Hi Linus, Collected rc fixes, as usual alot of probably AI fuelled stuff, and a few bugs that people were actually hitting. Thanks, Jason The following changes since commit cee9395acd8043be0644b25c34bfa86623f2b935: Linux 7.3-rc1 (2026-08-30 13:34:40 -0700) are available in the Git repository at: git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git tags/for-linus for you to fetch changes up to 9ff797e516dbc1ecb73701ec4c24055712d44411: RDMA/siw: Bound fragmented header copies by the remaining length (2026-09-10 11:15:46 -0400) ---------------------------------------------------------------- RDMA v7.3 first rc pull Lots of bug fixes from the last weeks: - Various error unwind bugs - Several more races and bugs in siw and rxe, including remote triggerable - HFI1 corruption with its credit scheme - Remove a bogus user triggerable dev_warn - Lock __ethtool_get_link_ksettings() properly - Fix a lockdep loop with diassociation - Several storage related bugs, some triggerable remotely - Do no leak physical addresses to userspace in bnxt_re - Fix wrong irq context for the xarrays in erdma - User triggerable race in ucma with multicast - Race in ipoib with multicast flushing and destruction ---------------------------------------------------------------- Bart Van Assche (1): RDMA/srp: Fix srp_remove_target() Carolina Jubran (1): IB/IPoIB: Avoid restoring OPER_UP after multicast flush Cheng Xu (1): RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables Gang Yan (1): RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access Guoqing Jiang (1): RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept Jacob Moroni (1): RDMA/irdma: Enforce local fence for IB_WR_REG_MR Jeffin Philip (1): RDMA/core: fix refcount bug in iwpm_get_nlmsg_request() Jérémy Jean (1): RDMA/siw: Bound fragmented header copies by the remaining length Krystian Kaniewski (1): RDMA/core: Reject unregistering netdevs in ib_get_eth_speed Leon Romanovsky (2): RDMA/efa: Keep admin queues alive while IRQ is registered RDMA/efa: Keep EQ resources alive while IRQ is registered Li RongQing (2): RDMA/uverbs: Fix potential leak of resources->collection in flow_resources_alloc() RDMA/mad: Fix receive buffer leak when PKey enforcement fails Linkai Gong (1): RDMA/bnxt_re: check create_singlethread_workqueue() in DCB setup Michael Bommarito (1): RDMA/rxe: insert mcg into mcg_tree only after rxe_mcast_add() succeeds Norbert Szetei (1): RDMA/rxe: validate access flags before swapping the MR's PD Or Har-Toov (2): RDMA/mlx5: Remove warn on missing representor in query_port_speed RDMA/uverbs: Fix mmap_lock/disassociation_lock circular dependency Quanye Yang (2): RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted RDMA/ucma: Serialize join and leave on copy_to_user failure Ryan Mehri (1): RDMA/rtrs: guard against null kobj name Shuangpeng Bai (1): IB/mlx4: Fix use-after-free on pkey sysfs registration failure Shuhei Takeshita (2): IB/hfi1: Resolve the credit-return buffer through the send context's node IB/hfi1: Fix the PIO_CRED credit-return mmap Sriharsha Basavapatna (1): RDMA/bnxt_re: Avoid exposing umdbr to userspace Weiming Shi (1): RDMA/rxe: Restore HMM_PFN_WRITE check in ODP write paths Yehyeong Lee (2): IB/iser: reject a remote invalidation of an unregistered direction IB/isert: wait for deferred control PDU completions before releasing the connection drivers/infiniband/core/iwpm_util.c | 9 ++--- drivers/infiniband/core/mad.c | 3 +- drivers/infiniband/core/rdma_core.c | 1 - drivers/infiniband/core/ucma.c | 7 ++-- drivers/infiniband/core/uverbs_flow.c | 1 + drivers/infiniband/core/uverbs_main.c | 25 ++++++------- drivers/infiniband/core/verbs.c | 12 ++++--- drivers/infiniband/hw/bnxt_re/main.c | 10 ++++-- drivers/infiniband/hw/bnxt_re/uapi.c | 6 ++-- drivers/infiniband/hw/efa/efa_com.c | 7 ++-- drivers/infiniband/hw/efa/efa_com.h | 1 + drivers/infiniband/hw/efa/efa_main.c | 33 +++++++++-------- drivers/infiniband/hw/erdma/erdma_main.c | 4 +-- drivers/infiniband/hw/erdma/erdma_verbs.c | 18 +++++----- drivers/infiniband/hw/hfi1/file_ops.c | 23 ++++++++---- drivers/infiniband/hw/irdma/verbs.c | 2 +- drivers/infiniband/hw/mlx4/sysfs.c | 4 +++ drivers/infiniband/hw/mlx5/main.c | 7 ++-- drivers/infiniband/sw/rxe/rxe_mcast.c | 50 ++++++++++++++++++-------- drivers/infiniband/sw/rxe/rxe_mr.c | 3 +- drivers/infiniband/sw/rxe/rxe_odp.c | 16 ++++++--- drivers/infiniband/sw/rxe/rxe_verbs.c | 13 +++---- drivers/infiniband/sw/siw/siw_cm.c | 7 ++-- drivers/infiniband/sw/siw/siw_qp_rx.c | 2 +- drivers/infiniband/ulp/ipoib/ipoib.h | 7 ++++ drivers/infiniband/ulp/ipoib/ipoib_ib.c | 12 ++++--- drivers/infiniband/ulp/ipoib/ipoib_multicast.c | 16 ++++----- drivers/infiniband/ulp/iser/iser_initiator.c | 16 ++++++--- drivers/infiniband/ulp/isert/ib_isert.c | 22 ++++++++++++ drivers/infiniband/ulp/isert/ib_isert.h | 2 ++ drivers/infiniband/ulp/rtrs/rtrs-clt-trace.h | 2 +- drivers/infiniband/ulp/rtrs/rtrs-clt.c | 8 +++++ drivers/infiniband/ulp/rtrs/rtrs-clt.h | 2 ++ drivers/infiniband/ulp/rtrs/rtrs-srv-trace.h | 2 +- drivers/infiniband/ulp/srp/ib_srp.c | 14 +++++--- include/rdma/uverbs_types.h | 2 -- include/uapi/rdma/bnxt_re-abi.h | 2 +- 37 files changed, 240 insertions(+), 131 deletions(-) -- Jason