Index: mlx4/kernel/bus/ib/qp.c
===================================================================
--- mlx4/kernel/bus/ib/qp.c	(revision 1622)
+++ mlx4/kernel/bus/ib/qp.c	(working copy)
@@ -411,14 +411,20 @@
 		err = mlx4_buf_write_mtt(dev->dev, &qp->mtt, &qp->buf);
 		if (err)
 			goto err_mtt;
-
-		qp->sq.wrid  = kmalloc(qp->sq.wqe_cnt * sizeof (u64), GFP_KERNEL);
-		qp->rq.wrid  = kmalloc(qp->rq.wqe_cnt * sizeof (u64), GFP_KERNEL);
-
-		if (!qp->sq.wrid || !qp->rq.wrid) {
-			err = -ENOMEM;
-			goto err_wrid;
+		if (qp->sq.wqe_cnt) {
+			qp->sq.wrid  = kmalloc(qp->sq.wqe_cnt * sizeof (u64), GFP_KERNEL);
+			if (!qp->sq.wrid) {
+				err = -ENOMEM;
+				goto err_wrid;
+			}
 		}
+		if (qp->rq.wqe_cnt) {
+			qp->rq.wrid  = kmalloc(qp->rq.wqe_cnt * sizeof (u64), GFP_KERNEL);
+			if (!qp->rq.wrid) {
+				err = -ENOMEM;
+				goto err_wrid;
+			}
+		}
 	}
 
 	if (!sqpn)
@@ -452,8 +458,10 @@
 			mlx4_ib_db_unmap_user(to_mucontext(pd->p_uctx),
 					      &qp->db);
 	} else {
-		kfree(qp->sq.wrid);
-		kfree(qp->rq.wrid);
+		if (qp->sq.wrid)
+			kfree(qp->sq.wrid);
+		if (qp->rq.wrid)
+			kfree(qp->rq.wrid);
 	}
 
 err_mtt: