2 files changed, 9 insertions, 3 deletions

diff --git a/ipc/mqueue.c b/ipc/mqueue.c
index 28bd64ddeda3..b6a0d46fbad7 100644
--- a/ipc/mqueue.c
+++ b/ipc/mqueue.c
@@ -66,6 +66,7 @@ struct mqueue_inode_info {
 
         struct sigevent notify;
         struct pid* notify_owner;
+        struct user_namespace *notify_user_ns;
         struct user_struct *user;       /* user who created, for accounting */
         struct sock *notify_sock;
         struct sk_buff *notify_cookie;
@@ -139,6 +140,7 @@ static struct inode *mqueue_get_inode(struct super_block *sb,
                 INIT_LIST_HEAD(&info->e_wait_q[0].list);
                 INIT_LIST_HEAD(&info->e_wait_q[1].list);
                 info->notify_owner = NULL;
+                info->notify_user_ns = NULL;
                 info->qsize = 0;
                 info->user = NULL;      /* set when all is ok */
                 memset(&info->attr, 0, sizeof(info->attr));
@@ -536,8 +538,7 @@ static void __do_notify(struct mqueue_inode_info *info)
                         rcu_read_lock();
                         sig_i.si_pid = task_tgid_nr_ns(current,
                                                 ns_of_pid(info->notify_owner));
-                        sig_i.si_uid = user_ns_map_uid(info->user->user_ns,
-                                                current_cred(), current_uid());
+                        sig_i.si_uid = from_kuid_munged(info->notify_user_ns, current_uid());
                         rcu_read_unlock();
 
                         kill_pid_info(info->notify.sigev_signo,
@@ -550,7 +551,9 @@ static void __do_notify(struct mqueue_inode_info *info)
                 }
                 /* after notification unregisters process */
                 put_pid(info->notify_owner);
+                put_user_ns(info->notify_user_ns);
                 info->notify_owner = NULL;
+                info->notify_user_ns = NULL;
         }
         wake_up(&info->wait_q);
 }
@@ -575,7 +578,9 @@ static void remove_notification(struct mqueue_inode_info *info)
                 netlink_sendskb(info->notify_sock, info->notify_cookie);
         }
         put_pid(info->notify_owner);
+        put_user_ns(info->notify_user_ns);
         info->notify_owner = NULL;
+        info->notify_user_ns = NULL;
 }
 
 static int mq_attr_ok(struct ipc_namespace *ipc_ns, struct mq_attr *attr)
@@ -1140,6 +1145,7 @@ retry:
                 }
 
                 info->notify_owner = get_pid(task_tgid(current));
+                info->notify_user_ns = get_user_ns(current_user_ns());
                 inode->i_atime = inode->i_ctime = CURRENT_TIME;
         }
         spin_unlock(&info->lock);
diff --git a/ipc/namespace.c b/ipc/namespace.c
index ce0a647869b1..f362298c5ce4 100644
--- a/ipc/namespace.c
+++ b/ipc/namespace.c
@@ -46,7 +46,7 @@ static struct ipc_namespace *create_ipc_ns(struct task_struct *tsk,
         ipcns_notify(IPCNS_CREATED);
         register_ipcns_notifier(ns);
 
-        ns->user_ns = get_user_ns(task_cred_xxx(tsk, user)->user_ns);
+        ns->user_ns = get_user_ns(task_cred_xxx(tsk, user_ns));
 
         return ns;
 }