Re: [PATCH rdma-next v3 0/5] RDMA: Stability and race condition fixes

[Jason Gunthorpe <jgg@nvidia.com>]

On Mon, Apr 27, 2026 at 02:02:31PM +0300, Edward Srouji wrote:
> This series addresses several stability issues in RDMA core and the
> mlx5 driver.
> 
> Patches 1-2 fix xarray race conditions in the mlx5 SRQ and DCT destroy
> paths where a concurrent create can reuse the same firmware object
> number right after firmware releases it, causing the destroy path to
> incorrectly erase the newly created entry.
> 
> The remaining patches are independent fixes.
> 
> Signed-off-by: Edward Srouji <edwards@nvidia.com>
> ---
> Changes in v3:
> - Dropped restrack destroy-ordering fixes (patches 1-6 in v2) to
>   rework them in a dedicated series based on code-review feedback
> - Rebased onto latest for-next
> - Link to v2: https://lore.kernel.org/r/20260406-security-bug-fixes-v2-0-ee8815fa81b7@nvidia.com
> 
> Changes in v2:
> - Added patch "RDMA/mlx5: Remove raw RSS QP restrack tracking" to
>   also suppress broken tracking for raw RSS QPs, which suffer from
>   the same silent failures as DCTs
> - Link to v1: https://lore.kernel.org/r/20260325-security-bug-fixes-v1-0-c8332981ad26@nvidia.com
> 
> ---
> Edward Srouji (2):
>       RDMA/mlx5: Fix UAF in SRQ destroy due to race with create
>       RDMA/mlx5: Fix UAF in DCT destroy due to race with create
> 
> Maher Sanalla (1):
>       IB/core: Fix IPv6 netlink message size in ib_nl_ip_send_msg()
> 
> Michael Guralnik (2):
>       RDMA/core: Fix rereg_mr use-after-free race
>       RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation

Applied to for-rc

Jason