1 files changed, 9 insertions, 2 deletions

diff --git a/ipc/mqueue.c b/ipc/mqueue.c
index 6e10a55a78c5..f8eba5e46c5a 100644
--- a/ipc/mqueue.c
+++ b/ipc/mqueue.c
@@ -24,6 +24,7 @@
 #include <linux/mqueue.h>
 #include <linux/msg.h>
 #include <linux/skbuff.h>
+#include <linux/vmalloc.h>
 #include <linux/netlink.h>
 #include <linux/syscalls.h>
 #include <linux/audit.h>
@@ -152,7 +153,10 @@ static struct inode *mqueue_get_inode(struct super_block *sb,
                         info->attr.mq_msgsize = attr->mq_msgsize;
                 }
                 mq_msg_tblsz = info->attr.mq_maxmsg * sizeof(struct msg_msg *);
-                info->messages = kmalloc(mq_msg_tblsz, GFP_KERNEL);
+                if (mq_msg_tblsz > KMALLOC_MAX_SIZE)
+                        info->messages = vmalloc(mq_msg_tblsz);
+                else
+                        info->messages = kmalloc(mq_msg_tblsz, GFP_KERNEL);
                 if (!info->messages)
                         goto out_inode;
 
@@ -262,7 +266,10 @@ static void mqueue_evict_inode(struct inode *inode)
         spin_lock(&info->lock);
         for (i = 0; i < info->attr.mq_curmsgs; i++)
                 free_msg(info->messages[i]);
-        kfree(info->messages);
+        if (info->attr.mq_maxmsg * sizeof(struct msg_msg *) > KMALLOC_MAX_SIZE)
+                vfree(info->messages);
+        else
+                kfree(info->messages);
         spin_unlock(&info->lock);
 
         /* Total amount of bytes accounted for the mqueue */