14 files changed, 158 insertions, 97 deletions

diff --git a/fs/nfsd/acl.h b/fs/nfsd/acl.h
index 34e5c40af5ef..8b186a4955cc 100644
--- a/fs/nfsd/acl.h
+++ b/fs/nfsd/acl.h
@@ -44,8 +44,6 @@
 struct nfs4_acl *nfs4_acl_new(int);
 int nfs4_acl_get_whotype(char *, u32);
 int nfs4_acl_write_who(int who, char *p);
-int nfs4_acl_permission(struct nfs4_acl *acl, uid_t owner, gid_t group,
-                                        uid_t who, u32 mask);
 
 #define NFS4_ACL_TYPE_DEFAULT   0x01
 #define NFS4_ACL_DIR            0x02
diff --git a/fs/nfsd/auth.c b/fs/nfsd/auth.c
index 34a10d78b839..06cddd572264 100644
--- a/fs/nfsd/auth.c
+++ b/fs/nfsd/auth.c
@@ -47,9 +47,9 @@ int nfsd_setuser(struct svc_rqst *rqstp, struct svc_export *exp)
                 if (!gi)
                         goto oom;
         } else if (flags & NFSEXP_ROOTSQUASH) {
-                if (!new->fsuid)
+                if (uid_eq(new->fsuid, GLOBAL_ROOT_UID))
                         new->fsuid = exp->ex_anon_uid;
-                if (!new->fsgid)
+                if (gid_eq(new->fsgid, GLOBAL_ROOT_GID))
                         new->fsgid = exp->ex_anon_gid;
 
                 gi = groups_alloc(rqgi->ngroups);
@@ -58,7 +58,7 @@ int nfsd_setuser(struct svc_rqst *rqstp, struct svc_export *exp)
 
                 for (i = 0; i < rqgi->ngroups; i++) {
                         if (gid_eq(GLOBAL_ROOT_GID, GROUP_AT(rqgi, i)))
-                                GROUP_AT(gi, i) = make_kgid(&init_user_ns, exp->ex_anon_gid);
+                                GROUP_AT(gi, i) = exp->ex_anon_gid;
                         else
                                 GROUP_AT(gi, i) = GROUP_AT(rqgi, i);
                 }
@@ -66,9 +66,9 @@ int nfsd_setuser(struct svc_rqst *rqstp, struct svc_export *exp)
                 gi = get_group_info(rqgi);
         }
 
-        if (new->fsuid == (uid_t) -1)
+        if (uid_eq(new->fsuid, INVALID_UID))
                 new->fsuid = exp->ex_anon_uid;
-        if (new->fsgid == (gid_t) -1)
+        if (gid_eq(new->fsgid, INVALID_GID))
                 new->fsgid = exp->ex_anon_gid;
 
         ret = set_groups(new, gi);
@@ -76,7 +76,7 @@ int nfsd_setuser(struct svc_rqst *rqstp, struct svc_export *exp)
         if (ret < 0)
                 goto error;
 
-        if (new->fsuid)
+        if (!uid_eq(new->fsuid, GLOBAL_ROOT_UID))
                 new->cap_effective = cap_drop_nfsd_set(new->cap_effective);
         else
                 new->cap_effective = cap_raise_nfsd_set(new->cap_effective,
diff --git a/fs/nfsd/auth.h b/fs/nfsd/auth.h
index 78b3c0e93822..53325a12ba62 100644
--- a/fs/nfsd/auth.h
+++ b/fs/nfsd/auth.h
@@ -1,6 +1,5 @@
 /*
  * nfsd-specific authentication stuff.
- * uid/gid mapping not yet implemented.
  *
  * Copyright (C) 1995, 1996 Olaf Kirch <okir@monad.swb.de>
  */
@@ -8,11 +7,6 @@
 #ifndef LINUX_NFSD_AUTH_H
 #define LINUX_NFSD_AUTH_H
 
-#define nfsd_luid(rq, uid)      ((u32)(uid))
-#define nfsd_lgid(rq, gid)      ((u32)(gid))
-#define nfsd_ruid(rq, uid)      ((u32)(uid))
-#define nfsd_rgid(rq, gid)      ((u32)(gid))
-
 /*
  * Set the current process's fsuid/fsgid etc to those of the NFS
  * client user
diff --git a/fs/nfsd/export.c b/fs/nfsd/export.c
index a3946cf13fc8..5681c5906f08 100644
--- a/fs/nfsd/export.c
+++ b/fs/nfsd/export.c
@@ -544,13 +544,17 @@ static int svc_export_parse(struct cache_detail *cd, char *mesg, int mlen)
                 err = get_int(&mesg, &an_int);
                 if (err)
                         goto out3;
-                exp.ex_anon_uid= an_int;
+                exp.ex_anon_uid= make_kuid(&init_user_ns, an_int);
+                if (!uid_valid(exp.ex_anon_uid))
+                        goto out3;
 
