Please pull RDMA subsystem changes

Hi Linus,

Collected rc fixes, as usual alot of probably AI fuelled stuff, and a few bugs that people were actually hitting.

Thanks,
Jason

The following changes since commit cee9395acd8043be0644b25c34bfa86623f2b935:

Linux 7.3-rc1 (2026-08-30 13:34:40 -0700)

are available in the Git repository at:

git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git tags/for-linus

for you to fetch changes up to 9ff797e516dbc1ecb73701ec4c24055712d44411:

RDMA/siw: Bound fragmented header copies by the remaining length (2026-09-10 11:15:46 -0400)

----------------------------------------------------------------
RDMA v7.3 first rc pull

Lots of bug fixes from the last weeks:

- Various error unwind bugs

- Several more races and bugs in siw and rxe, including remote triggerable

- HFI1 corruption with its credit scheme

- Remove a bogus user triggerable dev_warn

- Lock __ethtool_get_link_ksettings() properly

- Fix a lockdep loop with diassociation

- Several storage related bugs, some triggerable remotely

- Do no leak physical addresses to userspace in bnxt_re

- Fix wrong irq context for the xarrays in erdma

- User triggerable race in ucma with multicast

- Race in ipoib with multicast flushing and destruction

----------------------------------------------------------------
Bart Van Assche (1):
RDMA/srp: Fix srp_remove_target()

Carolina Jubran (1):
IB/IPoIB: Avoid restoring OPER_UP after multicast flush

Cheng Xu (1):
RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables

Gang Yan (1):
RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access

Guoqing Jiang (1):
RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept

Jacob Moroni (1):
RDMA/irdma: Enforce local fence for IB_WR_REG_MR

Jeffin Philip (1):
RDMA/core: fix refcount bug in iwpm_get_nlmsg_request()

Jérémy Jean (1):
RDMA/siw: Bound fragmented header copies by the remaining length

Krystian Kaniewski (1):
RDMA/core: Reject unregistering netdevs in ib_get_eth_speed

Leon Romanovsky (2):
RDMA/efa: Keep admin queues alive while IRQ is registered RDMA/efa: Keep EQ resources alive while IRQ is registered

Li RongQing (2):
RDMA/uverbs: Fix potential leak of resources->collection in flow_resources_alloc() RDMA/mad: Fix receive buffer leak when PKey enforcement fails

Linkai Gong (1):
RDMA/bnxt_re: check create_singlethread_workqueue() in DCB setup

Michael Bommarito (1):
RDMA/rxe: insert mcg into mcg_tree only after rxe_mcast_add() succeeds

Norbert Szetei (1):
RDMA/rxe: validate access flags before swapping the MR's PD

Or Har-Toov (2):
RDMA/mlx5: Remove warn on missing representor in query_port_speed RDMA/uverbs: Fix mmap_lock/disassociation_lock circular dependency

Quanye Yang (2):
RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted RDMA/ucma: Serialize join and leave on copy_to_user failure

Ryan Mehri (1):
RDMA/rtrs: guard against null kobj name

Shuangpeng Bai (1):
IB/mlx4: Fix use-after-free on pkey sysfs registration failure

Shuhei Takeshita (2):
IB/hfi1: Resolve the credit-return buffer through the send context's node IB/hfi1: Fix the PIO_CRED credit-return mmap

Sriharsha Basavapatna (1):
RDMA/bnxt_re: Avoid exposing umdbr to userspace

Weiming Shi (1):
RDMA/rxe: Restore HMM_PFN_WRITE check in ODP write paths

Yehyeong Lee (2):
IB/iser: reject a remote invalidation of an unregistered direction IB/isert: wait for deferred control PDU completions before releasing the connection

 drivers/infiniband/core/iwpm_util.c            |  9 ++---
 drivers/infiniband/core/mad.c                  |  3 +-
 drivers/infiniband/core/rdma_core.c            |  1 -
 drivers/infiniband/core/ucma.c                 |  7 ++--
 drivers/infiniband/core/uverbs_flow.c          |  1 +
 drivers/infiniband/core/uverbs_main.c          | 25 ++++++-------
 drivers/infiniband/core/verbs.c                | 12 ++++---
 drivers/infiniband/hw/bnxt_re/main.c           | 10 ++++--
 drivers/infiniband/hw/bnxt_re/uapi.c           |  6 ++--
 drivers/infiniband/hw/efa/efa_com.c            |  7 ++--
 drivers/infiniband/hw/efa/efa_com.h            |  1 +
 drivers/infiniband/hw/efa/efa_main.c           | 33 +++++++++--------
 drivers/infiniband/hw/erdma/erdma_main.c       |  4 +--
 drivers/infiniband/hw/erdma/erdma_verbs.c      | 18 +++++-----
 drivers/infiniband/hw/hfi1/file_ops.c          | 23 ++++++++----
 drivers/infiniband/hw/irdma/verbs.c            |  2 +-
 drivers/infiniband/hw/mlx4/sysfs.c             |  4 +++
 drivers/infiniband/hw/mlx5/main.c              |  7 ++--
 drivers/infiniband/sw/rxe/rxe_mcast.c          | 50 ++++++++++++++++++--------
 drivers/infiniband/sw/rxe/rxe_mr.c             |  3 +-
 drivers/infiniband/sw/rxe/rxe_odp.c            | 16 ++++++---
 drivers/infiniband/sw/rxe/rxe_verbs.c          | 13 +++----
 drivers/infiniband/sw/siw/siw_cm.c             |  7 ++--
 drivers/infiniband/sw/siw/siw_qp_rx.c          |  2 +-
 drivers/infiniband/ulp/ipoib/ipoib.h           |  7 ++++
 drivers/infiniband/ulp/ipoib/ipoib_ib.c        | 12 ++++---
 drivers/infiniband/ulp/ipoib/ipoib_multicast.c | 16 ++++-----
 drivers/infiniband/ulp/iser/iser_initiator.c   | 16 ++++++---
 drivers/infiniband/ulp/isert/ib_isert.c        | 22 ++++++++++++
 drivers/infiniband/ulp/isert/ib_isert.h        |  2 ++
 drivers/infiniband/ulp/rtrs/rtrs-clt-trace.h   |  2 +-
 drivers/infiniband/ulp/rtrs/rtrs-clt.c         |  8 +++++
 drivers/infiniband/ulp/rtrs/rtrs-clt.h         |  2 ++
 drivers/infiniband/ulp/rtrs/rtrs-srv-trace.h   |  2 +-
 drivers/infiniband/ulp/srp/ib_srp.c            | 14 +++++---
 include/rdma/uverbs_types.h                    |  2 --
 include/uapi/rdma/bnxt_re-abi.h                |  2 +-
 37 files changed, 240 insertions(+), 131 deletions(-)

Jason