9 files changed, 170 insertions, 91 deletions

diff --git a/net/9p/client.c b/net/9p/client.c
index 34d417670935..8eb75425e6e6 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -1100,7 +1100,7 @@ void p9_client_begin_disconnect(struct p9_client *clnt)
 EXPORT_SYMBOL(p9_client_begin_disconnect);
 
 struct p9_fid *p9_client_attach(struct p9_client *clnt, struct p9_fid *afid,
-        char *uname, u32 n_uname, char *aname)
+        char *uname, kuid_t n_uname, char *aname)
 {
         int err = 0;
         struct p9_req_t *req;
@@ -1117,7 +1117,7 @@ struct p9_fid *p9_client_attach(struct p9_client *clnt, struct p9_fid *afid,
                 goto error;
         }
 
-        req = p9_client_rpc(clnt, P9_TATTACH, "ddss?d", fid->fid,
+        req = p9_client_rpc(clnt, P9_TATTACH, "ddss?u", fid->fid,
                         afid ? afid->fid : P9_NOFID, uname, aname, n_uname);
         if (IS_ERR(req)) {
                 err = PTR_ERR(req);
@@ -1270,7 +1270,7 @@ error:
 EXPORT_SYMBOL(p9_client_open);
 
 int p9_client_create_dotl(struct p9_fid *ofid, char *name, u32 flags, u32 mode,
-                gid_t gid, struct p9_qid *qid)
+                kgid_t gid, struct p9_qid *qid)
 {
         int err = 0;
         struct p9_client *clnt;
@@ -1279,13 +1279,14 @@ int p9_client_create_dotl(struct p9_fid *ofid, char *name, u32 flags, u32 mode,
 
         p9_debug(P9_DEBUG_9P,
                         ">>> TLCREATE fid %d name %s flags %d mode %d gid %d\n",
-                        ofid->fid, name, flags, mode, gid);
+                        ofid->fid, name, flags, mode,
+                        from_kgid(&init_user_ns, gid));
         clnt = ofid->clnt;
 
         if (ofid->mode != -1)
                 return -EINVAL;
 
-        req = p9_client_rpc(clnt, P9_TLCREATE, "dsddd", ofid->fid, name, flags,
+        req = p9_client_rpc(clnt, P9_TLCREATE, "dsddg", ofid->fid, name, flags,
                         mode, gid);
         if (IS_ERR(req)) {
                 err = PTR_ERR(req);
@@ -1358,7 +1359,7 @@ error:
 }
 EXPORT_SYMBOL(p9_client_fcreate);
 
-int p9_client_symlink(struct p9_fid *dfid, char *name, char *symtgt, gid_t gid,
+int p9_client_symlink(struct p9_fid *dfid, char *name, char *symtgt, kgid_t gid,
                 struct p9_qid *qid)
 {
         int err = 0;
@@ -1369,7 +1370,7 @@ int p9_client_symlink(struct p9_fid *dfid, char *name, char *symtgt, gid_t gid,
                         dfid->fid, name, symtgt);
         clnt = dfid->clnt;
 
-        req = p9_client_rpc(clnt, P9_TSYMLINK, "dssd", dfid->fid, name, symtgt,
+        req = p9_client_rpc(clnt, P9_TSYMLINK, "dssg", dfid->fid, name, symtgt,
                         gid);
         if (IS_ERR(req)) {
                 err = PTR_ERR(req);
@@ -1710,7 +1711,9 @@ struct p9_wstat *p9_client_stat(struct p9_fid *fid)
                 (unsigned long long)ret->qid.path, ret->qid.version, ret->mode,
                 ret->atime, ret->mtime, (unsigned long long)ret->length,
                 ret->name, ret->uid, ret->gid, ret->muid, ret->extension,
-                ret->n_uid, ret->n_gid, ret->n_muid);
+                from_kuid(&init_user_ns, ret->n_uid),
+                from_kgid(&init_user_ns, ret->n_gid),
+                from_kuid(&init_user_ns, ret->n_muid));
 
