Hi Linus, This is quite big for rdma, it is not a lot of regressions but a lot of long standing bugs have been discovered and fixed. I think we will have some more of these in a few weeks. Thanks, Jason The following changes since commit 254f49634ee16a731174d2ae34bc50bd5f45e731: Linux 7.1-rc1 (2026-04-26 14:19:00 -0700) are available in the Git repository at: git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git tags/for-linus for you to fetch changes up to 0c99acbc8b6c6dd526ae475a48ee1897b61072fb: RDMA/hns: Fix unlocked call to hns_roce_qp_remove() (2026-05-02 15:30:48 -0300) ---------------------------------------------------------------- RDMA v7.1 first rc A collection of bugs, many found with inspection tools: - Several error unwind misses on system calls in mlx5, mana,, ocrdma, vmw_pvrdma, mlx4, and hns - More rxe bugs processing network packets - User triggerable races in mlx5 when destroying and creating the same same object when the FW returns the same object ID - Incorrect passing of an IPv6 address through netlink RDMA_NL_LS_OP_IP_RESOLVE - Add memory ordering for mlx5's lock avoidance pattenr - Protect mana from kernel memory overflow - Use safe patterns for xarray/radix_tree look up in mlx5 and hns ---------------------------------------------------------------- Edward Srouji (2): RDMA/mlx5: Fix UAF in SRQ destroy due to race with create RDMA/mlx5: Fix UAF in DCT destroy due to race with create Jason Gunthorpe (15): RDMA/ionic: Fix typo in format string RDMA/mlx5: Restore zero-init to mlx5_ib_modify_qp() ucmd RDMA/mlx5: Add missing store/release for lock elision pattern RDMA/mana: Validate rx_hash_key_len RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss() RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() RDMA/ocrdma: Clarify the mm_head searching RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() RDMA/hns: Fix xarray race in hns_roce_create_srq() RDMA/hns: Fix xarray race in hns_roce_create_qp_common() RDMA/hns: Fix unlocked call to hns_roce_qp_remove() Junrui Luo (1): RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() Li RongQing (1): IB/hfi1: Fix potential use-after-free in PIO and SDMA map teardown Maher Sanalla (1): IB/core: Fix IPv6 netlink message size in ib_nl_ip_send_msg() Michael Bommarito (2): RDMA/rxe: Reject unknown opcodes before ICRC processing RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads Michael Guralnik (2): RDMA/core: Fix rereg_mr use-after-free race RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation drivers/infiniband/core/addr.c | 2 +- drivers/infiniband/core/uverbs_cmd.c | 9 +++++++-- drivers/infiniband/hw/hfi1/pio.c | 5 ++++- drivers/infiniband/hw/hfi1/sdma.c | 4 +++- drivers/infiniband/hw/hns/hns_roce_qp.c | 13 ++++++++++--- drivers/infiniband/hw/hns/hns_roce_srq.c | 12 ++++++------ drivers/infiniband/hw/ionic/ionic_ibdev.c | 2 +- drivers/infiniband/hw/mana/cq.c | 5 +++-- drivers/infiniband/hw/mana/qp.c | 16 ++++++++++------ drivers/infiniband/hw/mlx4/srq.c | 4 +++- drivers/infiniband/hw/mlx5/main.c | 9 +++++---- drivers/infiniband/hw/mlx5/qp.c | 7 ++++++- drivers/infiniband/hw/mlx5/qpc.c | 9 ++++++++- drivers/infiniband/hw/mlx5/srq_cmd.c | 9 ++++++++- drivers/infiniband/hw/mlx5/umr.c | 4 ++-- drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 8 ++++---- drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c | 2 +- drivers/infiniband/sw/rxe/rxe_recv.c | 11 +++++++++++ drivers/infiniband/sw/rxe/rxe_resp.c | 14 +++++++++++++- drivers/net/ethernet/mellanox/mlx4/srq.c | 13 +++++++------ 20 files changed, 113 insertions(+), 45 deletions(-)