1 files changed, 5 insertions, 7 deletions

diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
index cd4c5f1d554a..6fb73ff26183 100644
--- a/net/sunrpc/xprtrdma/verbs.c
+++ b/net/sunrpc/xprtrdma/verbs.c
@@ -871,7 +871,7 @@ rpcrdma_buffer_create(struct rpcrdma_xprt *r_xprt)
         }
 
         INIT_LIST_HEAD(&buf->rb_recv_bufs);
-        for (i = 0; i < buf->rb_max_requests + 2; i++) {
+        for (i = 0; i < buf->rb_max_requests; i++) {
                 struct rpcrdma_rep *rep;
 
                 rep = rpcrdma_create_rep(r_xprt);
@@ -989,8 +989,6 @@ rpcrdma_put_mw(struct rpcrdma_xprt *r_xprt, struct rpcrdma_mw *mw)
 
 /*
  * Get a set of request/reply buffers.
- *
- * Reply buffer (if available) is attached to send buffer upon return.
  */
 struct rpcrdma_req *
 rpcrdma_buffer_get(struct rpcrdma_buffer *buffers)
@@ -1009,13 +1007,13 @@ rpcrdma_buffer_get(struct rpcrdma_buffer *buffers)
 
 out_reqbuf:
         spin_unlock(&buffers->rb_lock);
-        pr_warn("RPC:       %s: out of request buffers\n", __func__);
+        pr_warn("rpcrdma: out of request buffers (%p)\n", buffers);
         return NULL;
 out_repbuf:
+        list_add(&req->rl_free, &buffers->rb_send_bufs);
         spin_unlock(&buffers->rb_lock);
-        pr_warn("RPC:       %s: out of reply buffers\n", __func__);
-        req->rl_reply = NULL;
-        return req;
+        pr_warn("rpcrdma: out of reply buffers (%p)\n", buffers);
+        return NULL;
 }
 
 /*