         p9_free_req(clnt, req);
         return ret;
@@ -1764,8 +1767,10 @@ struct p9_stat_dotl *p9_client_getattr_dotl(struct p9_fid *fid,
                 "<<< st_btime_sec=%lld st_btime_nsec=%lld\n"
                 "<<< st_gen=%lld st_data_version=%lld",
                 ret->st_result_mask, ret->qid.type, ret->qid.path,
-                ret->qid.version, ret->st_mode, ret->st_nlink, ret->st_uid,
-                ret->st_gid, ret->st_rdev, ret->st_size, ret->st_blksize,
+                ret->qid.version, ret->st_mode, ret->st_nlink,
+                from_kuid(&init_user_ns, ret->st_uid),
+                from_kgid(&init_user_ns, ret->st_gid),
+                ret->st_rdev, ret->st_size, ret->st_blksize,
                 ret->st_blocks, ret->st_atime_sec, ret->st_atime_nsec,
                 ret->st_mtime_sec, ret->st_mtime_nsec, ret->st_ctime_sec,
                 ret->st_ctime_nsec, ret->st_btime_sec, ret->st_btime_nsec,
@@ -1828,7 +1833,9 @@ int p9_client_wstat(struct p9_fid *fid, struct p9_wstat *wst)
                 (unsigned long long)wst->qid.path, wst->qid.version, wst->mode,
                 wst->atime, wst->mtime, (unsigned long long)wst->length,
                 wst->name, wst->uid, wst->gid, wst->muid, wst->extension,
-                wst->n_uid, wst->n_gid, wst->n_muid);
+                from_kuid(&init_user_ns, wst->n_uid),
+                from_kgid(&init_user_ns, wst->n_gid),
+                from_kuid(&init_user_ns, wst->n_muid));
 
         req = p9_client_rpc(clnt, P9_TWSTAT, "dwS", fid->fid, wst->size+2, wst);
         if (IS_ERR(req)) {
@@ -1857,7 +1864,9 @@ int p9_client_setattr(struct p9_fid *fid, struct p9_iattr_dotl *p9attr)
                 "    valid=%x mode=%x uid=%d gid=%d size=%lld\n"
                 "    atime_sec=%lld atime_nsec=%lld\n"
                 "    mtime_sec=%lld mtime_nsec=%lld\n",
-                p9attr->valid, p9attr->mode, p9attr->uid, p9attr->gid,
+                p9attr->valid, p9attr->mode,
+                from_kuid(&init_user_ns, p9attr->uid),
+                from_kgid(&init_user_ns, p9attr->gid),
                 p9attr->size, p9attr->atime_sec, p9attr->atime_nsec,
                 p9attr->mtime_sec, p9attr->mtime_nsec);
 
@@ -2106,7 +2115,7 @@ error:
 EXPORT_SYMBOL(p9_client_readdir);
 
 int p9_client_mknod_dotl(struct p9_fid *fid, char *name, int mode,
-                        dev_t rdev, gid_t gid, struct p9_qid *qid)
+                        dev_t rdev, kgid_t gid, struct p9_qid *qid)
 {
         int err;
         struct p9_client *clnt;
@@ -2116,7 +2125,7 @@ int p9_client_mknod_dotl(struct p9_fid *fid, char *name, int mode,
         clnt = fid->clnt;
         p9_debug(P9_DEBUG_9P, ">>> TMKNOD fid %d name %s mode %d major %d "
                 "minor %d\n", fid->fid, name, mode, MAJOR(rdev), MINOR(rdev));
-        req = p9_client_rpc(clnt, P9_TMKNOD, "dsdddd", fid->fid, name, mode,
+        req = p9_client_rpc(clnt, P9_TMKNOD, "dsdddg", fid->fid, name, mode,
                 MAJOR(rdev), MINOR(rdev), gid);
         if (IS_ERR(req))
                 return PTR_ERR(req);
@@ -2137,7 +2146,7 @@ error:
 EXPORT_SYMBOL(p9_client_mknod_dotl);
 
 int p9_client_mkdir_dotl(struct p9_fid *fid, char *name, int mode,
-                                gid_t gid, struct p9_qid *qid)
+                                kgid_t gid, struct p9_qid *qid)
 {
         int err;
         struct p9_client *clnt;
@@ -2146,8 +2155,8 @@ int p9_client_mkdir_dotl(struct p9_fid *fid, char *name, int mode,
         err = 0;
         clnt = fid->clnt;
         p9_debug(P9_DEBUG_9P, ">>> TMKDIR fid %d name %s mode %d gid %d\n",
-                 fid->fid, name, mode, gid);
-        req = p9_client_rpc(clnt, P9_TMKDIR, "dsdd", fid->fid, name, mode,
+                 fid->fid, name, mode, from_kgid(&init_user_ns, gid));
+        req = p9_client_rpc(clnt, P9_TMKDIR, "dsdg", fid->fid, name, mode,
                 gid);
         if (IS_ERR(req))
                 return PTR_ERR(req);
diff --git a/net/9p/protocol.c b/net/9p/protocol.c
index 3d33ecf13327..ab9127ec5b7a 100644
--- a/net/9p/protocol.c
+++ b/net/9p/protocol.c
@@ -85,6 +85,8 @@ pdu_write_u(struct p9_fcall *pdu, const char __user *udata, size_t size)
         d - int32_t
         q - int64_t
         s - string
+        u - numeric uid
+        g - numeric gid
         S - stat
         Q - qid
         D - data blob (int32_t size followed by void *, results are not freed)
@@ -163,6 +165,26 @@ p9pdu_vreadf(struct p9_fcall *pdu, int proto_version, const char *fmt,
                                         (*sptr)[len] = 0;
                         }
                         break;
+                case 'u': {
+                                kuid_t *uid = va_arg(ap, kuid_t *);
+                                __le32 le_val;
+                                if (pdu_read(pdu, &le_val, sizeof(le_val))) {
+                                        errcode = -EFAULT;
+                                        break;
+                                }
+                                *uid = make_kuid(&init_user_ns,
+                                                 le32_to_cpu(le_val));
+                        } break;
+                case 'g': {
+                                kgid_t *gid = va_arg(ap, kgid_t *);
+                                __le32 le_val;
+                                if (pdu_read(pdu, &le_val, sizeof(le_val))) {
+                                        errcode = -EFAULT;
+                                        break;
+                                }
+                                *gid = make_kgid(&init_user_ns,
+                                                 le32_to_cpu(le_val));
+                        } break;
                 case 'Q':{
                                 struct p9_qid *qid =
                                     va_arg(ap, struct p9_qid *);
@@ -177,11 +199,12 @@ p9pdu_vreadf(struct p9_fcall *pdu, int proto_version, const char *fmt,
                                     va_arg(ap, struct p9_wstat *);
 