                 /* anon gid */
                 err = get_int(&mesg, &an_int);
                 if (err)
                         goto out3;
-                exp.ex_anon_gid= an_int;
+                exp.ex_anon_gid= make_kgid(&init_user_ns, an_int);
+                if (!gid_valid(exp.ex_anon_gid))
+                        goto out3;
 
                 /* fsid */
                 err = get_int(&mesg, &an_int);
@@ -613,7 +617,7 @@ out:
 }
 
 static void exp_flags(struct seq_file *m, int flag, int fsid,
-                uid_t anonu, uid_t anong, struct nfsd4_fs_locations *fslocs);
+                kuid_t anonu, kgid_t anong, struct nfsd4_fs_locations *fslocs);
 static void show_secinfo(struct seq_file *m, struct svc_export *exp);
 
 static int svc_export_show(struct seq_file *m,
@@ -1179,15 +1183,17 @@ static void show_secinfo(struct seq_file *m, struct svc_export *exp)
 }
 
 static void exp_flags(struct seq_file *m, int flag, int fsid,
-                uid_t anonu, uid_t anong, struct nfsd4_fs_locations *fsloc)
+                kuid_t anonu, kgid_t anong, struct nfsd4_fs_locations *fsloc)
 {
         show_expflags(m, flag, NFSEXP_ALLFLAGS);
         if (flag & NFSEXP_FSID)
                 seq_printf(m, ",fsid=%d", fsid);
-        if (anonu != (uid_t)-2 && anonu != (0x10000-2))
-                seq_printf(m, ",anonuid=%u", anonu);
-        if (anong != (gid_t)-2 && anong != (0x10000-2))
-                seq_printf(m, ",anongid=%u", anong);
+        if (!uid_eq(anonu, make_kuid(&init_user_ns, (uid_t)-2)) &&
+            !uid_eq(anonu, make_kuid(&init_user_ns, 0x10000-2)))
+                seq_printf(m, ",anonuid=%u", from_kuid(&init_user_ns, anonu));
+        if (!gid_eq(anong, make_kgid(&init_user_ns, (gid_t)-2)) &&
+            !gid_eq(anong, make_kgid(&init_user_ns, 0x10000-2)))
+                seq_printf(m, ",anongid=%u", from_kgid(&init_user_ns, anong));
         if (fsloc && fsloc->locations_count > 0) {
                 char *loctype = (fsloc->migrated) ? "refer" : "replicas";
                 int i;
diff --git a/fs/nfsd/idmap.h b/fs/nfsd/idmap.h
index 9d513efc01ba..bf95f6b817a4 100644
--- a/fs/nfsd/idmap.h
+++ b/fs/nfsd/idmap.h
@@ -54,9 +54,9 @@ static inline void nfsd_idmap_shutdown(struct net *net)
 }
 #endif
 
-__be32 nfsd_map_name_to_uid(struct svc_rqst *, const char *, size_t, __u32 *);
-__be32 nfsd_map_name_to_gid(struct svc_rqst *, const char *, size_t, __u32 *);
-int nfsd_map_uid_to_name(struct svc_rqst *, __u32, char *);
-int nfsd_map_gid_to_name(struct svc_rqst *, __u32, char *);
+__be32 nfsd_map_name_to_uid(struct svc_rqst *, const char *, size_t, kuid_t *);
+__be32 nfsd_map_name_to_gid(struct svc_rqst *, const char *, size_t, kgid_t *);
+int nfsd_map_uid_to_name(struct svc_rqst *, kuid_t, char *);
+int nfsd_map_gid_to_name(struct svc_rqst *, kgid_t, char *);
 
