3 files changed, 24 insertions, 0 deletions

diff --git a/drivers/infiniband/hw/ipath/ipath_mr.c b/drivers/infiniband/hw/ipath/ipath_mr.c
index 30936769ab3a..4ac31a5da330 100644
--- a/drivers/infiniband/hw/ipath/ipath_mr.c
+++ b/drivers/infiniband/hw/ipath/ipath_mr.c
@@ -170,6 +170,11 @@ struct ib_mr *ipath_reg_user_mr(struct ib_pd *pd, struct ib_umem *region,
         int n, m, i;
         struct ib_mr *ret;
 
+        if (region->length == 0) {
+                ret = ERR_PTR(-EINVAL);
+                goto bail;
+        }
+
         n = 0;
         list_for_each_entry(chunk, &region->chunk_list, list)
                 n += chunk->nents;
diff --git a/drivers/infiniband/hw/ipath/ipath_qp.c b/drivers/infiniband/hw/ipath/ipath_qp.c
index 47271be65b0f..e6fc4c02823f 100644
--- a/drivers/infiniband/hw/ipath/ipath_qp.c
+++ b/drivers/infiniband/hw/ipath/ipath_qp.c
@@ -667,6 +667,14 @@ struct ib_qp *ipath_create_qp(struct ib_pd *ibpd,
                 goto bail;
         }
 
+        if (init_attr->cap.max_send_sge +
+            init_attr->cap.max_recv_sge +
+            init_attr->cap.max_send_wr +
+            init_attr->cap.max_recv_wr == 0) {
+                ret = ERR_PTR(-EINVAL);
+                goto bail;
+        }
+
         switch (init_attr->qp_type) {
         case IB_QPT_UC:
         case IB_QPT_RC:
diff --git a/drivers/infiniband/hw/ipath/ipath_verbs.c b/drivers/infiniband/hw/ipath/ipath_verbs.c
index 6af5402fe447..18375e831744 100644
--- a/drivers/infiniband/hw/ipath/ipath_verbs.c
+++ b/drivers/infiniband/hw/ipath/ipath_verbs.c
@@ -792,6 +792,17 @@ static struct ib_ah *ipath_create_ah(struct ib_pd *pd,
                 goto bail;
         }
 
+        if (ah_attr->dlid == 0) {
+                ret = ERR_PTR(-EINVAL);
+                goto bail;
+        }
+
+        if (ah_attr->port_num != 1 ||
+            ah_attr->port_num > pd->device->phys_port_cnt) {
+                ret = ERR_PTR(-EINVAL);
+                goto bail;
+        }
+
         ah = kmalloc(sizeof *ah, GFP_ATOMIC);
         if (!ah) {
                 ret = ERR_PTR(-ENOMEM);