                                 memset(stbuf, 0, sizeof(struct p9_wstat));
-                                stbuf->n_uid = stbuf->n_gid = stbuf->n_muid =
-                                                                        -1;
+                                stbuf->n_uid = stbuf->n_muid = INVALID_UID;
+                                stbuf->n_gid = INVALID_GID;
+
                                 errcode =
                                     p9pdu_readf(pdu, proto_version,
-                                                "wwdQdddqssss?sddd",
+                                                "wwdQdddqssss?sugu",
                                                 &stbuf->size, &stbuf->type,
                                                 &stbuf->dev, &stbuf->qid,
                                                 &stbuf->mode, &stbuf->atime,
@@ -294,7 +317,7 @@ p9pdu_vreadf(struct p9_fcall *pdu, int proto_version, const char *fmt,
                                 memset(stbuf, 0, sizeof(struct p9_stat_dotl));
                                 errcode =
                                     p9pdu_readf(pdu, proto_version,
-                                        "qQdddqqqqqqqqqqqqqqq",
+                                        "qQdugqqqqqqqqqqqqqqq",
                                         &stbuf->st_result_mask,
                                         &stbuf->qid,
                                         &stbuf->st_mode,
@@ -377,6 +400,20 @@ p9pdu_vwritef(struct p9_fcall *pdu, int proto_version, const char *fmt,
                                         errcode = -EFAULT;
                         }
                         break;
+                case 'u': {
+                                kuid_t uid = va_arg(ap, kuid_t);
+                                __le32 val = cpu_to_le32(
+                                                from_kuid(&init_user_ns, uid));
+                                if (pdu_write(pdu, &val, sizeof(val)))
+                                        errcode = -EFAULT;
+                        } break;
+                case 'g': {
+                                kgid_t gid = va_arg(ap, kgid_t);
+                                __le32 val = cpu_to_le32(
+                                                from_kgid(&init_user_ns, gid));
+                                if (pdu_write(pdu, &val, sizeof(val)))
+                                        errcode = -EFAULT;
+                        } break;
                 case 'Q':{
                                 const struct p9_qid *qid =
                                     va_arg(ap, const struct p9_qid *);
@@ -390,7 +427,7 @@ p9pdu_vwritef(struct p9_fcall *pdu, int proto_version, const char *fmt,
                                     va_arg(ap, const struct p9_wstat *);
                                 errcode =
                                     p9pdu_writef(pdu, proto_version,
-                                                 "wwdQdddqssss?sddd",
+                                                 "wwdQdddqssss?sugu",
                                                  stbuf->size, stbuf->type,
                                                  stbuf->dev, &stbuf->qid,
                                                  stbuf->mode, stbuf->atime,
@@ -468,7 +505,7 @@ p9pdu_vwritef(struct p9_fcall *pdu, int proto_version, const char *fmt,
                                                         struct p9_iattr_dotl *);
 
                                 errcode = p9pdu_writef(pdu, proto_version,
-                                                        "ddddqqqqq",
+                                                        "ddugqqqqq",
                                                         p9attr->valid,
                                                         p9attr->mode,
                                                         p9attr->uid,
diff --git a/net/ceph/ceph_common.c b/net/ceph/ceph_common.c
index ee71ea26777a..1deb29af82fd 100644
--- a/net/ceph/ceph_common.c
+++ b/net/ceph/ceph_common.c
@@ -15,6 +15,8 @@
 #include <linux/slab.h>
 #include <linux/statfs.h>
 #include <linux/string.h>
+#include <linux/nsproxy.h>
+#include <net/net_namespace.h>
 
