3 files changed, 10 insertions, 2 deletions

diff --git a/drivers/infiniband/hw/ipath/ipath_ruc.c b/drivers/infiniband/hw/ipath/ipath_ruc.c
index 837118676cc7..1b0e62b761bb 100644
--- a/drivers/infiniband/hw/ipath/ipath_ruc.c
+++ b/drivers/infiniband/hw/ipath/ipath_ruc.c
@@ -396,6 +396,8 @@ again:
 
                 if (len > sge->length)
                         len = sge->length;
+                if (len > sge->sge_length)
+                        len = sge->sge_length;
                 BUG_ON(len == 0);
                 ipath_copy_sge(&qp->r_sge, sge->vaddr, len);
                 sge->vaddr += len;
diff --git a/drivers/infiniband/hw/ipath/ipath_ud.c b/drivers/infiniband/hw/ipath/ipath_ud.c
index a518f7c8fa83..0b5a6ac1bb83 100644
--- a/drivers/infiniband/hw/ipath/ipath_ud.c
+++ b/drivers/infiniband/hw/ipath/ipath_ud.c
@@ -231,6 +231,8 @@ static void ipath_ud_loopback(struct ipath_qp *sqp,
 
                 if (len > length)
                         len = length;
+                if (len > sge->sge_length)
+                        len = sge->sge_length;
                 BUG_ON(len == 0);
                 ipath_copy_sge(&rsge, sge->vaddr, len);
                 sge->vaddr += len;
diff --git a/drivers/infiniband/hw/ipath/ipath_verbs.c b/drivers/infiniband/hw/ipath/ipath_verbs.c
index cd79a8ca5104..35241b76d766 100644
--- a/drivers/infiniband/hw/ipath/ipath_verbs.c
+++ b/drivers/infiniband/hw/ipath/ipath_verbs.c
@@ -164,9 +164,11 @@ void ipath_copy_sge(struct ipath_sge_state *ss, void *data, u32 length)
         while (length) {
                 u32 len = sge->length;
 
-                BUG_ON(len == 0);
                 if (len > length)
                         len = length;
+                if (len > sge->sge_length)
+                        len = sge->sge_length;
+                BUG_ON(len == 0);
                 memcpy(sge->vaddr, data, len);
                 sge->vaddr += len;
                 sge->length -= len;
@@ -202,9 +204,11 @@ void ipath_skip_sge(struct ipath_sge_state *ss, u32 length)
         while (length) {
                 u32 len = sge->length;
 
-                BUG_ON(len == 0);
                 if (len > length)
                         len = length;
+                if (len > sge->sge_length)
+                        len = sge->sge_length;
+                BUG_ON(len == 0);
                 sge->vaddr += len;
                 sge->length -= len;
                 sge->sge_length -= len;