 #endif /* LINUX_NFSD_IDMAP_H */
diff --git a/fs/nfsd/nfs3xdr.c b/fs/nfsd/nfs3xdr.c
index 324c0baf7cda..925c944bc0bc 100644
--- a/fs/nfsd/nfs3xdr.c
+++ b/fs/nfsd/nfs3xdr.c
@@ -105,12 +105,14 @@ decode_sattr3(__be32 *p, struct iattr *iap)
                 iap->ia_mode = ntohl(*p++);
         }
         if (*p++) {
-                iap->ia_valid |= ATTR_UID;
-                iap->ia_uid = ntohl(*p++);
+                iap->ia_uid = make_kuid(&init_user_ns, ntohl(*p++));
+                if (uid_valid(iap->ia_uid))
+                        iap->ia_valid |= ATTR_UID;
         }
         if (*p++) {
-                iap->ia_valid |= ATTR_GID;
-                iap->ia_gid = ntohl(*p++);
+                iap->ia_gid = make_kgid(&init_user_ns, ntohl(*p++));
+                if (gid_valid(iap->ia_gid))
+                        iap->ia_valid |= ATTR_GID;
         }
         if (*p++) {
                 u64     newsize;
@@ -167,8 +169,8 @@ encode_fattr3(struct svc_rqst *rqstp, __be32 *p, struct svc_fh *fhp,
         *p++ = htonl(nfs3_ftypes[(stat->mode & S_IFMT) >> 12]);
         *p++ = htonl((u32) stat->mode);
         *p++ = htonl((u32) stat->nlink);
-        *p++ = htonl((u32) nfsd_ruid(rqstp, stat->uid));
-        *p++ = htonl((u32) nfsd_rgid(rqstp, stat->gid));
+        *p++ = htonl((u32) from_kuid(&init_user_ns, stat->uid));
+        *p++ = htonl((u32) from_kgid(&init_user_ns, stat->gid));
         if (S_ISLNK(stat->mode) && stat->size > NFS3_MAXPATHLEN) {
                 p = xdr_encode_hyper(p, (u64) NFS3_MAXPATHLEN);
         } else {
diff --git a/fs/nfsd/nfs4acl.c b/fs/nfsd/nfs4acl.c
index 9c51aff02ae2..8a50b3c18093 100644
--- a/fs/nfsd/nfs4acl.c
+++ b/fs/nfsd/nfs4acl.c
@@ -264,7 +264,7 @@ _posix_to_nfsv4_one(struct posix_acl *pacl, struct nfs4_acl *acl,
                         ace->flag = eflag;
                         ace->access_mask = deny_mask_from_posix(deny, flags);
                         ace->whotype = NFS4_ACL_WHO_NAMED;
-                        ace->who = pa->e_id;
+                        ace->who_uid = pa->e_uid;
                         ace++;
                         acl->naces++;
                 }
@@ -273,7 +273,7 @@ _posix_to_nfsv4_one(struct posix_acl *pacl, struct nfs4_acl *acl,
                 ace->access_mask = mask_from_posix(pa->e_perm & pas.mask,
                                                    flags);
                 ace->whotype = NFS4_ACL_WHO_NAMED;
-                ace->who = pa->e_id;
+                ace->who_uid = pa->e_uid;
                 ace++;
                 acl->naces++;
                 pa++;
@@ -300,7 +300,7 @@ _posix_to_nfsv4_one(struct posix_acl *pacl, struct nfs4_acl *acl,
                 ace->access_mask = mask_from_posix(pa->e_perm & pas.mask,
                                                    flags);
                 ace->whotype = NFS4_ACL_WHO_NAMED;
-                ace->who = pa->e_id;
+                ace->who_gid = pa->e_gid;
                 ace++;
                 acl->naces++;
                 pa++;
@@ -329,7 +329,7 @@ _posix_to_nfsv4_one(struct posix_acl *pacl, struct nfs4_acl *acl,
                         ace->flag = eflag | NFS4_ACE_IDENTIFIER_GROUP;
                         ace->access_mask = deny_mask_from_posix(deny, flags);
                         ace->whotype = NFS4_ACL_WHO_NAMED;
-                        ace->who = pa->e_id;
+                        ace->who_gid = pa->e_gid;
                         ace++;
                         acl->naces++;
                 }
@@ -345,6 +345,18 @@ _posix_to_nfsv4_one(struct posix_acl *pacl, struct nfs4_acl *acl,
         acl->naces++;
 }
 
+static bool
+pace_gt(struct posix_acl_entry *pace1, struct posix_acl_entry *pace2)
+{
+        if (pace1->e_tag != pace2->e_tag)
+                return pace1->e_tag > pace2->e_tag;
+        if (pace1->e_tag == ACL_USER)
+                return uid_gt(pace1->e_uid, pace2->e_uid);
+        if (pace1->e_tag == ACL_GROUP)
+                return gid_gt(pace1->e_gid, pace2->e_gid);
+        return false;
+}
+
 static void
 sort_pacl_range(struct posix_acl *pacl, int start, int end) {
         int sorted = 0, i;
@@ -355,8 +367,8 @@ sort_pacl_range(struct posix_acl *pacl, int start, int end) {
         while (!sorted) {
                 sorted = 1;
                 for (i = start; i < end; i++) {
-                        if (pacl->a_entries[i].e_id
-                                        > pacl->a_entries[i+1].e_id) {
+                        if (pace_gt(&pacl->a_entries[i],
+                                    &pacl->a_entries[i+1])) {
                                 sorted = 0;
                                 tmp = pacl->a_entries[i];
                                 pacl->a_entries[i] = pacl->a_entries[i+1];
@@ -398,7 +410,10 @@ struct posix_ace_state {
 };
 