 
 #include <linux/ceph/ceph_features.h>
@@ -292,6 +294,9 @@ ceph_parse_options(char *options, const char *dev_name,
         int err = -ENOMEM;
         substring_t argstr[MAX_OPT_ARGS];
 
+        if (current->nsproxy->net_ns != &init_net)
+                return ERR_PTR(-EINVAL);
+
         opt = kzalloc(sizeof(*opt), GFP_KERNEL);
         if (!opt)
                 return ERR_PTR(-ENOMEM);
diff --git a/net/sunrpc/auth.c b/net/sunrpc/auth.c
index b5c067bccc45..392adc41e2e5 100644
--- a/net/sunrpc/auth.c
+++ b/net/sunrpc/auth.c
@@ -412,7 +412,7 @@ rpcauth_lookup_credcache(struct rpc_auth *auth, struct auth_cred * acred,
                         *entry, *new;
         unsigned int nr;
 
-        nr = hash_long(acred->uid, cache->hashbits);
+        nr = hash_long(from_kuid(&init_user_ns, acred->uid), cache->hashbits);
 
         rcu_read_lock();
         hlist_for_each_entry_rcu(entry, pos, &cache->hashtable[nr], cr_hash) {
@@ -519,8 +519,8 @@ rpcauth_bind_root_cred(struct rpc_task *task, int lookupflags)
 {
         struct rpc_auth *auth = task->tk_client->cl_auth;
         struct auth_cred acred = {
-                .uid = 0,
-                .gid = 0,
+                .uid = GLOBAL_ROOT_UID,
+                .gid = GLOBAL_ROOT_GID,
         };
 
         dprintk("RPC: %5u looking up %s cred\n",
diff --git a/net/sunrpc/auth_generic.c b/net/sunrpc/auth_generic.c
index 6ed6f201b022..b6badafc6494 100644
--- a/net/sunrpc/auth_generic.c
+++ b/net/sunrpc/auth_generic.c
@@ -18,8 +18,8 @@
 # define RPCDBG_FACILITY        RPCDBG_AUTH
 #endif
 
-#define RPC_MACHINE_CRED_USERID         ((uid_t)0)
-#define RPC_MACHINE_CRED_GROUPID        ((gid_t)0)
+#define RPC_MACHINE_CRED_USERID         GLOBAL_ROOT_UID
+#define RPC_MACHINE_CRED_GROUPID        GLOBAL_ROOT_GID
 
 struct generic_cred {
         struct rpc_cred gc_base;
@@ -96,7 +96,9 @@ generic_create_cred(struct rpc_auth *auth, struct auth_cred *acred, int flags)
 
         dprintk("RPC:       allocated %s cred %p for uid %d gid %d\n",
                         gcred->acred.machine_cred ? "machine" : "generic",
-                        gcred, acred->uid, acred->gid);
+                        gcred,
+                        from_kuid(&init_user_ns, acred->uid),
+                        from_kgid(&init_user_ns, acred->gid));
         return &gcred->gc_base;
 }
 
@@ -129,8 +131,8 @@ machine_cred_match(struct auth_cred *acred, struct generic_cred *gcred, int flag
 {
         if (!gcred->acred.machine_cred ||
             gcred->acred.principal != acred->principal ||
-            gcred->acred.uid != acred->uid ||
-            gcred->acred.gid != acred->gid)
+            !uid_eq(gcred->acred.uid, acred->uid) ||
+            !gid_eq(gcred->acred.gid, acred->gid))
                 return 0;
         return 1;
 }
@@ -147,8 +149,8 @@ generic_match(struct auth_cred *acred, struct rpc_cred *cred, int flags)
         if (acred->machine_cred)
                 return machine_cred_match(acred, gcred, flags);
 
-        if (gcred->acred.uid != acred->uid ||
-            gcred->acred.gid != acred->gid ||
+        if (!uid_eq(gcred->acred.uid, acred->uid) ||
+            !gid_eq(gcred->acred.gid, acred->gid) ||
             gcred->acred.machine_cred != 0)
                 goto out_nomatch;
 
diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index 911ef008b701..6ea29f4ed6c0 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -255,7 +255,7 @@ err:
 
 struct gss_upcall_msg {
         atomic_t count;
-        uid_t   uid;
+        kuid_t  uid;
         struct rpc_pipe_msg msg;
         struct list_head list;
         struct gss_auth *auth;
@@ -302,11 +302,11 @@ gss_release_msg(struct gss_upcall_msg *gss_msg)
 }
 
 static struct gss_upcall_msg *
-__gss_find_upcall(struct rpc_pipe *pipe, uid_t uid)
+__gss_find_upcall(struct rpc_pipe *pipe, kuid_t uid)
 {
         struct gss_upcall_msg *pos;
         list_for_each_entry(pos, &pipe->in_downcall, list) {
-                if (pos->uid != uid)
+                if (!uid_eq(pos->uid, uid))
                         continue;
                 atomic_inc(&pos->count);
                 dprintk("RPC:       %s found msg %p\n", __func__, pos);
@@ -394,8 +394,11 @@ gss_upcall_callback(struct rpc_task *task)
 
