diff --git a/net/rds/rdma.c b/net/rds/rdma.c
index cf0dfa7..3481931 100644
--- a/net/rds/rdma.c
+++ b/net/rds/rdma.c
@@ -498,6 +498,15 @@
 
 		max_pages = max(nr, max_pages);
 		nr_pages += nr;
+
+		/*
+		 * nr for one entry is limited to (UINT_MAX>>PAGE_SHIFT)+1,
+		 * so nr_pages cannot overflow without first going negative.
+		 */
+		if ((int)nr_pages < 0) {
+			ret = -EINVAL;
+			goto out;
+		}
 	}
 
 	pages = kcalloc(max_pages, sizeof(struct page *), GFP_KERNEL);