1 files changed, 8 insertions, 3 deletions

diff --git a/ipc/mqueue.c b/ipc/mqueue.c
index 3c72a05dc326..076399ce363a 100644
--- a/ipc/mqueue.c
+++ b/ipc/mqueue.c
@@ -676,6 +676,9 @@ static void remove_notification(struct mqueue_inode_info *info)
 
 static int mq_attr_ok(struct ipc_namespace *ipc_ns, struct mq_attr *attr)
 {
+        int mq_treesize;
+        unsigned long total_size;
+
         if (attr->mq_maxmsg <= 0 || attr->mq_msgsize <= 0)
                 return 0;
         if (capable(CAP_SYS_RESOURCE)) {
@@ -690,9 +693,11 @@ static int mq_attr_ok(struct ipc_namespace *ipc_ns, struct mq_attr *attr)
         /* check for overflow */
         if (attr->mq_msgsize > ULONG_MAX/attr->mq_maxmsg)
                 return 0;
-        if ((unsigned long)(attr->mq_maxmsg * (attr->mq_msgsize
-            + sizeof (struct msg_msg *))) <
-            (unsigned long)(attr->mq_maxmsg * attr->mq_msgsize))
+        mq_treesize = attr->mq_maxmsg * sizeof(struct msg_msg) +
+                min_t(unsigned int, attr->mq_maxmsg, MQ_PRIO_MAX) *
+                sizeof(struct posix_msg_tree_node);
+        total_size = attr->mq_maxmsg * attr->mq_msgsize;
+        if (total_size + mq_treesize < total_size)
                 return 0;
         return 1;
 }