1 files changed, 12 insertions, 2 deletions

diff --git a/kernel/uid16.c b/kernel/uid16.c
index 51c6e89e8619..e530bc34c4cf 100644
--- a/kernel/uid16.c
+++ b/kernel/uid16.c
@@ -134,11 +134,14 @@ SYSCALL_DEFINE1(setfsgid16, old_gid_t, gid)
 static int groups16_to_user(old_gid_t __user *grouplist,
     struct group_info *group_info)
 {
+        struct user_namespace *user_ns = current_user_ns();
         int i;
         old_gid_t group;
+        kgid_t kgid;
 
         for (i = 0; i < group_info->ngroups; i++) {
-                group = high2lowgid(GROUP_AT(group_info, i));
+                kgid = GROUP_AT(group_info, i);
+                group = high2lowgid(from_kgid_munged(user_ns, kgid));
                 if (put_user(group, grouplist+i))
                         return -EFAULT;
         }
@@ -149,13 +152,20 @@ static int groups16_to_user(old_gid_t __user *grouplist,
 static int groups16_from_user(struct group_info *group_info,
     old_gid_t __user *grouplist)
 {
+        struct user_namespace *user_ns = current_user_ns();
         int i;
         old_gid_t group;
+        kgid_t kgid;
 
         for (i = 0; i < group_info->ngroups; i++) {
                 if (get_user(group, grouplist+i))
                         return  -EFAULT;
-                GROUP_AT(group_info, i) = low2highgid(group);
+
+                kgid = make_kgid(user_ns, low2highgid(group));
+                if (!gid_valid(kgid))
+                        return -EINVAL;
+
+                GROUP_AT(group_info, i) = kgid;
         }
 
         return 0;