1 files changed, 2 insertions, 0 deletions

diff --git a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
index 6b16d8cd5682..06ab4841537b 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
@@ -306,6 +306,8 @@ static int rdma_read_xdr(struct svcxprt_rdma *xprt,
         ch_sge_ary = (struct chunk_sge *)tmp_ch_ctxt->sge;
 
         svc_rdma_rcl_chunk_counts(ch, &ch_count, &byte_count);
+        if (ch_count > RPCSVC_MAXPAGES)
+                return -EINVAL;
         sge_count = rdma_rcl_to_sge(xprt, rqstp, hdr_ctxt, rmsgp,
                                     sge, ch_sge_ary,
                                     ch_count, byte_count);