1 files changed, 15 insertions, 0 deletions

diff --git a/drivers/infiniband/hw/ipath/ipath_cq.c b/drivers/infiniband/hw/ipath/ipath_cq.c
index 392eeb394637..3efee341c9bc 100644
--- a/drivers/infiniband/hw/ipath/ipath_cq.c
+++ b/drivers/infiniband/hw/ipath/ipath_cq.c
@@ -158,10 +158,21 @@ struct ib_cq *ipath_create_cq(struct ib_device *ibdev, int entries,
                               struct ib_ucontext *context,
                               struct ib_udata *udata)
 {
+        struct ipath_ibdev *dev = to_idev(ibdev);
         struct ipath_cq *cq;
         struct ib_wc *wc;
         struct ib_cq *ret;
 
+        if (entries > ib_ipath_max_cqes) {
+                ret = ERR_PTR(-EINVAL);
+                goto bail;
+        }
+
+        if (dev->n_cqs_allocated == ib_ipath_max_cqs) {
+                ret = ERR_PTR(-ENOMEM);
+                goto bail;
+        }
+
         /*
          * Need to use vmalloc() if we want to support large #s of
          * entries.
@@ -197,6 +208,8 @@ struct ib_cq *ipath_create_cq(struct ib_device *ibdev, int entries,
 
         ret = &cq->ibcq;
 
+        dev->n_cqs_allocated++;
+
 bail:
         return ret;
 }
@@ -211,9 +224,11 @@ bail:
  */
 int ipath_destroy_cq(struct ib_cq *ibcq)
 {
+        struct ipath_ibdev *dev = to_idev(ibcq->device);
         struct ipath_cq *cq = to_icq(ibcq);
 
         tasklet_kill(&cq->comptask);
+        dev->n_cqs_allocated--;
         vfree(cq->queue);
         kfree(cq);