Re: [PATCH rdma-next v3 0/5] RDMA: Stability and race condition fixes

Jason Gunthorpe
2026-04-30T01:50:02Z

On Mon, Apr 27, 2026 at 02:02:31PM +0300, Edward Srouji wrote:
> This series addresses several stability issues in RDMA core and the
> mlx5 driver.
>
> Patches 1-2 fix xarray race conditions in the mlx5 SRQ and DCT destroy
> paths where a concurrent create can reuse the same firmware object
> number right after firmware releases it, causing the destroy path to
> incorrectly erase the newly created entry.
>
> The remaining patches are independent fixes.
>
> Signed-off-by: Edward Srouji <edwards@nvidia.com>
> ---
> Changes in v3:
> - Dropped restrack destroy-ordering fixes (patches 1-6 in v2) to
> rework them in a dedicated series based on code-review feedback
> - Rebased onto latest for-next
> - Link to v2: https://lore.kernel.org/r/20260406-security-bug-fixes-v2-0-ee8815fa81b7@nvidia.com
>
> Changes in v2:
> - Added patch "RDMA/mlx5: Remove raw RSS QP restrack tracking" to
> also suppress broken tracking for raw RSS QPs, which suffer from
> the same silent failures as DCTs
> - Link to v1: https://lore.kernel.org/r/20260325-security-bug-fixes-v1-0-c8332981ad26@nvidia.com
>
> ---
> Edward Srouji (2):
> RDMA/mlx5: Fix UAF in SRQ destroy due to race with create
> RDMA/mlx5: Fix UAF in DCT destroy due to race with create
>
> Maher Sanalla (1):
> IB/core: Fix IPv6 netlink message size in ib_nl_ip_send_msg()
>
> Michael Guralnik (2):
> RDMA/core: Fix rereg_mr use-after-free race
> RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation

Applied to for-rc

Jason