2 files changed, 14 insertions, 2 deletions

diff --git a/ipc/mqueue.c b/ipc/mqueue.c
index ba44164ea1f9..6f93bda7e408 100644
--- a/ipc/mqueue.c
+++ b/ipc/mqueue.c
@@ -430,7 +430,8 @@ static void mqueue_evict_inode(struct inode *inode)
         struct user_struct *user;
         unsigned long mq_bytes, mq_treesize;
         struct ipc_namespace *ipc_ns;
-        struct msg_msg *msg;
+        struct msg_msg *msg, *nmsg;
+        LIST_HEAD(tmp_msg);
 
         clear_inode(inode);
 
@@ -441,10 +442,15 @@ static void mqueue_evict_inode(struct inode *inode)
         info = MQUEUE_I(inode);
         spin_lock(&info->lock);
         while ((msg = msg_get(info)) != NULL)
-                free_msg(msg);
+                list_add_tail(&msg->m_list, &tmp_msg);
         kfree(info->node_cache);
         spin_unlock(&info->lock);
 
+        list_for_each_entry_safe(msg, nmsg, &tmp_msg, m_list) {
+                list_del(&msg->m_list);
+                free_msg(msg);
+        }
+
         /* Total amount of bytes accounted for the mqueue */
         mq_treesize = info->attr.mq_maxmsg * sizeof(struct msg_msg) +
                 min_t(unsigned int, info->attr.mq_maxmsg, MQ_PRIO_MAX) *
diff --git a/ipc/msgutil.c b/ipc/msgutil.c
index 84598025a6ad..e65593742e2b 100644
--- a/ipc/msgutil.c
+++ b/ipc/msgutil.c
@@ -18,6 +18,7 @@
 #include <linux/utsname.h>
 #include <linux/proc_ns.h>
 #include <linux/uaccess.h>
+#include <linux/sched.h>
 
 #include "util.h"
 
@@ -64,6 +65,9 @@ static struct msg_msg *alloc_msg(size_t len)
         pseg = &msg->next;
         while (len > 0) {
                 struct msg_msgseg *seg;
+
+                cond_resched();
+
                 alen = min(len, DATALEN_SEG);
                 seg = kmalloc(sizeof(*seg) + alen, GFP_KERNEL_ACCOUNT);
                 if (seg == NULL)
@@ -176,6 +180,8 @@ void free_msg(struct msg_msg *msg)
         kfree(msg);
         while (seg != NULL) {
                 struct msg_msgseg *tmp = seg->next;
+
+                cond_resched();
                 kfree(seg);
                 seg = tmp;
         }