Please pull RDMA subsystem changes

Hi Linus,

This is quite big for rdma, it is not a lot of regressions but a lot of long standing bugs have been discovered and fixed. I think we will have some more of these in a few weeks.

Thanks,
Jason

The following changes since commit 254f49634ee16a731174d2ae34bc50bd5f45e731:

Linux 7.1-rc1 (2026-04-26 14:19:00 -0700)

are available in the Git repository at:

git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git tags/for-linus

for you to fetch changes up to 0c99acbc8b6c6dd526ae475a48ee1897b61072fb:

RDMA/hns: Fix unlocked call to hns_roce_qp_remove() (2026-05-02 15:30:48 -0300)

----------------------------------------------------------------
RDMA v7.1 first rc

A collection of bugs, many found with inspection tools:

- Several error unwind misses on system calls in mlx5, mana,, ocrdma, vmw_pvrdma, mlx4, and hns

- More rxe bugs processing network packets

- User triggerable races in mlx5 when destroying and creating the same same object when the FW returns the same object ID

- Incorrect passing of an IPv6 address through netlink RDMA_NL_LS_OP_IP_RESOLVE

- Add memory ordering for mlx5's lock avoidance pattenr

- Protect mana from kernel memory overflow

- Use safe patterns for xarray/radix_tree look up in mlx5 and hns

----------------------------------------------------------------
Edward Srouji (2):
RDMA/mlx5: Fix UAF in SRQ destroy due to race with create RDMA/mlx5: Fix UAF in DCT destroy due to race with create

Jason Gunthorpe (15):
RDMA/ionic: Fix typo in format string
RDMA/mlx5: Restore zero-init to mlx5_ib_modify_qp() ucmd RDMA/mlx5: Add missing store/release for lock elision pattern RDMA/mana: Validate rx_hash_key_len
RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss() RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() RDMA/ocrdma: Clarify the mm_head searching
RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()
RDMA/hns: Fix xarray race in hns_roce_create_srq() RDMA/hns: Fix xarray race in hns_roce_create_qp_common() RDMA/hns: Fix unlocked call to hns_roce_qp_remove()

Junrui Luo (1):
RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init()

Li RongQing (1):
IB/hfi1: Fix potential use-after-free in PIO and SDMA map teardown

Maher Sanalla (1):
IB/core: Fix IPv6 netlink message size in ib_nl_ip_send_msg()

Michael Bommarito (2):
RDMA/rxe: Reject unknown opcodes before ICRC processing RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads

Michael Guralnik (2):
RDMA/core: Fix rereg_mr use-after-free race RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation

 drivers/infiniband/core/addr.c                  |  2 +-
 drivers/infiniband/core/uverbs_cmd.c            |  9 +++++++--
 drivers/infiniband/hw/hfi1/pio.c                |  5 ++++-
 drivers/infiniband/hw/hfi1/sdma.c               |  4 +++-
 drivers/infiniband/hw/hns/hns_roce_qp.c         | 13 ++++++++++---
 drivers/infiniband/hw/hns/hns_roce_srq.c        | 12 ++++++------
 drivers/infiniband/hw/ionic/ionic_ibdev.c       |  2 +-
 drivers/infiniband/hw/mana/cq.c                 |  5 +++--
 drivers/infiniband/hw/mana/qp.c                 | 16 ++++++++++------
 drivers/infiniband/hw/mlx4/srq.c                |  4 +++-
 drivers/infiniband/hw/mlx5/main.c               |  9 +++++----
 drivers/infiniband/hw/mlx5/qp.c                 |  7 ++++++-
 drivers/infiniband/hw/mlx5/qpc.c                |  9 ++++++++-
 drivers/infiniband/hw/mlx5/srq_cmd.c            |  9 ++++++++-
 drivers/infiniband/hw/mlx5/umr.c                |  4 ++--
 drivers/infiniband/hw/ocrdma/ocrdma_verbs.c     |  8 ++++----
 drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c |  2 +-
 drivers/infiniband/sw/rxe/rxe_recv.c            | 11 +++++++++++
 drivers/infiniband/sw/rxe/rxe_resp.c            | 14 +++++++++++++-
 drivers/net/ethernet/mellanox/mlx4/srq.c        | 13 +++++++------
 20 files changed, 113 insertions(+), 45 deletions(-)