 static void gss_encode_v0_msg(struct gss_upcall_msg *gss_msg)
 {
-        gss_msg->msg.data = &gss_msg->uid;
-        gss_msg->msg.len = sizeof(gss_msg->uid);
+        uid_t uid = from_kuid(&init_user_ns, gss_msg->uid);
+        memcpy(gss_msg->databuf, &uid, sizeof(uid));
+        gss_msg->msg.data = gss_msg->databuf;
+        gss_msg->msg.len = sizeof(uid);
+        BUG_ON(sizeof(uid) > UPCALL_BUF_LEN);
 }
 
 static void gss_encode_v1_msg(struct gss_upcall_msg *gss_msg,
@@ -408,7 +411,7 @@ static void gss_encode_v1_msg(struct gss_upcall_msg *gss_msg,
 
         gss_msg->msg.len = sprintf(gss_msg->databuf, "mech=%s uid=%d ",
                                    mech->gm_name,
-                                   gss_msg->uid);
+                                   from_kuid(&init_user_ns, gss_msg->uid));
         p += gss_msg->msg.len;
         if (clnt->cl_principal) {
                 len = sprintf(p, "target=%s ", clnt->cl_principal);
@@ -444,7 +447,7 @@ static void gss_encode_msg(struct gss_upcall_msg *gss_msg,
 
 static struct gss_upcall_msg *
 gss_alloc_msg(struct gss_auth *gss_auth, struct rpc_clnt *clnt,
-                uid_t uid, const char *service_name)
+                kuid_t uid, const char *service_name)
 {
         struct gss_upcall_msg *gss_msg;
         int vers;
@@ -474,7 +477,7 @@ gss_setup_upcall(struct rpc_clnt *clnt, struct gss_auth *gss_auth, struct rpc_cr
         struct gss_cred *gss_cred = container_of(cred,
                         struct gss_cred, gc_base);
         struct gss_upcall_msg *gss_new, *gss_msg;
-        uid_t uid = cred->cr_uid;
+        kuid_t uid = cred->cr_uid;
 
         gss_new = gss_alloc_msg(gss_auth, clnt, uid, gss_cred->gc_principal);
         if (IS_ERR(gss_new))
@@ -516,7 +519,7 @@ gss_refresh_upcall(struct rpc_task *task)
         int err = 0;
 
         dprintk("RPC: %5u %s for uid %u\n",
-                task->tk_pid, __func__, cred->cr_uid);
+                task->tk_pid, __func__, from_kuid(&init_user_ns, cred->cr_uid));
         gss_msg = gss_setup_upcall(task->tk_client, gss_auth, cred);
         if (PTR_ERR(gss_msg) == -EAGAIN) {
                 /* XXX: warning on the first, under the assumption we
@@ -548,7 +551,8 @@ gss_refresh_upcall(struct rpc_task *task)
         gss_release_msg(gss_msg);
 out:
         dprintk("RPC: %5u %s for uid %u result %d\n",
-                task->tk_pid, __func__, cred->cr_uid, err);
+                task->tk_pid, __func__,
+                from_kuid(&init_user_ns, cred->cr_uid), err);
         return err;
 }
 
@@ -561,7 +565,8 @@ gss_create_upcall(struct gss_auth *gss_auth, struct gss_cred *gss_cred)
         DEFINE_WAIT(wait);
         int err = 0;
 
-        dprintk("RPC:       %s for uid %u\n", __func__, cred->cr_uid);
+        dprintk("RPC:       %s for uid %u\n",
+                __func__, from_kuid(&init_user_ns, cred->cr_uid));
 retry:
         gss_msg = gss_setup_upcall(gss_auth->client, gss_auth, cred);
         if (PTR_ERR(gss_msg) == -EAGAIN) {
@@ -603,7 +608,7 @@ out_intr:
         gss_release_msg(gss_msg);
 out:
         dprintk("RPC:       %s for uid %u result %d\n",
-                __func__, cred->cr_uid, err);
+                __func__, from_kuid(&init_user_ns, cred->cr_uid), err);
         return err;
 }
 
@@ -617,7 +622,8 @@ gss_pipe_downcall(struct file *filp, const char __user *src, size_t mlen)
         struct gss_upcall_msg *gss_msg;
         struct rpc_pipe *pipe = RPC_I(filp->f_dentry->d_inode)->pipe;
         struct gss_cl_ctx *ctx;
-        uid_t uid;
+        uid_t id;
+        kuid_t uid;
         ssize_t err = -EFBIG;
 
         if (mlen > MSG_BUF_MAXSIZE)
@@ -632,12 +638,18 @@ gss_pipe_downcall(struct file *filp, const char __user *src, size_t mlen)
                 goto err;
 
         end = (const void *)((char *)buf + mlen);
-        p = simple_get_bytes(buf, end, &uid, sizeof(uid));
+        p = simple_get_bytes(buf, end, &id, sizeof(id));
         if (IS_ERR(p)) {
                 err = PTR_ERR(p);
                 goto err;
         }
 
