diff --git a/srpt/src/ib_srpt.c b/srpt/src/ib_srpt.c
index 51286248c..930729092 100644
--- a/srpt/src/ib_srpt.c
+++ b/srpt/src/ib_srpt.c
@@ -889,7 +889,7 @@ static struct srpt_ioctx **srpt_alloc_ioctx_ring(struct srpt_device *sdev,
 	WARN_ON(ioctx_size != sizeof(struct srpt_recv_ioctx) &&
 		ioctx_size != sizeof(struct srpt_send_ioctx));
 
-	ring = vmalloc(ring_size * sizeof(ring[0]));
+	ring = kvmalloc_array(ring_size, sizeof(ring[0]), GFP_KERNEL);
 	if (!ring)
 		goto out;
 	for (i = 0; i < ring_size; ++i) {
@@ -904,7 +904,7 @@ static struct srpt_ioctx **srpt_alloc_ioctx_ring(struct srpt_device *sdev,
 err:
 	while (--i >= 0)
 		srpt_free_ioctx(sdev, ring[i], buf_cache, dir);
-	vfree(ring);
+	kvfree(ring);
 	ring = NULL;
 out:
 	return ring;
@@ -930,7 +930,7 @@ static void srpt_free_ioctx_ring(struct srpt_ioctx **ioctx_ring,
 
 	for (i = 0; i < ring_size; ++i)
 		srpt_free_ioctx(sdev, ioctx_ring[i], buf_cache, dir);
-	vfree(ioctx_ring);
+	kvfree(ioctx_ring);
 }
 
 /**
@@ -1304,7 +1304,6 @@ static int srpt_ch_qp_rtr(struct srpt_rdma_ch *ch, struct ib_qp *qp)
 	if (ret)
 		goto out;
 
-	attr->qp_access_flags = 0;
 	attr->max_dest_rd_atomic = 4;
 
 	ret = ib_modify_qp(qp, attr, attr_mask);
@@ -1338,7 +1337,6 @@ static int srpt_ch_qp_rts(struct srpt_rdma_ch *ch, struct ib_qp *qp)
 	if (ret)
 		goto out;
 
-	attr->qp_access_flags = 0;
 	attr->max_rd_atomic = 4;
 
 	ret = ib_modify_qp(qp, attr, attr_mask);
@@ -2331,10 +2329,8 @@ retry:
 	qp_init->cap.max_send_wr = sq_size;
 #if HAVE_DEV_ATTR_MAX_SEND_SGE
 	ch->max_send_sge = sdev->dev_attr.max_send_sge;
-	ch->max_recv_sge = sdev->dev_attr.max_recv_sge;
 #else
 	ch->max_send_sge = sdev->dev_attr.max_sge;
-	ch->max_recv_sge = ch->max_send_sge;
 #endif
 	/*
 	 * For max_sge values > 2 * max_sge_delta, subtract max_sge_delta. For
@@ -2346,12 +2342,11 @@ retry:
 		      max_t(int, 0,
 			    ch->max_send_sge - max_sge_delta));
 	qp_init->cap.max_send_sge = ch->max_send_sge;
-	qp_init->cap.max_recv_sge = ch->max_recv_sge;
+	qp_init->cap.max_recv_sge = 1;
 	if (sdev->use_srq) {
 		qp_init->srq = sdev->srq;
 	} else {
 		qp_init->cap.max_recv_wr = ch->rq_size;
-		qp_init->cap.max_recv_sge = ch->max_recv_sge;
 	}
 
 	if (ch->using_rdma_cm) {
diff --git a/srpt/src/ib_srpt.h b/srpt/src/ib_srpt.h
index ce680261a..30b07adfb 100644
--- a/srpt/src/ib_srpt.h
+++ b/srpt/src/ib_srpt.h
@@ -382,7 +382,6 @@ enum rdma_ch_state {
  * @kref:	   kref for this channel.
  * @rq_size:       IB receive queue size.
  * @max_send_sge:  Maximum length of RDMA send scatter list.
- * @max_recv_sge:  Maximum length of RDMA receive scatter list.
  * @max_rsp_size:  Maximum size of an SRP response message in bytes.
  * @sq_wr_avail:   number of work requests available in the send queue.
  * @sport:         pointer to the information of the HCA port used by this
@@ -428,7 +427,6 @@ struct srpt_rdma_ch {
 	struct kref		kref;
 	int			rq_size;
 	u32			max_send_sge;
-	u32			max_recv_sge;
 	u32			max_rsp_size;
 	atomic_t		sq_wr_avail;
 	struct srpt_port	*sport;