[PATCH rdma-next v3 0/5] RDMA: Stability and race condition fixes

[Edward Srouji]

This series addresses several stability issues in RDMA core and the
mlx5 driver.

Patches 1-2 fix xarray race conditions in the mlx5 SRQ and DCT destroy
paths where a concurrent create can reuse the same firmware object
number right after firmware releases it, causing the destroy path to
incorrectly erase the newly created entry.

The remaining patches are independent fixes.

Signed-off-by: Edward Srouji <edwards@xxxxxxxxxx>
---
Changes in v3:
- Dropped restrack destroy-ordering fixes (patches 1-6 in v2) to
  rework them in a dedicated series based on code-review feedback
- Rebased onto latest for-next
- Link to v2: https://lore.kernel.org/r/20260406-security-bug-fixes-v2-0-ee8815fa81b7@xxxxxxxxxx

Changes in v2:
- Added patch "RDMA/mlx5: Remove raw RSS QP restrack tracking" to
  also suppress broken tracking for raw RSS QPs, which suffer from
  the same silent failures as DCTs
- Link to v1: https://lore.kernel.org/r/20260325-security-bug-fixes-v1-0-c8332981ad26@xxxxxxxxxx

---
Edward Srouji (2):
      RDMA/mlx5: Fix UAF in SRQ destroy due to race with create
      RDMA/mlx5: Fix UAF in DCT destroy due to race with create

Maher Sanalla (1):
      IB/core: Fix IPv6 netlink message size in ib_nl_ip_send_msg()

Michael Guralnik (2):
      RDMA/core: Fix rereg_mr use-after-free race
      RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation

 drivers/infiniband/core/addr.c       | 2 +-
 drivers/infiniband/core/uverbs_cmd.c | 9 +++++++--
 drivers/infiniband/hw/mlx5/qp.c      | 5 +++++
 drivers/infiniband/hw/mlx5/qpc.c     | 9 ++++++++-
 drivers/infiniband/hw/mlx5/srq_cmd.c | 9 ++++++++-
 5 files changed, 29 insertions(+), 5 deletions(-)
---
base-commit: 9091e3b59f2bef11c0a841096327565ae0ca220b
change-id: 20260325-security-bug-fixes-6fdef22d9412

Best regards,
-- 
Edward Srouji <edwards@xxxxxxxxxx>