Hi Linus,

I don't usually send rc PRs so late but this cycle there are some
urgent user triggerable bugs that should be expedited. As per your
request I've been putting most of the discovered bugs into the merge
window stream, these ones stood out as particularly significant.

Thanks,
Jason

The following changes since commit e43ffb69e0438cddd72aaa30898b4dc446f664f8:

  Linux 7.1-rc6 (2026-05-31 15:14:24 -0700)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git tags/for-linus

for you to fetch changes up to 13e91fd076306f5d0cdfa14f53d69e37274723c4:

  RDMA/srp: bound SRP_RSP sense copy by the received length (2026-06-08 13:43:23 -0300)

----------------------------------------------------------------
RDMA v7.1 second rc window

Several significant bug fixes of pre-existing issues:

- Missing validation on ucap fd types passed from userspace

- Missing validation of HW DMA space vs userpace expected sizes in EFA
  queue setup

- DMA corruption when using DMA block sizes >= 4G when setting up MRs in
  all drivers

- Missing validation of CPU IDs when setting up dma handles

- Missing validation of IB_MR_REREG_ACCESS when changing writability of a
  MR

- Missing validation of received message/packet size in ISER and SRP

----------------------------------------------------------------
Jason Gunthorpe (3):
      RDMA/core: Validate the passed in fops for ib_get_ucaps()
      RDMA/umem: Fix truncation for block sizes >= 4G
      RDMA: During rereg_mr ensure that REREG_ACCESS is compatible

Michael Bommarito (2):
      IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN
      RDMA/srp: bound SRP_RSP sense copy by the received length

Yishai Hadas (1):
      RDMA/core: Validate cpu_id against nr_cpu_ids in DMAH alloc

Yonatan Nachum (1):
      RDMA/efa: Validate SQ ring size against max LLQ size

 drivers/infiniband/core/iter.c                  |  4 ++--
 drivers/infiniband/core/ucaps.c                 |  8 +++----
 drivers/infiniband/core/umem.c                  | 16 +++++++++++++
 drivers/infiniband/core/uverbs_std_types_dmah.c |  5 +++++
 drivers/infiniband/hw/efa/efa_verbs.c           | 27 ++++++++++++++--------
 drivers/infiniband/hw/hns/hns_roce_mr.c         |  4 ++++
 drivers/infiniband/hw/irdma/verbs.c             |  4 ++++
 drivers/infiniband/hw/mlx4/mr.c                 |  4 ++++
 drivers/infiniband/hw/mlx5/mr.c                 |  4 ++++
 drivers/infiniband/sw/rxe/rxe_verbs.c           |  5 +++++
 drivers/infiniband/ulp/isert/ib_isert.c         |  6 +++++
 drivers/infiniband/ulp/srp/ib_srp.c             | 30 ++++++++++++++++++++-----
 include/rdma/ib_umem.h                          |  8 +++++++
 13 files changed, 103 insertions(+), 22 deletions(-)