--- ./source/private_module/cxgb4/sge.c	2019-03-23 08:11:47.789192966 +0000
+++ ./source/private_module/cxgb4/sge.c.hotpatch	2019-03-25 11:47:12.005192966 +0000
@@ -2879,34 +2879,34 @@
     int ret;
 
     cxgb_hold(adap);
-    if (unlikely(cxgb4_is_ctrl_pkt(skb)))
-    {
-    	
-        /* Single ctrl queue is a requirement for LE workaround path */
-        if (adap->tids.nsftids)
-        {
+    if (unlikely(cxgb4_is_ctrl_pkt(skb))) {
+        if (adap->tids.nsftids) {
             idx = 0;
         }
-        /* chenkeyu(5484): оƬѾλˣsgeнڣ
-        Ϣ˵оƬλdownڣͨ
-        Cxgbe_ResetChipֹܹͣϲ豸ݷͶ,
-        ڿϢ˵ƶ
-        (оƬλȥkillall netperf)оƬ
-        λǷ·sgeԴ */
-        if (likely(CXGB_IS_READY(adap)))
-        {
+        if (unlikely(idx >= MAX_CTRL_QUEUES)) {
+            CXGB4_LOG_PERIOD(DRV_LOG_INFO, 381, 5, 3600*HZ, "Adapter %p ctrl queue id %u is invalid.", adap, idx);
+            dev_kfree_skb(skb);
+            cxgb_put(adap);
+            return NET_XMIT_DROP;
+        }
+        if (likely(CXGB_IS_READY(adap))) {
             ret = ctrl_xmit(&adap->sge.ctrlq[idx], skb);
             cxgb_put(adap);
             return ret;
         }
-
         ret = ctrl_defer_xmit_chipreset(&adap->sge.ctrlq[idx], skb);
         cxgb_put(adap);
         return ret;
     }
 
-    if (likely(CXGB_IS_READY(adap)))
-    {
+    if (unlikely(idx >= MAX_OFLD_QSETS)) {
+        CXGB4_LOG_PERIOD(DRV_LOG_INFO, 381, 5, 3600*HZ, "Adapter %p ofldtx queue id %u is invalid.", adap, idx);
+        dev_kfree_skb(skb);
+        cxgb_put(adap);
+        return NET_XMIT_DROP;
+    }
+
+    if (likely(CXGB_IS_READY(adap))) {
         ret = ofld_xmit(&adap->sge.ofldtxq[idx], skb);
         cxgb_put(adap);
         return ret;
