diff --git a/[refs] b/[refs]
index 724b8a1a7e98..6e5318735828 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 008fdbc57164b0ac237ad6ee2766944f02ac9c28
+refs/heads/master: a6f911c04e20b98feb4b33d3aba2976851977d6a
diff --git a/trunk/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c b/trunk/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
index 6b16d8cd5682..06ab4841537b 100644
--- a/trunk/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
+++ b/trunk/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
@@ -306,6 +306,8 @@ static int rdma_read_xdr(struct svcxprt_rdma *xprt,
 	ch_sge_ary = (struct chunk_sge *)tmp_ch_ctxt->sge;
 
 	svc_rdma_rcl_chunk_counts(ch, &ch_count, &byte_count);
+	if (ch_count > RPCSVC_MAXPAGES)
+		return -EINVAL;
 	sge_count = rdma_rcl_to_sge(xprt, rqstp, hdr_ctxt, rmsgp,
 				    sge, ch_sge_ary,
 				    ch_count, byte_count);