+        uid = make_kuid(&init_user_ns, id);
+        if (!uid_valid(uid)) {
+                err = -EINVAL;
+                goto err;
+        }
+
         err = -ENOMEM;
         ctx = gss_alloc_context();
         if (ctx == NULL)
@@ -1058,7 +1070,8 @@ gss_create_cred(struct rpc_auth *auth, struct auth_cred *acred, int flags)
         int err = -ENOMEM;
 
         dprintk("RPC:       %s for uid %d, flavor %d\n",
-                __func__, acred->uid, auth->au_flavor);
+                __func__, from_kuid(&init_user_ns, acred->uid),
+                auth->au_flavor);
 
         if (!(cred = kzalloc(sizeof(*cred), GFP_NOFS)))
                 goto out_err;
@@ -1114,7 +1127,7 @@ out:
         }
         if (gss_cred->gc_principal != NULL)
                 return 0;
-        return rc->cr_uid == acred->uid;
+        return uid_eq(rc->cr_uid, acred->uid);
 }
 
 /*
diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
index 73e957386600..ecd1d58bf611 100644
--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -418,6 +418,7 @@ static int rsc_parse(struct cache_detail *cd,
 {
         /* contexthandle expiry [ uid gid N <n gids> mechname ...mechdata... ] */
         char *buf = mesg;
+        int id;
         int len, rv;
         struct rsc rsci, *rscp = NULL;
         time_t expiry;
@@ -444,7 +445,7 @@ static int rsc_parse(struct cache_detail *cd,
                 goto out;
 
         /* uid, or NEGATIVE */
-        rv = get_int(&mesg, &rsci.cred.cr_uid);
+        rv = get_int(&mesg, &id);
         if (rv == -EINVAL)
                 goto out;
         if (rv == -ENOENT)
@@ -452,8 +453,16 @@ static int rsc_parse(struct cache_detail *cd,
         else {
                 int N, i;
 
+                /* uid */
+                rsci.cred.cr_uid = make_kuid(&init_user_ns, id);
+                if (!uid_valid(rsci.cred.cr_uid))
+                        goto out;
+
                 /* gid */
-                if (get_int(&mesg, &rsci.cred.cr_gid))
+                if (get_int(&mesg, &id))
+                        goto out;
+                rsci.cred.cr_gid = make_kgid(&init_user_ns, id);
+                if (!gid_valid(rsci.cred.cr_gid))
                         goto out;
 
                 /* number of additional gid's */
@@ -467,11 +476,10 @@ static int rsc_parse(struct cache_detail *cd,
                 /* gid's */
                 status = -EINVAL;
                 for (i=0; i<N; i++) {
-                        gid_t gid;
                         kgid_t kgid;
-                        if (get_int(&mesg, &gid))
+                        if (get_int(&mesg, &id))
                                 goto out;
-                        kgid = make_kgid(&init_user_ns, gid);
+                        kgid = make_kgid(&init_user_ns, id);
                         if (!gid_valid(kgid))
                                 goto out;
                         GROUP_AT(rsci.cred.cr_group_info, i) = kgid;
diff --git a/net/sunrpc/auth_unix.c b/net/sunrpc/auth_unix.c
index 52c5abdee211..dc37021fc3e5 100644
--- a/net/sunrpc/auth_unix.c
+++ b/net/sunrpc/auth_unix.c
@@ -18,8 +18,8 @@
 
 struct unx_cred {
         struct rpc_cred         uc_base;
-        gid_t                   uc_gid;
-        gid_t                   uc_gids[NFS_NGROUPS];
+        kgid_t                  uc_gid;
+        kgid_t                  uc_gids[NFS_NGROUPS];
 };
 #define uc_uid                  uc_base.cr_uid
 
