[GIT PULL] Please pull RDMA subsystem changes

[Jason Gunthorpe]

Hi Linus,

This is quite big for rdma, it is not a lot of regressions but a lot
of long standing bugs have been discovered and fixed. I think we will
have some more of these in a few weeks.

Thanks,
Jason

The following changes since commit 254f49634ee16a731174d2ae34bc50bd5f45e731:

  Linux 7.1-rc1 (2026-04-26 14:19:00 -0700)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git tags/for-linus

for you to fetch changes up to 0c99acbc8b6c6dd526ae475a48ee1897b61072fb:

  RDMA/hns: Fix unlocked call to hns_roce_qp_remove() (2026-05-02 15:30:48 -0300)

----------------------------------------------------------------
RDMA v7.1 first rc

A collection of bugs, many found with inspection tools:

- Several error unwind misses on system calls in mlx5, mana,, ocrdma,
  vmw_pvrdma, mlx4, and hns

- More rxe bugs processing network packets

- User triggerable races in mlx5 when destroying and creating the same
  same object when the FW returns the same object ID

- Incorrect passing of an IPv6 address through netlink
  RDMA_NL_LS_OP_IP_RESOLVE

- Add memory ordering for mlx5's lock avoidance pattenr

- Protect mana from kernel memory overflow

- Use safe patterns for xarray/radix_tree look up in mlx5 and hns

----------------------------------------------------------------
Edward Srouji (2):
      RDMA/mlx5: Fix UAF in SRQ destroy due to race with create
      RDMA/mlx5: Fix UAF in DCT destroy due to race with create

Jason Gunthorpe (15):
      RDMA/ionic: Fix typo in format string
      RDMA/mlx5: Restore zero-init to mlx5_ib_modify_qp() ucmd
      RDMA/mlx5: Add missing store/release for lock elision pattern
      RDMA/mana: Validate rx_hash_key_len
      RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss()
      RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss()
      RDMA/mana: Fix error unwind in mana_ib_create_qp_rss()
      RDMA/ocrdma: Clarify the mm_head searching
      RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp()
      RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path
      RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq()
      RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()
      RDMA/hns: Fix xarray race in hns_roce_create_srq()
      RDMA/hns: Fix xarray race in hns_roce_create_qp_common()
      RDMA/hns: Fix unlocked call to hns_roce_qp_remove()

Junrui Luo (1):
      RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init()

Li RongQing (1):
      IB/hfi1: Fix potential use-after-free in PIO and SDMA map teardown

Maher Sanalla (1):
      IB/core: Fix IPv6 netlink message size in ib_nl_ip_send_msg()

Michael Bommarito (2):
      RDMA/rxe: Reject unknown opcodes before ICRC processing
      RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads

Michael Guralnik (2):
      RDMA/core: Fix rereg_mr use-after-free race
      RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation

 drivers/infiniband/core/addr.c                  |  2 +-
 drivers/infiniband/core/uverbs_cmd.c            |  9 +++++++--
 drivers/infiniband/hw/hfi1/pio.c                |  5 ++++-
 drivers/infiniband/hw/hfi1/sdma.c               |  4 +++-
 drivers/infiniband/hw/hns/hns_roce_qp.c         | 13 ++++++++++---
 drivers/infiniband/hw/hns/hns_roce_srq.c        | 12 ++++++------
 drivers/infiniband/hw/ionic/ionic_ibdev.c       |  2 +-
 drivers/infiniband/hw/mana/cq.c                 |  5 +++--
 drivers/infiniband/hw/mana/qp.c                 | 16 ++++++++++------
 drivers/infiniband/hw/mlx4/srq.c                |  4 +++-
 drivers/infiniband/hw/mlx5/main.c               |  9 +++++----
 drivers/infiniband/hw/mlx5/qp.c                 |  7 ++++++-
 drivers/infiniband/hw/mlx5/qpc.c                |  9 ++++++++-
 drivers/infiniband/hw/mlx5/srq_cmd.c            |  9 ++++++++-
 drivers/infiniband/hw/mlx5/umr.c                |  4 ++--
 drivers/infiniband/hw/ocrdma/ocrdma_verbs.c     |  8 ++++----
 drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c |  2 +-
 drivers/infiniband/sw/rxe/rxe_recv.c            | 11 +++++++++++
 drivers/infiniband/sw/rxe/rxe_resp.c            | 14 +++++++++++++-
 drivers/net/ethernet/mellanox/mlx4/srq.c        | 13 +++++++------
 20 files changed, 113 insertions(+), 45 deletions(-)

Attachment: signature.asc
Description: PGP signature