3 files changed, 10 insertions, 5 deletions
diff --git a/src/net/infiniband.c b/src/net/infiniband.c
index 1c19fada4..4784f4044 100644
--- a/src/net/infiniband.c
+++ b/src/net/infiniband.c
@@ -345,6 +345,13 @@ int ib_post_recv ( struct ib_device *ibdev, struct ib_queue_pair *qp,
 		   struct io_buffer *iobuf ) {
 	int rc;
 
+	/* Check packet length */
+	if ( iob_tailroom ( iobuf ) < IB_MAX_PAYLOAD_SIZE ) {
+		DBGC ( ibdev, "IBDEV %p QPN %#lx wrong RX buffer size (%zd)\n",
+		       ibdev, qp->qpn, iob_tailroom ( iobuf ) );
+		return -EINVAL;
+	}
+
 	/* Check queue fill level */
 	if ( qp->recv.fill >= qp->recv.num_wqes ) {
 		DBGC ( ibdev, "IBDEV %p QPN %#lx receive queue full\n",
diff --git a/src/net/infiniband/ib_qset.c b/src/net/infiniband/ib_qset.c
index 1972b7abf..799489f94 100644
--- a/src/net/infiniband/ib_qset.c
+++ b/src/net/infiniband/ib_qset.c
@@ -40,7 +40,6 @@ FILE_LICENCE ( GPL2_OR_LATER );
  * @v cq_op		Completion queue operations
  * @v num_send_wqes	Number of send work queue entries
  * @v num_recv_wqes	Number of receive work queue entries
- * @v recv_pkt_len	Receive packet length
  * @v qkey		Queue key
  * @ret rc		Return status code
  */
@@ -48,7 +47,7 @@ int ib_create_qset ( struct ib_device *ibdev, struct ib_queue_set *qset,
 		     unsigned int num_cqes,
 		     struct ib_completion_queue_operations *cq_op,
 		     unsigned int num_send_wqes, unsigned int num_recv_wqes,
-		     size_t recv_pkt_len, unsigned long qkey ) {
+		     unsigned long qkey ) {
 	int rc;
 
 	/* Sanity check */
@@ -57,7 +56,6 @@ int ib_create_qset ( struct ib_device *ibdev, struct ib_queue_set *qset,
 
 	/* Store queue parameters */
 	qset->recv_max_fill = num_recv_wqes;
-	qset->recv_pkt_len = recv_pkt_len;
 
 	/* Allocate completion queue */
 	qset->cq = ib_create_cq ( ibdev, num_cqes, cq_op );
@@ -99,7 +97,7 @@ void ib_qset_refill_recv ( struct ib_device *ibdev,
 	while ( qset->qp->recv.fill < qset->recv_max_fill ) {
 
 		/* Allocate I/O buffer */
-		iobuf = alloc_iob ( qset->recv_pkt_len );
+		iobuf = alloc_iob ( IB_MAX_PAYLOAD_SIZE );
 		if ( ! iobuf ) {
 			/* Non-fatal; we will refill on next attempt */
 			return;
diff --git a/src/net/infiniband/ib_sma.c b/src/net/infiniband/ib_sma.c
index cfc881c5c..b83d20ea1 100644
--- a/src/net/infiniband/ib_sma.c
+++ b/src/net/infiniband/ib_sma.c
@@ -361,7 +361,7 @@ static void ib_sma_refill_recv ( struct ib_sma *sma ) {
 	while ( sma->qp->recv.fill < IB_SMA_NUM_RECV_WQES ) {
 
 		/* Allocate I/O buffer */
-		iobuf = alloc_iob ( IB_SMA_PAYLOAD_LEN );
+		iobuf = alloc_iob ( IB_MAX_PAYLOAD_SIZE );
 		if ( ! iobuf ) {
 			/* Non-fatal; we will refill on next attempt */
 			return;