned long *rss,
@@ -558,30 +593,13 @@ static void shm_get_stat(struct ipc_namespace *ns, unsigned long *rss,
         for (total = 0, next_id = 0; total < in_use; next_id++) {
                 struct kern_ipc_perm *ipc;
                 struct shmid_kernel *shp;
-                struct inode *inode;
 
                 ipc = idr_find(&shm_ids(ns).ipcs_idr, next_id);
                 if (ipc == NULL)
                         continue;
                 shp = container_of(ipc, struct shmid_kernel, shm_perm);
 
-                inode = shp->shm_file->f_path.dentry->d_inode;
-
-                if (is_file_hugepages(shp->shm_file)) {
-                        struct address_space *mapping = inode->i_mapping;
-                        struct hstate *h = hstate_file(shp->shm_file);
-                        *rss += pages_per_huge_page(h) * mapping->nrpages;
-                } else {
-#ifdef CONFIG_SHMEM
-                        struct shmem_inode_info *info = SHMEM_I(inode);
-                        spin_lock(&info->lock);
-                        *rss += inode->i_mapping->nrpages;
-                        *swp += info->swapped;
-                        spin_unlock(&info->lock);
-#else
-                        *rss += inode->i_mapping->nrpages;
-#endif
-                }
+                shm_add_rss_swap(shp, rss, swp);
 
                 total++;
         }
@@ -605,7 +623,8 @@ static int shmctl_down(struct ipc_namespace *ns, int shmid, int cmd,
                         return -EFAULT;
         }
 
-        ipcp = ipcctl_pre_down(&shm_ids(ns), shmid, cmd, &shmid64.shm_perm, 0);
+        ipcp = ipcctl_pre_down(ns, &shm_ids(ns), shmid, cmd,
+                               &shmid64.shm_perm, 0);
         if (IS_ERR(ipcp))
                 return PTR_ERR(ipcp);
 
@@ -719,7 +738,7 @@ SYSCALL_DEFINE3(shmctl, int, shmid, int, cmd, struct shmid_ds __user *, buf)
                         result = 0;
                 }
                 err = -EACCES;
-                if (ipcperms (&shp->shm_perm, S_IRUGO))
+                if (ipcperms(ns, &shp->shm_perm, S_IRUGO))
                         goto out_unlock;
                 err = security_shm_shmctl(shp, cmd);
                 if (err)
@@ -755,7 +774,7 @@ SYSCALL_DEFINE3(shmctl, int, shmid, int, cmd, struct shmid_ds __user *, buf)
 
                 audit_ipc_obj(&(shp->shm_perm));
 
-                if (!capable(CAP_IPC_LOCK)) {
+                if (!ns_capable(ns->user_ns, CAP_IPC_LOCK)) {
                         uid_t euid = current_euid();
                         err = -EPERM;
                         if (euid != shp->shm_perm.uid &&
@@ -870,7 +889,7 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg, ulong *raddr)
         }
 
         err = -EACCES;
-        if (ipcperms(&shp->shm_perm, acc_mode))
+        if (ipcperms(ns, &shp->shm_perm, acc_mode))
                 goto out_unlock;
 
         err = security_shm_shmat(shp, shmaddr, shmflg);
@@ -1037,7 +1056,7 @@ SYSCALL_DEFINE1(shmdt, char __user *, shmaddr)
         /*
          * We need look no further than the maximum address a fragment
          * could possibly have landed at. Also cast things to loff_t to
-         * prevent overflows and make comparisions vs. equal-width types.
+         * prevent overflows and make comparisons vs. equal-width types.
          */
         size = PAGE_ALIGN(size);
         while (vma && (loff_t)(vma->vm_end - addr) <= size) {
@@ -1070,6 +1089,9 @@ SYSCALL_DEFINE1(shmdt, char __user *, shmaddr)
 static int sysvipc_shm_proc_show(struct seq_file *s, void *it)
 {
         struct shmid_kernel *shp = it;
+        unsigned long rss = 0, swp = 0;
+
+        shm_add_rss_swap(shp, &rss, &swp);
 
 #if BITS_PER_LONG <= 32
 #define SIZE_SPEC "%10lu"
@@ -1079,7 +1101,8 @@ static int sysvipc_shm_proc_show(struct seq_file *s, void *it)
 
         return seq_printf(s,
                           "%10d %10d  %4o " SIZE_SPEC " %5u %5u  "
-                          "%5lu %5u %5u %5u %5u %10lu %10lu %10lu\n",
+                          "%5lu %5u %5u %5u %5u %10lu %10lu %10lu "
+                          SIZE_SPEC " " SIZE_SPEC "\n",
                           shp->shm_perm.key,
                           shp->shm_perm.id,
                           shp->shm_perm.mode,
@@ -1093,6 +1116,8 @@ static int sysvipc_shm_proc_show(struct seq_file *s, void *it)
                           shp->shm_perm.cgid,
                           shp->shm_atim,
                           shp->shm_dtim,
-                          shp->shm_ctim);
+                          shp->shm_ctim,
+                          rss * PAGE_SIZE,
+                          swp * PAGE_SIZE);
 }
 #endif
diff --git a/ipc/util.c b/ipc/util.c
index 69a0cc13d966..5c0d28921ba8 100644
--- a/ipc/util.c
+++ b/ipc/util.c
@@ -317,6 +317,7 @@ retry:
 
