}
 
        if (fte->action & MLX5_FLOW_CONTEXT_ACTION_COUNT) {
+               int max_list_size = BIT(MLX5_CAP_FLOWTABLE_TYPE(dev,
+                                       log_max_flow_counter,
+                                       ft->type));
                int list_size = 0;
 
                list_for_each_entry(dst, &fte->node.children, node.list) {
                        in_dests += MLX5_ST_SZ_BYTES(dest_format_struct);
                        list_size++;
                }
+               if (list_size > max_list_size) {
+                       err = -EINVAL;
+                       goto err_out;
+               }
 
                MLX5_SET(flow_context, in_flow_context, flow_counter_list_size,
                         list_size);
        }
 
        err = mlx5_cmd_exec(dev, in, inlen, out, sizeof(out));
+err_out:
        kvfree(in);
        return err;
 }
 
        FS_FT_FDB             = 0X4,
        FS_FT_SNIFFER_RX        = 0X5,
        FS_FT_SNIFFER_TX        = 0X6,
+       FS_FT_MAX_TYPE = FS_FT_SNIFFER_TX,
 };
 
 enum fs_flow_table_op_mod {
 #define fs_for_each_dst(pos, fte)                      \
        fs_list_for_each_entry(pos, &(fte)->node.children)
 
+#define MLX5_CAP_FLOWTABLE_TYPE(mdev, cap, type) (             \
+       (type == FS_FT_NIC_RX) ? MLX5_CAP_FLOWTABLE_NIC_RX(mdev, cap) :         \
+       (type == FS_FT_ESW_EGRESS_ACL) ? MLX5_CAP_ESW_EGRESS_ACL(mdev, cap) :           \
+       (type == FS_FT_ESW_INGRESS_ACL) ? MLX5_CAP_ESW_INGRESS_ACL(mdev, cap) :         \
+       (type == FS_FT_FDB) ? MLX5_CAP_ESW_FLOWTABLE_FDB(mdev, cap) :           \
+       (type == FS_FT_SNIFFER_RX) ? MLX5_CAP_FLOWTABLE_SNIFFER_RX(mdev, cap) :         \
+       (type == FS_FT_SNIFFER_TX) ? MLX5_CAP_FLOWTABLE_SNIFFER_TX(mdev, cap) :         \
+       (BUILD_BUG_ON_ZERO(FS_FT_SNIFFER_TX != FS_FT_MAX_TYPE))\
+       )
+
 #endif
 
        u8         reserved_at_80[0x18];
        u8         log_max_destination[0x8];
 
-       u8         reserved_at_a0[0x18];
+       u8         log_max_flow_counter[0x8];
+       u8         reserved_at_a8[0x10];
        u8         log_max_flow[0x8];
 
        u8         reserved_at_c0[0x40];