We have only 2 inline sg entries and we allow 4 sg entries for the send
wr sge. Larger sgls entries will be chained. However when we build
in-capsule send wr sge, we iterate without taking into account that the
sgl may be chained and still fit in-capsule (which can happen if the sgl
is bigger than 2, but lower-equal to 4).

Fix in-capsule data mapping to correctly iterate chained sgls.

Reported-by: Walker, Benjamin <redacted>
Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
---
Changes from v1:
- fix silly compilation error

  drivers/nvme/host/rdma.c | 5 +++--
  1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
index 8d107b201f16..f61bf39c39a0 100644
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c

@@ -1320,16 +1320,17 @@ static int nvme_rdma_map_sg_inline(struct nvme_rdma_queue *queue,
  		int count)
  {
  	struct nvme_sgl_desc *sg = &c->common.dptr.sgl;
-	struct scatterlist *sgl = req->data_sgl.sg_table.sgl;
  	struct ib_sge *sge = &req->sge[1];
+	struct scatterlist *sgl;
  	u32 len = 0;
  	int i;
  
-	for (i = 0; i < count; i++, sgl++, sge++) {
+	for_each_sg(req->data_sgl.sg_table.sgl, sgl, count, i) {
  		sge->addr = sg_dma_address(sgl);
  		sge->length = sg_dma_len(sgl);
  		sge->lkey = queue->device->pd->local_dma_lkey;
  		len += sge->length;
+		sge++;
  	}
  
  	sg->addr = cpu_to_le64(queue->ctrl->ctrl.icdoff);