2 files changed, 19 insertions, 15 deletions

diff --git a/net/sunrpc/xprtrdma/rpc_rdma.c b/net/sunrpc/xprtrdma/rpc_rdma.c
index 14106d26bb95..e5e28d1946a4 100644
--- a/net/sunrpc/xprtrdma/rpc_rdma.c
+++ b/net/sunrpc/xprtrdma/rpc_rdma.c
@@ -310,6 +310,19 @@ rpcrdma_inline_pullup(struct rpc_rqst *rqst, int pad)
                 __func__, pad, destp, rqst->rq_slen, curlen);
 
         copy_len = rqst->rq_snd_buf.page_len;
+
+        if (rqst->rq_snd_buf.tail[0].iov_len) {
+                curlen = rqst->rq_snd_buf.tail[0].iov_len;
+                if (destp + copy_len != rqst->rq_snd_buf.tail[0].iov_base) {
+                        memmove(destp + copy_len,
+                                rqst->rq_snd_buf.tail[0].iov_base, curlen);
+                        r_xprt->rx_stats.pullup_copy_count += curlen;
+                }
+                dprintk("RPC:       %s: tail destp 0x%p len %d\n",
+                        __func__, destp + copy_len, curlen);
+                rqst->rq_svec[0].iov_len += curlen;
+        }
+
         r_xprt->rx_stats.pullup_copy_count += copy_len;
         npages = PAGE_ALIGN(rqst->rq_snd_buf.page_base+copy_len) >> PAGE_SHIFT;
         for (i = 0; copy_len && i < npages; i++) {
@@ -332,17 +345,6 @@ rpcrdma_inline_pullup(struct rpc_rqst *rqst, int pad)
                 destp += curlen;
                 copy_len -= curlen;
         }
-        if (rqst->rq_snd_buf.tail[0].iov_len) {
-                curlen = rqst->rq_snd_buf.tail[0].iov_len;
-                if (destp != rqst->rq_snd_buf.tail[0].iov_base) {
-                        memcpy(destp,
-                                rqst->rq_snd_buf.tail[0].iov_base, curlen);
-                        r_xprt->rx_stats.pullup_copy_count += curlen;
-                }
-                dprintk("RPC:       %s: tail destp 0x%p len %d curlen %d\n",
-                        __func__, destp, copy_len, curlen);
-                rqst->rq_svec[0].iov_len += curlen;
-        }
         /* header now contains entire send message */
         return pad;
 }
@@ -656,7 +658,7 @@ rpcrdma_inline_fixup(struct rpc_rqst *rqst, char *srcp, int copy_len, int pad)
                 if (curlen > rqst->rq_rcv_buf.tail[0].iov_len)
                         curlen = rqst->rq_rcv_buf.tail[0].iov_len;
                 if (rqst->rq_rcv_buf.tail[0].iov_base != srcp)
-                        memcpy(rqst->rq_rcv_buf.tail[0].iov_base, srcp, curlen);
+                        memmove(rqst->rq_rcv_buf.tail[0].iov_base, srcp, curlen);
                 dprintk("RPC:       %s: tail srcp 0x%p len %d curlen %d\n",
                         __func__, srcp, copy_len, curlen);
                 rqst->rq_rcv_buf.tail[0].iov_len = curlen;
diff --git a/net/sunrpc/xprtrdma/svc_rdma_sendto.c b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
index a3334e3b73cc..6c26a675435a 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_sendto.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
@@ -191,7 +191,6 @@ static int map_xdr(struct svcxprt_rdma *xprt,
                    struct xdr_buf *xdr,
                    struct svc_rdma_req_map *vec)
 {
-        int sge_max = (xdr->len+PAGE_SIZE-1) / PAGE_SIZE + 3;
         int sge_no;
         u32 sge_bytes;
         u32 page_bytes;
@@ -235,7 +234,11 @@ static int map_xdr(struct svcxprt_rdma *xprt,
                 sge_no++;
         }
 
-        BUG_ON(sge_no > sge_max);
+        dprintk("svcrdma: map_xdr: sge_no %d page_no %d "
+                "page_base %u page_len %u head_len %zu tail_len %zu\n",
+                sge_no, page_no, xdr->page_base, xdr->page_len,
+                xdr->head[0].iov_len, xdr->tail[0].iov_len);
+
         vec->count = sge_no;
         return 0;
 }
@@ -579,7 +582,6 @@ static int send_reply(struct svcxprt_rdma *rdma,
                         ctxt->sge[page_no+1].length = 0;
         }
         BUG_ON(sge_no > rdma->sc_max_sge);
-        BUG_ON(sge_no > ctxt->count);
         memset(&send_wr, 0, sizeof send_wr);
         ctxt->wr_op = IB_WR_SEND;
         send_wr.wr_id = (unsigned long)ctxt;