 struct posix_user_ace_state {
-        uid_t uid;
+        union {
+                kuid_t uid;
+                kgid_t gid;
+        };
         struct posix_ace_state perms;
 };
 
@@ -521,7 +536,6 @@ posix_state_to_acl(struct posix_acl_state *state, unsigned int flags)
         if (error)
                 goto out_err;
         low_mode_from_nfs4(state->owner.allow, &pace->e_perm, flags);
-        pace->e_id = ACL_UNDEFINED_ID;
 
         for (i=0; i < state->users->n; i++) {
                 pace++;
@@ -531,7 +545,7 @@ posix_state_to_acl(struct posix_acl_state *state, unsigned int flags)
                         goto out_err;
                 low_mode_from_nfs4(state->users->aces[i].perms.allow,
                                         &pace->e_perm, flags);
-                pace->e_id = state->users->aces[i].uid;
+                pace->e_uid = state->users->aces[i].uid;
                 add_to_mask(state, &state->users->aces[i].perms);
         }
 
@@ -541,7 +555,6 @@ posix_state_to_acl(struct posix_acl_state *state, unsigned int flags)
         if (error)
                 goto out_err;
         low_mode_from_nfs4(state->group.allow, &pace->e_perm, flags);
-        pace->e_id = ACL_UNDEFINED_ID;
         add_to_mask(state, &state->group);
 
         for (i=0; i < state->groups->n; i++) {
@@ -552,14 +565,13 @@ posix_state_to_acl(struct posix_acl_state *state, unsigned int flags)
                         goto out_err;
                 low_mode_from_nfs4(state->groups->aces[i].perms.allow,
                                         &pace->e_perm, flags);
-                pace->e_id = state->groups->aces[i].uid;
+                pace->e_gid = state->groups->aces[i].gid;
                 add_to_mask(state, &state->groups->aces[i].perms);
         }
 
         pace++;
         pace->e_tag = ACL_MASK;
         low_mode_from_nfs4(state->mask.allow, &pace->e_perm, flags);
-        pace->e_id = ACL_UNDEFINED_ID;
 
         pace++;
         pace->e_tag = ACL_OTHER;
@@ -567,7 +579,6 @@ posix_state_to_acl(struct posix_acl_state *state, unsigned int flags)
         if (error)
                 goto out_err;
         low_mode_from_nfs4(state->other.allow, &pace->e_perm, flags);
-        pace->e_id = ACL_UNDEFINED_ID;
 
         return pacl;
 out_err:
@@ -587,12 +598,13 @@ static inline void deny_bits(struct posix_ace_state *astate, u32 mask)
         astate->deny |= mask & ~astate->allow;
 }
 
-static int find_uid(struct posix_acl_state *state, struct posix_ace_state_array *a, uid_t uid)
+static int find_uid(struct posix_acl_state *state, kuid_t uid)
 {
+        struct posix_ace_state_array *a = state->users;
         int i;
 
         for (i = 0; i < a->n; i++)
-                if (a->aces[i].uid == uid)
+                if (uid_eq(a->aces[i].uid, uid))
                         return i;
         /* Not found: */
         a->n++;
@@ -603,6 +615,23 @@ static int find_uid(struct posix_acl_state *state, struct posix_ace_state_array
         return i;
 }
 
