1 files changed, 10 insertions, 2 deletions

diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
index ce92f7e6290a..89f6eaed067a 100644
--- a/kernel/user_namespace.c
+++ b/kernel/user_namespace.c
@@ -391,7 +391,7 @@ static int uid_m_show(struct seq_file *seq, void *v)
         struct user_namespace *lower_ns;
         uid_t lower;
 
-        lower_ns = current_user_ns();
+        lower_ns = seq_user_ns(seq);
         if ((lower_ns == ns) && lower_ns->parent)
                 lower_ns = lower_ns->parent;
 
@@ -412,7 +412,7 @@ static int gid_m_show(struct seq_file *seq, void *v)
         struct user_namespace *lower_ns;
         gid_t lower;
 
-        lower_ns = current_user_ns();
+        lower_ns = seq_user_ns(seq);
         if ((lower_ns == ns) && lower_ns->parent)
                 lower_ns = lower_ns->parent;
 
@@ -688,10 +688,14 @@ ssize_t proc_uid_map_write(struct file *file, const char __user *buf, size_t siz
 {
         struct seq_file *seq = file->private_data;
         struct user_namespace *ns = seq->private;
+        struct user_namespace *seq_ns = seq_user_ns(seq);
 
         if (!ns->parent)
                 return -EPERM;
 
+        if ((seq_ns != ns) && (seq_ns != ns->parent))
+                return -EPERM;
+
         return map_write(file, buf, size, ppos, CAP_SETUID,
                          &ns->uid_map, &ns->parent->uid_map);
 }
@@ -700,10 +704,14 @@ ssize_t proc_gid_map_write(struct file *file, const char __user *buf, size_t siz
 {
         struct seq_file *seq = file->private_data;
         struct user_namespace *ns = seq->private;
+        struct user_namespace *seq_ns = seq_user_ns(seq);
 
         if (!ns->parent)
                 return -EPERM;
 
+        if ((seq_ns != ns) && (seq_ns != ns->parent))
+                return -EPERM;
+
         return map_write(file, buf, size, ppos, CAP_SETGID,
                          &ns->gid_map, &ns->parent->gid_map);
 }