Hi Linus, Collected fixes over the break. We made a bunch of progress on some of the difficult syzkaller bugs. Otherwise lots of little driver bug fixes. Thanks, Jason The following changes since commit 8f0b4cce4481fb22653697cced8d0d04027cb1e8: Linux 6.19-rc1 (2025-12-14 16:05:07 +1200) are available in the Git repository at: git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git tags/for-linus for you to fetch changes up to fcd431a9627f272b4c0bec445eba365fe2232a94: RDMA/bnxt_re: fix dma_free_coherent() pointer (2025-12-30 06:45:51 -0500) ---------------------------------------------------------------- RDMA v6.19 first rc request - Fix several syzkaller found bugs: * Poor parsing of the RDMA_NL_LS_OP_IP_RESOLVE netlink * GID entry refcount leaking when CM destruction races with multicast establishment * Missing refcount put in ib_del_sub_device_and_put() - Fixup recently introduced uABI padding for 32 bit consistency - Avoid user triggered math overflow in MANA and AFA - Reading invalid netdev data during an event - kdoc fixes - Fix never-working gid copying in ib_get_gids_from_rdma_hdr - Typo in bnxt when validating the BAR - bnxt mis-parsed IB_SEND_IP_CSUM so it didn't work always - bnxt out of bounds access in bnxt related to the counters on new devices - Allocate the bnxt PDE table with the right sizing - Use dma_free_coherent() correctly in bnxt - Allow rxe to be unloadable when CONFIG_PROVE_LOCKING by adjusting the tracking of the global sockets it uses - Missing unlocking on error path in rxe - Compute the right number of pages in a MR in rtrs ---------------------------------------------------------------- Alok Tiwari (2): RDMA/bnxt_re: Fix incorrect BAR check in bnxt_qplib_map_creq_db() RDMA/bnxt_re: Fix IB_SEND_IP_CSUM handling in post_send Arnd Bergmann (2): RDMA/ucma: Fix rdma_ucm_query_ib_service_resp struct padding RDMA/irdma: Fix irdma_alloc_ucontext_resp padding Ding Hui (1): RDMA/bnxt_re: Fix OOB write in bnxt_re_copy_err_stats() Honggang LI (1): RDMA/rtrs: Fix clt_path::max_pages_per_mr calculation Jang Ingyu (1): RDMA/core: Fix logic error in ib_get_gids_from_rdma_hdr() Jason Gunthorpe (2): RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly RDMA/cm: Fix leaking the multicast GID table reference Kalesh AP (1): RDMA/bnxt_re: Fix to use correct page size for PDE table Konstantin Taranov (1): RDMA/mana_ib: check cqe length for kernel CQs Li Zhijian (1): IB/rxe: Fix missing umem_odp->umem_mutex unlock on error path Michael Margolin (1): RDMA/efa: Remove possible negative shift Michal Schmidt (1): RDMA/irdma: avoid invalid read in irdma_net_event Randy Dunlap (1): RTRS/rtrs: clean up rtrs headers kernel-doc Stefan Metzmacher (1): RDMA/rxe: let rxe_reclassify_recv_socket() call sk_owner_put() Tetsuo Handa (1): RDMA/core: always drop device refcount in ib_del_sub_device_and_put() Thomas Fourier (1): RDMA/bnxt_re: fix dma_free_coherent() pointer drivers/infiniband/core/addr.c | 33 +++++++++-------------------- drivers/infiniband/core/cma.c | 3 +++ drivers/infiniband/core/device.c | 4 +++- drivers/infiniband/core/verbs.c | 2 +- drivers/infiniband/hw/bnxt_re/hw_counters.h | 6 +++--- drivers/infiniband/hw/bnxt_re/ib_verbs.c | 7 +----- drivers/infiniband/hw/bnxt_re/qplib_rcfw.c | 2 +- drivers/infiniband/hw/bnxt_re/qplib_res.c | 8 +++---- drivers/infiniband/hw/efa/efa_verbs.c | 4 ---- drivers/infiniband/hw/irdma/utils.c | 3 ++- drivers/infiniband/hw/mana/cq.c | 4 ++++ drivers/infiniband/sw/rxe/rxe_net.c | 32 ++++++++++++++++++++++++++++ drivers/infiniband/sw/rxe/rxe_odp.c | 4 +++- drivers/infiniband/ulp/rtrs/rtrs-clt.c | 1 + drivers/infiniband/ulp/rtrs/rtrs-pri.h | 32 ++++++++++++++++++---------- drivers/infiniband/ulp/rtrs/rtrs.h | 24 +++++++++++++-------- include/uapi/rdma/irdma-abi.h | 2 +- include/uapi/rdma/rdma_user_cm.h | 4 +++- 18 files changed, 107 insertions(+), 68 deletions(-)