+static int find_gid(struct posix_acl_state *state, kgid_t gid)
+{
+        struct posix_ace_state_array *a = state->groups;
+        int i;
+
+        for (i = 0; i < a->n; i++)
+                if (gid_eq(a->aces[i].gid, gid))
+                        return i;
+        /* Not found: */
+        a->n++;
+        a->aces[i].gid = gid;
+        a->aces[i].perms.allow = state->everyone.allow;
+        a->aces[i].perms.deny  = state->everyone.deny;
+
+        return i;
+}
+
 static void deny_bits_array(struct posix_ace_state_array *a, u32 mask)
 {
         int i;
@@ -636,7 +665,7 @@ static void process_one_v4_ace(struct posix_acl_state *state,
                 }
                 break;
         case ACL_USER:
-                i = find_uid(state, state->users, ace->who);
+                i = find_uid(state, ace->who_uid);
                 if (ace->type == NFS4_ACE_ACCESS_ALLOWED_ACE_TYPE) {
                         allow_bits(&state->users->aces[i].perms, mask);
                 } else {
@@ -658,7 +687,7 @@ static void process_one_v4_ace(struct posix_acl_state *state,
                 }
                 break;
         case ACL_GROUP:
-                i = find_uid(state, state->groups, ace->who);
+                i = find_gid(state, ace->who_gid);
                 if (ace->type == NFS4_ACE_ACCESS_ALLOWED_ACE_TYPE) {
                         allow_bits(&state->groups->aces[i].perms, mask);
                 } else {
diff --git a/fs/nfsd/nfs4idmap.c b/fs/nfsd/nfs4idmap.c
index a1f10c0a6255..0ce12346df9c 100644
--- a/fs/nfsd/nfs4idmap.c
+++ b/fs/nfsd/nfs4idmap.c
@@ -65,7 +65,7 @@ MODULE_PARM_DESC(nfs4_disable_idmapping,
 struct ent {
         struct cache_head h;
         int               type;                /* User / Group */
-        uid_t             id;
+        u32               id;
         char              name[IDMAP_NAMESZ];
         char              authname[IDMAP_NAMESZ];
 };
@@ -540,7 +540,7 @@ rqst_authname(struct svc_rqst *rqstp)
 
 static __be32
 idmap_name_to_id(struct svc_rqst *rqstp, int type, const char *name, u32 namelen,
-                uid_t *id)
+                u32 *id)
 {
         struct ent *item, key = {
                 .type = type,
@@ -564,7 +564,7 @@ idmap_name_to_id(struct svc_rqst *rqstp, int type, const char *name, u32 namelen
 }
 
 static int
-idmap_id_to_name(struct svc_rqst *rqstp, int type, uid_t id, char *name)
+idmap_id_to_name(struct svc_rqst *rqstp, int type, u32 id, char *name)
 {
         struct ent *item, key = {
                 .id = id,
@@ -587,7 +587,7 @@ idmap_id_to_name(struct svc_rqst *rqstp, int type, uid_t id, char *name)
 }
 
 static bool
-numeric_name_to_id(struct svc_rqst *rqstp, int type, const char *name, u32 namelen, uid_t *id)
+numeric_name_to_id(struct svc_rqst *rqstp, int type, const char *name, u32 namelen, u32 *id)
 {
         int ret;
         char buf[11];
@@ -603,7 +603,7 @@ numeric_name_to_id(struct svc_rqst *rqstp, int type, const char *name, u32 namel
 }
 
 static __be32
-do_name_to_id(struct svc_rqst *rqstp, int type, const char *name, u32 namelen, uid_t *id)
+do_name_to_id(struct svc_rqst *rqstp, int type, const char *name, u32 namelen, u32 *id)
 {
         if (nfs4_disable_idmapping && rqstp->rq_cred.cr_flavor < RPC_AUTH_GSS)
                 if (numeric_name_to_id(rqstp, type, name, namelen, id))
@@ -616,7 +616,7 @@ do_name_to_id(struct svc_rqst *rqstp, int type, const char *name, u32 namelen, u
 }
 
 static int
-do_id_to_name(struct svc_rqst *rqstp, int type, uid_t id, char *name)
+do_id_to_name(struct svc_rqst *rqstp, int type, u32 id, char *name)
 {
         if (nfs4_disable_idmapping && rqstp->rq_cred.cr_flavor < RPC_AUTH_GSS)
                 return sprintf(name, "%u", id);
@@ -625,26 +625,40 @@ do_id_to_name(struct svc_rqst *rqstp, int type, uid_t id, char *name)
 
 __be32
 nfsd_map_name_to_uid(struct svc_rqst *rqstp, const char *name, size_t namelen,
-                __u32 *id)
+                kuid_t *uid)
 {
-        return do_name_to_id(rqstp, IDMAP_TYPE_USER, name, namelen, id);
+        __be32 status;
+        u32 id = -1;
+        status = do_name_to_id(rqstp, IDMAP_TYPE_USER, name, namelen, &id);
+        *uid = make_kuid(&init_user_ns, id);
+        if (!uid_valid(*uid))
+                status = nfserr_badowner;
+        return status;
 }
 