@@ -65,7 +65,8 @@ unx_create_cred(struct rpc_auth *auth, struct auth_cred *acred, int flags)
         unsigned int i;
 
         dprintk("RPC:       allocating UNIX cred for uid %d gid %d\n",
-                        acred->uid, acred->gid);
+                        from_kuid(&init_user_ns, acred->uid),
+                        from_kgid(&init_user_ns, acred->gid));
 
         if (!(cred = kmalloc(sizeof(*cred), GFP_NOFS)))
                 return ERR_PTR(-ENOMEM);
@@ -79,13 +80,10 @@ unx_create_cred(struct rpc_auth *auth, struct auth_cred *acred, int flags)
                 groups = NFS_NGROUPS;
 
         cred->uc_gid = acred->gid;
-        for (i = 0; i < groups; i++) {
-                gid_t gid;
-                gid = from_kgid(&init_user_ns, GROUP_AT(acred->group_info, i));
-                cred->uc_gids[i] = gid;
-        }
+        for (i = 0; i < groups; i++)
+                cred->uc_gids[i] = GROUP_AT(acred->group_info, i);
         if (i < NFS_NGROUPS)
-                cred->uc_gids[i] = NOGROUP;
+                cred->uc_gids[i] = INVALID_GID;
 
         return &cred->uc_base;
 }
@@ -123,21 +121,17 @@ unx_match(struct auth_cred *acred, struct rpc_cred *rcred, int flags)
         unsigned int i;
 
 
-        if (cred->uc_uid != acred->uid || cred->uc_gid != acred->gid)
+        if (!uid_eq(cred->uc_uid, acred->uid) || !gid_eq(cred->uc_gid, acred->gid))
                 return 0;
 
         if (acred->group_info != NULL)
                 groups = acred->group_info->ngroups;
         if (groups > NFS_NGROUPS)
                 groups = NFS_NGROUPS;
-        for (i = 0; i < groups ; i++) {
-                gid_t gid;
-                gid = from_kgid(&init_user_ns, GROUP_AT(acred->group_info, i));
-                if (cred->uc_gids[i] != gid)
+        for (i = 0; i < groups ; i++)
+                if (!gid_eq(cred->uc_gids[i], GROUP_AT(acred->group_info, i)))
                         return 0;
-        }
-        if (groups < NFS_NGROUPS &&
-            cred->uc_gids[groups] != NOGROUP)
+        if (groups < NFS_NGROUPS && gid_valid(cred->uc_gids[groups]))
                 return 0;
         return 1;
 }
@@ -163,11 +157,11 @@ unx_marshal(struct rpc_task *task, __be32 *p)
          */
         p = xdr_encode_array(p, clnt->cl_nodename, clnt->cl_nodelen);
 
-        *p++ = htonl((u32) cred->uc_uid);
-        *p++ = htonl((u32) cred->uc_gid);
+        *p++ = htonl((u32) from_kuid(&init_user_ns, cred->uc_uid));
+        *p++ = htonl((u32) from_kgid(&init_user_ns, cred->uc_gid));
         hold = p++;
-        for (i = 0; i < 16 && cred->uc_gids[i] != (gid_t) NOGROUP; i++)
-                *p++ = htonl((u32) cred->uc_gids[i]);
+        for (i = 0; i < 16 && gid_valid(cred->uc_gids[i]); i++)
+                *p++ = htonl((u32) from_kgid(&init_user_ns, cred->uc_gids[i]));
         *hold = htonl(p - hold - 1);            /* gid array length */
         *base = htonl((p - base - 1) << 2);     /* cred length */
 
diff --git a/net/sunrpc/svcauth_unix.c b/net/sunrpc/svcauth_unix.c
index 4d0129203733..a1852e19ed0c 100644
--- a/net/sunrpc/svcauth_unix.c
+++ b/net/sunrpc/svcauth_unix.c
@@ -415,10 +415,15 @@ svcauth_unix_info_release(struct svc_xprt *xpt)
 
 struct unix_gid {
         struct cache_head       h;
-        uid_t                   uid;
+        kuid_t                  uid;
         struct group_info       *gi;
 };
 
+static int unix_gid_hash(kuid_t uid)
+{
+        return hash_long(from_kuid(&init_user_ns, uid), GID_HASHBITS);
+}
+
 static void unix_gid_put(struct kref *kref)
 {
         struct cache_head *item = container_of(kref, struct cache_head, ref);
@@ -433,7 +438,7 @@ static int unix_gid_match(struct cache_head *corig, struct cache_head *cnew)
 {
         struct unix_gid *orig = container_of(corig, struct unix_gid, h);
         struct unix_gid *new = container_of(cnew, struct unix_gid, h);
-        return orig->uid == new->uid;
+        return uid_eq(orig->uid, new->uid);
 }
 static void unix_gid_init(struct cache_head *cnew, struct cache_head *citem)
 {
@@ -465,7 +470,7 @@ static void unix_gid_request(struct cache_detail *cd,
         char tuid[20];
         struct unix_gid *ug = container_of(h, struct unix_gid, h);
 
-        snprintf(tuid, 20, "%u", ug->uid);
+        snprintf(tuid, 20, "%u", from_kuid(&init_user_ns, ug->uid));
         qword_add(bpp, blen, tuid);
         (*bpp)[-1] = '\n';
 }
@@ -475,13 +480,14 @@ static int unix_gid_upcall(struct cache_detail *cd, struct cache_head *h)
         return sunrpc_cache_pipe_upcall(cd, h, unix_gid_request);
 }
 