 /**
  *      ipc_check_perms -       check security and permissions for an IPC
+ *      @ns: IPC namespace
  *      @ipcp: ipc permission set
  *      @ops: the actual security routine to call
  *      @params: its parameters
@@ -329,12 +330,14 @@ retry:
  *
  *      It is called with ipc_ids.rw_mutex and ipcp->lock held.
  */
-static int ipc_check_perms(struct kern_ipc_perm *ipcp, struct ipc_ops *ops,
-                        struct ipc_params *params)
+static int ipc_check_perms(struct ipc_namespace *ns,
+                           struct kern_ipc_perm *ipcp,
+                           struct ipc_ops *ops,
+                           struct ipc_params *params)
 {
         int err;
 
-        if (ipcperms(ipcp, params->flg))
+        if (ipcperms(ns, ipcp, params->flg))
                 err = -EACCES;
         else {
                 err = ops->associate(ipcp, params->flg);
@@ -396,7 +399,7 @@ retry:
                                  * ipc_check_perms returns the IPC id on
                                  * success
                                  */
-                                err = ipc_check_perms(ipcp, ops, params);
+                                err = ipc_check_perms(ns, ipcp, ops, params);
                 }
                 ipc_unlock(ipcp);
         }
@@ -605,15 +608,18 @@ void ipc_rcu_putref(void *ptr)
 
 /**
  *      ipcperms        -       check IPC permissions
+ *      @ns: IPC namespace
  *      @ipcp: IPC permission set
  *      @flag: desired permission set.
  *
  *      Check user, group, other permissions for access
  *      to ipc resources. return 0 if allowed
+ *
+ *      @flag will most probably be 0 or S_...UGO from <linux/stat.h>
  */
  
-int ipcperms (struct kern_ipc_perm *ipcp, short flag)
-{       /* flag will most probably be 0 or S_...UGO from <linux/stat.h> */
+int ipcperms(struct ipc_namespace *ns, struct kern_ipc_perm *ipcp, short flag)
+{
         uid_t euid = current_euid();
         int requested_mode, granted_mode;
 
@@ -627,7 +633,7 @@ int ipcperms (struct kern_ipc_perm *ipcp, short flag)
                 granted_mode >>= 3;
         /* is there some bit set in requested_mode but not in granted_mode? */
         if ((requested_mode & ~granted_mode & 0007) && 
-            !capable(CAP_IPC_OWNER))
+            !ns_capable(ns->user_ns, CAP_IPC_OWNER))
                 return -1;
 
         return security_ipc_permission(ipcp, flag);
@@ -765,6 +771,7 @@ void ipc_update_perm(struct ipc64_perm *in, struct kern_ipc_perm *out)
 
 /**
  * ipcctl_pre_down - retrieve an ipc and check permissions for some IPC_XXX cmd
+ * @ns:  the ipc namespace
  * @ids:  the table of ids where to look for the ipc
  * @id:   the id of the ipc to retrieve
  * @cmd:  the cmd to check
@@ -779,7 +786,8 @@ void ipc_update_perm(struct ipc64_perm *in, struct kern_ipc_perm *out)
  *  - returns the ipc with both ipc and rw_mutex locks held in case of success
  *    or an err-code without any lock held otherwise.
  */
-struct kern_ipc_perm *ipcctl_pre_down(struct ipc_ids *ids, int id, int cmd,
+struct kern_ipc_perm *ipcctl_pre_down(struct ipc_namespace *ns,
+                                      struct ipc_ids *ids, int id, int cmd,
                                       struct ipc64_perm *perm, int extra_perm)
 {
         struct kern_ipc_perm *ipcp;
@@ -799,8 +807,8 @@ struct kern_ipc_perm *ipcctl_pre_down(struct ipc_ids *ids, int id, int cmd,
                                          perm->gid, perm->mode);
 
         euid = current_euid();
-        if (euid == ipcp->cuid ||
-            euid == ipcp->uid  || capable(CAP_SYS_ADMIN))
+        if (euid == ipcp->cuid || euid == ipcp->uid  ||
+            ns_capable(ns->user_ns, CAP_SYS_ADMIN))
                 return ipcp;
 
         err = -EPERM;
diff --git a/ipc/util.h b/ipc/util.h
index 764b51a37a6a..6f5c20bedaab 100644
--- a/ipc/util.h
+++ b/ipc/util.h
@@ -103,7 +103,7 @@ int ipc_get_maxid(struct ipc_ids *);
 void ipc_rmid(struct ipc_ids *, struct kern_ipc_perm *);
 
 /* must be called with ipcp locked */
-int ipcperms(struct kern_ipc_perm *ipcp, short flg);
+int ipcperms(struct ipc_namespace *ns, struct kern_ipc_perm *ipcp, short flg);
 
 /* for rare, potentially huge allocations.
  * both function can sleep
@@ -126,7 +126,8 @@ struct kern_ipc_perm *ipc_lock(struct ipc_ids *, int);
 void kernel_to_ipc64_perm(struct kern_ipc_perm *in, struct ipc64_perm *out);
 void ipc64_perm_to_ipc_perm(struct ipc64_perm *in, struct ipc_perm *out);
 void ipc_update_perm(struct ipc64_perm *in, struct kern_ipc_perm *out);
-struct kern_ipc_perm *ipcctl_pre_down(struct ipc_ids *ids, int id, int cmd,
+struct kern_ipc_perm *ipcctl_pre_down(struct ipc_namespace *ns,
+                                      struct ipc_ids *ids, int id, int cmd,
                                       struct ipc64_perm *perm, int extra_perm);
 
 #ifndef __ARCH_WANT_IPC_PARSE_VERSION