 __be32
 nfsd_map_name_to_gid(struct svc_rqst *rqstp, const char *name, size_t namelen,
-                __u32 *id)
+                kgid_t *gid)
 {
-        return do_name_to_id(rqstp, IDMAP_TYPE_GROUP, name, namelen, id);
+        __be32 status;
+        u32 id = -1;
+        status = do_name_to_id(rqstp, IDMAP_TYPE_GROUP, name, namelen, &id);
+        *gid = make_kgid(&init_user_ns, id);
+        if (!gid_valid(*gid))
+                status = nfserr_badowner;
+        return status;
 }
 
 int
-nfsd_map_uid_to_name(struct svc_rqst *rqstp, __u32 id, char *name)
+nfsd_map_uid_to_name(struct svc_rqst *rqstp, kuid_t uid, char *name)
 {
+        u32 id = from_kuid(&init_user_ns, uid);
         return do_id_to_name(rqstp, IDMAP_TYPE_USER, id, name);
 }
 
 int
-nfsd_map_gid_to_name(struct svc_rqst *rqstp, __u32 id, char *name)
+nfsd_map_gid_to_name(struct svc_rqst *rqstp, kgid_t gid, char *name)
 {
+        u32 id = from_kgid(&init_user_ns, gid);
         return do_id_to_name(rqstp, IDMAP_TYPE_GROUP, id, name);
 }
diff --git a/fs/nfsd/nfs4recover.c b/fs/nfsd/nfs4recover.c
index ba6fdd4a0455..4914af4a817e 100644
--- a/fs/nfsd/nfs4recover.c
+++ b/fs/nfsd/nfs4recover.c
@@ -73,8 +73,8 @@ nfs4_save_creds(const struct cred **original_creds)
         if (!new)
                 return -ENOMEM;
 
-        new->fsuid = 0;
-        new->fsgid = 0;
+        new->fsuid = GLOBAL_ROOT_UID;
+        new->fsgid = GLOBAL_ROOT_GID;
         *original_creds = override_creds(new);
         put_cred(new);
         return 0;
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index 499e957510e7..9e7103b6e0ad 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -1202,7 +1202,7 @@ static bool groups_equal(struct group_info *g1, struct group_info *g2)
         if (g1->ngroups != g2->ngroups)
                 return false;
         for (i=0; i<g1->ngroups; i++)
-                if (GROUP_AT(g1, i) != GROUP_AT(g2, i))
+                if (!gid_eq(GROUP_AT(g1, i), GROUP_AT(g2, i)))
                         return false;
         return true;
 }
@@ -1227,8 +1227,8 @@ static bool
 same_creds(struct svc_cred *cr1, struct svc_cred *cr2)
 {
         if ((is_gss_cred(cr1) != is_gss_cred(cr2))
-                || (cr1->cr_uid != cr2->cr_uid)
-                || (cr1->cr_gid != cr2->cr_gid)
+                || (!uid_eq(cr1->cr_uid, cr2->cr_uid))
+                || (!gid_eq(cr1->cr_gid, cr2->cr_gid))
                 || !groups_equal(cr1->cr_group_info, cr2->cr_group_info))
                 return false;
         if (cr1->cr_principal == cr2->cr_principal)
diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index 0dc11586682f..2d1d06bae3a7 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -293,13 +293,13 @@ nfsd4_decode_fattr(struct nfsd4_compoundargs *argp, u32 *bmval,
                         ace->whotype = nfs4_acl_get_whotype(buf, dummy32);
                         status = nfs_ok;
                         if (ace->whotype != NFS4_ACL_WHO_NAMED)
-                                ace->who = 0;
+                                ;
                         else if (ace->flag & NFS4_ACE_IDENTIFIER_GROUP)
                                 status = nfsd_map_name_to_gid(argp->rqstp,
-                                                buf, dummy32, &ace->who);
+                                                buf, dummy32, &ace->who_gid);
                         else
                                 status = nfsd_map_name_to_uid(argp->rqstp,
-                                                buf, dummy32, &ace->who);
+                                                buf, dummy32, &ace->who_uid);
                         if (status)
                                 return status;
                 }
@@ -464,9 +464,16 @@ static __be32 nfsd4_decode_cb_sec(struct nfsd4_compoundargs *argp, struct nfsd4_
                         READ32(dummy);
                         READ_BUF(dummy * 4);
                         if (cbs->flavor == (u32)(-1)) {
-                                cbs->uid = uid;
-                                cbs->gid = gid;
-                                cbs->flavor = RPC_AUTH_UNIX;
+                                kuid_t kuid = make_kuid(&init_user_ns, uid);
+                                kgid_t kgid = make_kgid(&init_user_ns, gid);
+                                if (uid_valid(kuid) && gid_valid(kgid)) {
+                                        cbs->uid = kuid;
+                                        cbs->gid = kgid;
+                                        cbs->flavor = RPC_AUTH_UNIX;
+                                } else {
+                                        dprintk("RPC_AUTH_UNIX with invalid"
+                                                "uid or gid ignoring!\n");
+                                }
                         }
                         break;
                 case RPC_AUTH_GSS:
@@ -1926,7 +1933,7 @@ static u32 nfs4_file_type(umode_t mode)
 }
 