-static struct unix_gid *unix_gid_lookup(struct cache_detail *cd, uid_t uid);
+static struct unix_gid *unix_gid_lookup(struct cache_detail *cd, kuid_t uid);
 
 static int unix_gid_parse(struct cache_detail *cd,
                         char *mesg, int mlen)
 {
         /* uid expiry Ngid gid0 gid1 ... gidN-1 */
-        int uid;
+        int id;
+        kuid_t uid;
         int gids;
         int rv;
         int i;
@@ -493,9 +499,12 @@ static int unix_gid_parse(struct cache_detail *cd,
                 return -EINVAL;
         mesg[mlen-1] = 0;
 
-        rv = get_int(&mesg, &uid);
+        rv = get_int(&mesg, &id);
         if (rv)
                 return -EINVAL;
+        uid = make_kuid(&init_user_ns, id);
+        if (!uid_valid(uid))
+                return -EINVAL;
         ug.uid = uid;
 
         expiry = get_expiry(&mesg);
@@ -530,7 +539,7 @@ static int unix_gid_parse(struct cache_detail *cd,
                 ug.h.expiry_time = expiry;
                 ch = sunrpc_cache_update(cd,
                                          &ug.h, &ugp->h,
-                                         hash_long(uid, GID_HASHBITS));
+                                         unix_gid_hash(uid));
                 if (!ch)
                         err = -ENOMEM;
                 else {
@@ -549,7 +558,7 @@ static int unix_gid_show(struct seq_file *m,
                          struct cache_detail *cd,
                          struct cache_head *h)
 {
-        struct user_namespace *user_ns = current_user_ns();
+        struct user_namespace *user_ns = &init_user_ns;
         struct unix_gid *ug;
         int i;
         int glen;
@@ -565,7 +574,7 @@ static int unix_gid_show(struct seq_file *m,
         else
                 glen = 0;
 
-        seq_printf(m, "%u %d:", ug->uid, glen);
+        seq_printf(m, "%u %d:", from_kuid_munged(user_ns, ug->uid), glen);
         for (i = 0; i < glen; i++)
                 seq_printf(m, " %d", from_kgid_munged(user_ns, GROUP_AT(ug->gi, i)));
         seq_printf(m, "\n");
@@ -615,20 +624,20 @@ void unix_gid_cache_destroy(struct net *net)
         cache_destroy_net(cd, net);
 }
 
-static struct unix_gid *unix_gid_lookup(struct cache_detail *cd, uid_t uid)
+static struct unix_gid *unix_gid_lookup(struct cache_detail *cd, kuid_t uid)
 {
         struct unix_gid ug;
         struct cache_head *ch;
 
         ug.uid = uid;
-        ch = sunrpc_cache_lookup(cd, &ug.h, hash_long(uid, GID_HASHBITS));
+        ch = sunrpc_cache_lookup(cd, &ug.h, unix_gid_hash(uid));
         if (ch)
                 return container_of(ch, struct unix_gid, h);
         else
                 return NULL;
 }
 
-static struct group_info *unix_gid_find(uid_t uid, struct svc_rqst *rqstp)
+static struct group_info *unix_gid_find(kuid_t uid, struct svc_rqst *rqstp)
 {
         struct unix_gid *ug;
         struct group_info *gi;
@@ -750,8 +759,8 @@ svcauth_null_accept(struct svc_rqst *rqstp, __be32 *authp)
         }
 
         /* Signal that mapping to nobody uid/gid is required */
-        cred->cr_uid = (uid_t) -1;
-        cred->cr_gid = (gid_t) -1;
+        cred->cr_uid = INVALID_UID;
+        cred->cr_gid = INVALID_GID;
         cred->cr_group_info = groups_alloc(0);
         if (cred->cr_group_info == NULL)
                 return SVC_CLOSE; /* kmalloc failure - client must retry */
@@ -812,8 +821,10 @@ svcauth_unix_accept(struct svc_rqst *rqstp, __be32 *authp)
         argv->iov_base = (void*)((__be32*)argv->iov_base + slen);       /* skip machname */
         argv->iov_len -= slen*4;
 
-        cred->cr_uid = svc_getnl(argv);         /* uid */
-        cred->cr_gid = svc_getnl(argv);         /* gid */
+        cred->cr_uid = make_kuid(&init_user_ns, svc_getnl(argv)); /* uid */
+        cred->cr_gid = make_kgid(&init_user_ns, svc_getnl(argv)); /* gid */
+        if (!uid_valid(cred->cr_uid) || !gid_valid(cred->cr_gid))
+                goto badcred;
         slen = svc_getnl(argv);                 /* gids length */
         if (slen > 16 || (len -= (slen + 2)*4) < 0)
                 goto badcred;