The loop which initializes the user memory region from an array of
pages was using the wrong limit for the array.  This worked OK when
dma_map_sg() returned the same number as the number of pages.  This
patch fixes the problem.
Signed-off-by: Ralph Campbell <ralph.campbell@qlogic.com>
Signed-off-by: Bryan O'Sullivan <bryan.osullivan@qlogic.com>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
        m = 0;
        n = 0;
        list_for_each_entry(chunk, ®ion->chunk_list, list) {
-               for (i = 0; i < chunk->nmap; i++) {
-                       mr->mr.map[m]->segs[n].vaddr =
-                               page_address(chunk->page_list[i].page);
+               for (i = 0; i < chunk->nents; i++) {
+                       void *vaddr;
+
+                       vaddr = page_address(chunk->page_list[i].page);
+                       if (!vaddr) {
+                               ret = ERR_PTR(-EINVAL);
+                               goto bail;
+                       }
+                       mr->mr.map[m]->segs[n].vaddr = vaddr;
                        mr->mr.map[m]->segs[n].length = region->page_size;
                        n++;
                        if (n == IPATH_SEGSZ) {