 static __be32
-nfsd4_encode_name(struct svc_rqst *rqstp, int whotype, uid_t id, int group,
+nfsd4_encode_name(struct svc_rqst *rqstp, int whotype, kuid_t uid, kgid_t gid,
                         __be32 **p, int *buflen)
 {
         int status;
@@ -1935,10 +1942,10 @@ nfsd4_encode_name(struct svc_rqst *rqstp, int whotype, uid_t id, int group,
                 return nfserr_resource;
         if (whotype != NFS4_ACL_WHO_NAMED)
                 status = nfs4_acl_write_who(whotype, (u8 *)(*p + 1));
-        else if (group)
-                status = nfsd_map_gid_to_name(rqstp, id, (u8 *)(*p + 1));
+        else if (gid_valid(gid))
+                status = nfsd_map_gid_to_name(rqstp, gid, (u8 *)(*p + 1));
         else
-                status = nfsd_map_uid_to_name(rqstp, id, (u8 *)(*p + 1));
+                status = nfsd_map_uid_to_name(rqstp, uid, (u8 *)(*p + 1));
         if (status < 0)
                 return nfserrno(status);
         *p = xdr_encode_opaque(*p, NULL, status);
@@ -1948,22 +1955,33 @@ nfsd4_encode_name(struct svc_rqst *rqstp, int whotype, uid_t id, int group,
 }
 
 static inline __be32
-nfsd4_encode_user(struct svc_rqst *rqstp, uid_t uid, __be32 **p, int *buflen)
+nfsd4_encode_user(struct svc_rqst *rqstp, kuid_t user, __be32 **p, int *buflen)
 {
-        return nfsd4_encode_name(rqstp, NFS4_ACL_WHO_NAMED, uid, 0, p, buflen);
+        return nfsd4_encode_name(rqstp, NFS4_ACL_WHO_NAMED, user, INVALID_GID,
+                                 p, buflen);
 }
 
 static inline __be32
-nfsd4_encode_group(struct svc_rqst *rqstp, uid_t gid, __be32 **p, int *buflen)
+nfsd4_encode_group(struct svc_rqst *rqstp, kgid_t group, __be32 **p, int *buflen)
 {
-        return nfsd4_encode_name(rqstp, NFS4_ACL_WHO_NAMED, gid, 1, p, buflen);
+        return nfsd4_encode_name(rqstp, NFS4_ACL_WHO_NAMED, INVALID_UID, group,
+                                 p, buflen);
 }
 
 static inline __be32
-nfsd4_encode_aclname(struct svc_rqst *rqstp, int whotype, uid_t id, int group,
+nfsd4_encode_aclname(struct svc_rqst *rqstp, struct nfs4_ace *ace,
                 __be32 **p, int *buflen)
 {
-        return nfsd4_encode_name(rqstp, whotype, id, group, p, buflen);
+        kuid_t uid = INVALID_UID;
+        kgid_t gid = INVALID_GID;
+
+        if (ace->whotype == NFS4_ACL_WHO_NAMED) {
+                if (ace->flag & NFS4_ACE_IDENTIFIER_GROUP)
+                        gid = ace->who_gid;
+                else
+                        uid = ace->who_uid;
+        }
+        return nfsd4_encode_name(rqstp, ace->whotype, uid, gid, p, buflen);
 }
 
 #define WORD0_ABSENT_FS_ATTRS (FATTR4_WORD0_FS_LOCATIONS | FATTR4_WORD0_FSID | \
@@ -2224,9 +2242,7 @@ nfsd4_encode_fattr(struct svc_fh *fhp, struct svc_export *exp,
                         WRITE32(ace->type);
                         WRITE32(ace->flag);
                         WRITE32(ace->access_mask & NFS4_ACE_MASK_ALL);
-                        status = nfsd4_encode_aclname(rqstp, ace->whotype,
-                                ace->who, ace->flag & NFS4_ACE_IDENTIFIER_GROUP,
-                                &p, &buflen);
+                        status = nfsd4_encode_aclname(rqstp, ace, &p, &buflen);
                         if (status == nfserr_resource)
                                 goto out_resource;
                         if (status)
diff --git a/fs/nfsd/nfsxdr.c b/fs/nfsd/nfsxdr.c
index 979b42106979..4201ede0ec91 100644
--- a/fs/nfsd/nfsxdr.c
+++ b/fs/nfsd/nfsxdr.c
@@ -100,12 +100,14 @@ decode_sattr(__be32 *p, struct iattr *iap)
                 iap->ia_mode = tmp;
         }
         if ((tmp = ntohl(*p++)) != (u32)-1) {
-                iap->ia_valid |= ATTR_UID;
-                iap->ia_uid = tmp;
+                iap->ia_uid = make_kuid(&init_user_ns, tmp);
+                if (uid_valid(iap->ia_uid))
+                        iap->ia_valid |= ATTR_UID;
         }
         if ((tmp = ntohl(*p++)) != (u32)-1) {
-                iap->ia_valid |= ATTR_GID;
-                iap->ia_gid = tmp;
+                iap->ia_gid = make_kgid(&init_user_ns, tmp);
+                if (gid_valid(iap->ia_gid))
+                        iap->ia_valid |= ATTR_GID;
         }
         if ((tmp = ntohl(*p++)) != (u32)-1) {
                 iap->ia_valid |= ATTR_SIZE;
@@ -151,8 +153,8 @@ encode_fattr(struct svc_rqst *rqstp, __be32 *p, struct svc_fh *fhp,
         *p++ = htonl(nfs_ftypes[type >> 12]);
         *p++ = htonl((u32) stat->mode);
         *p++ = htonl((u32) stat->nlink);
-        *p++ = htonl((u32) nfsd_ruid(rqstp, stat->uid));
-        *p++ = htonl((u32) nfsd_rgid(rqstp, stat->gid));
+        *p++ = htonl((u32) from_kuid(&init_user_ns, stat->uid));
+        *p++ = htonl((u32) from_kgid(&init_user_ns, stat->gid));
 
         if (S_ISLNK(type) && stat->size > NFS_MAXPATHLEN) {
                 *p++ = htonl(NFS_MAXPATHLEN);
diff --git a/fs/nfsd/state.h b/fs/nfsd/state.h
index d1c229feed52..1a8c7391f7ae 100644
--- a/fs/nfsd/state.h
+++ b/fs/nfsd/state.h
@@ -152,8 +152,8 @@ struct nfsd4_channel_attrs {
 
 struct nfsd4_cb_sec {
         u32     flavor; /* (u32)(-1) used to mean "no valid flavor" */
-        u32     uid;
-        u32     gid;
+        kuid_t  uid;
+        kgid_t  gid;
 };
 
 struct nfsd4_create_session {
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index d586117fa94a..31ff1d642e31 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -401,8 +401,8 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap,
 
         /* Revoke setuid/setgid on chown */
         if (!S_ISDIR(inode->i_mode) &&
-            (((iap->ia_valid & ATTR_UID) && iap->ia_uid != inode->i_uid) ||
-             ((iap->ia_valid & ATTR_GID) && iap->ia_gid != inode->i_gid))) {
+            (((iap->ia_valid & ATTR_UID) && !uid_eq(iap->ia_uid, inode->i_uid)) ||
+             ((iap->ia_valid & ATTR_GID) && !gid_eq(iap->ia_gid, inode->i_gid)))) {
                 iap->ia_valid |= ATTR_KILL_PRIV;
                 if (iap->ia_valid & ATTR_MODE) {
                         /* we're setting mode too, just clear the s*id bits */
@@ -1205,7 +1205,7 @@ nfsd_create_setattr(struct svc_rqst *rqstp, struct svc_fh *resfhp,
          * send along the gid on create when it tries to implement
          * setgid directories via NFS:
          */
-        if (current_fsuid() != 0)
+        if (!uid_eq(current_fsuid(), GLOBAL_ROOT_UID))
                 iap->ia_valid &= ~(ATTR_UID|ATTR_GID);
         if (iap->ia_valid)
                 return nfsd_setattr(rqstp, resfhp, iap, 0, (time_t)0);
@@ -2150,7 +2150,7 @@ nfsd_permission(struct svc_rqst *rqstp, struct svc_export *exp,
          * with NFSv3.
          */
         if ((acc & NFSD_MAY_OWNER_OVERRIDE) &&
-            inode->i_uid == current_fsuid())
+            uid_eq(inode->i_uid, current_fsuid()))
                 return 0;
 
         /* This assumes  NFSD_MAY_{READ,WRITE,EXEC} == MAY_{READ,WRITE,EXEC} */