kernel/git/stable/linux.git/drivers/infiniband/hw/mana, branch master

Merge rdma branch 'for-rc' into 'for-next'

2026-08-18T14:05:13+00:00

These did not seem worth sending as a dedicated rc PR during the last week of the cycle. * ko-rdma/for-rc: RDMA/ipoib: Drain RCU callbacks during module teardown RDMA/mlx5: Drain RCU callbacks during module teardown RDMA/core: Wait for RCU callbacks before unloading ib_core RDMA/irdma: Prevent overflows in memory contiguity checks RDMA/siw: publish QP after initialization RDMA/hns: Fix potential integer overflow in mhop hem cleanup RDMA/core: Fix memory leak in __ib_create_cq() on invalid cqe RDMA/mana_ib: initialize err for empty send WR lists RDMA/erdma: initialize ret for empty receive WR lists RDMA/irdma: Prevent user-triggered null deref on QP create RDMA/irdma: Prevent rereg_mr for non-mem regions RDMA/cma: Fix hardware address comparison length in netevent callback RDMa/mlx5: Avoid frame overflow warning IB/mad: Drop unmatched RMPP responses before reassembly Signed-off-by: Jason Gunthorpe

RDMA/mana_ib: UC QP support for UAPI

2026-08-05T14:44:30+00:00

Implement UC QP creation in the RNIC HW for user API. An UC QP is exposed as three work queues: send, receive, and memory management. The latter is used for bind and invalidate WQEs to support memory windows. Signed-off-by: Konstantin Taranov Link: https://patch.msgid.link/20260723115955.1859519-3-kotaranov@linux.microsoft.com Reviewed-by: Long Li Signed-off-by: Leon Romanovsky

RDMA/mana_ib: unify QP lookup table

2026-08-05T14:44:30+00:00

Add helpers to retrieve the send and receive queues of a QP. Use these helpers when storing queue IDs in the lookup table. MANA queue IDs are 2-bit aligned, allowing the two least significant bits to be omitted when storing and looking up queue IDs. Signed-off-by: Konstantin Taranov Link: https://patch.msgid.link/20260723115955.1859519-2-kotaranov@linux.microsoft.com Reviewed-by: Long Li Signed-off-by: Leon Romanovsky

RDMA/mana_ib: return PD number to the user

2026-07-23T12:21:17+00:00

Implement returning to userspace applications PDNs of created PDs. The PDN is used by applications that build work requests outside of the rdma-core code base. The PDN is used to build work requests that require mentioning the PD. The HW still ensures PD isolation using PDN attached to MRs and WRs, therefore the PDN mentioned in the work request must match the PDN of the used work queue. The work requests can fit only 16 bit PDNs. Allow users to request short PDNs which are 16 bits. The capability to request short PDN and get PDN is encoded in the response of alloc user context IOCTL. Signed-off-by: Konstantin Taranov Link: https://patch.msgid.link/20260717200839.495327-1-kotaranov@linux.microsoft.com Signed-off-by: Leon Romanovsky

RDMA/mana_ib: drain QP references after partial table insertion

2026-07-22T09:35:11+00:00

mana_table_store_ud_qp() publishes a QP at its send-queue id before inserting the receive-queue id, dropping the XArray lock between the two xa_insert_irq() calls. A concurrent completion handler can look up the QP and take a transient reference. When the second insertion fails, the rollback erased only the send-queue entry and returned, leaving both the initial table reference and the transient reference outstanding while RDMA core frees the QP, causing a use-after-free. Drain the reference as normal destruction does: drop the initial reference and wait for qp->free, releasing the QP only after every concurrent lookup returns its reference. Fixes: 8001e9257eca ("RDMA/mana_ib: extend mana QP table") Link: https://patch.msgid.link/20260721-if-mana-table-store-qp-qids-partiall-v1-1-8fb3d2d2b559@nvidia.com Reviewed-by: Konstantin Taranov Reviewed-by: Long Li Signed-off-by: Leon Romanovsky

RDMA/mana_ib: Adopt robust udata

2026-07-20T13:45:44+00:00

Enable the uverbs robust udata interface in mana_ib by setting uverbs_robust_udata and converting the driver to the new udata handling model. Signed-off-by: Konstantin Taranov Signed-off-by: Leon Romanovsky

RDMA: Use ib_no_udata_io() in query_device callbacks

2026-07-20T13:00:40+00:00

The query_device callbacks that neither accept driver-specific input nor return a driver-specific response open-code the empty udata handling as ib_is_udata_in_empty() on entry and ib_respond_empty_udata() on exit. ib_no_udata_io() already combines both steps, so replace the entry check with it and simply return 0 on success. Unlike the create and destroy flows, query_device owns no uobject or HW resource - the extended path fills a stack ib_device_attr that the core discards on error - so clearing the empty response buffer on entry rather than on exit is a mechanical change with no functional difference. Link: https://patch.msgid.link/20260714-convert-to-noio-udata-v1-1-f1f6b6c7c988@nvidia.com Signed-off-by: Leon Romanovsky

RDMA: Remove redundant memset() from query_device callbacks

2026-07-14T06:53:14+00:00

The core always hands the driver's query_device() callback a zeroed ib_device_attr. There are only two callers of the op and both clear the structure before invoking it: setup_device() memsets &device->attrs, and ib_uverbs_ex_query_device() passes an on-stack structure initialized to {}. The open-coded memset(props, 0, sizeof(*props)) at the top of the driver callbacks is therefore redundant. Remove it from all drivers. Signed-off-by: Leon Romanovsky

RDMA/mana_ib: initialize err for empty send WR lists

2026-07-02T17:16:44+00:00

mana_ib_post_send() returns err after walking the send work request list. If the caller passes an empty list, the loop is skipped and err is not assigned. Initialize err to 0 so an empty send work request list returns success instead of stack data. Fixes: c8017f5b4856 ("RDMA/mana_ib: UD/GSI work requests") Link: https://patch.msgid.link/r/20260618041752.481193-2-ruoyuw560@gmail.com Signed-off-by: Ruoyu Wang Reviewed-by: Long Li Signed-off-by: Jason Gunthorpe

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma

2026-06-18T15:16:21+00:00

Pull rdma updates from Jason Gunthorpe: "Many AI driven bug fixes, and several big driver API cleanups - Driver bug fixes and minor cleanups in mlx5, hns, rxe, efa, siw, rtrs, mana, irdma, mlx4. Commonly error path flows, integer arithmetic overflows on unsafe data, out of bounds access, and use after free issues under races. - Second half of the new udata API for drivers focusing on uAPI response - bnxt_re supports more options for QP creation that will allow a dv path in rdma-core - Untangle the module dependencies so drivers don't link to ib_uverbs.ko as was originall intended - Provide a new way to handle umems with a consistent simplified uAPI and update several drivers to use it. This brings dmabuf support to more places and more drivers - Support for mlx5 rate limit and packet pacing for UD and UC - A batch of fixes for the new shared FRMR pools infrastructure" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: (148 commits) RDMA/irdma: Replace waitqueue and flag with completion RDMA/hns: Fix memory leak of bonding resources RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg docs: infiniband: correct name of option to enable the ib_uverbs module RDMA/bnxt_re: Reject GET_TOGGLE_MEM when toggle page was not allocated RDMA/bnxt_re: Fail DBR related page allocation UAPIs if the feature is disabled RDMA/bnxt_re: Avoid repeated requests to allocate WC pages RDMA/bnxt_re: Proper rollback if the ioremap fails RDMA/bnxt_re: Add a max slot check for SQ RDMA/bnxt_re: Avoid displaying the kernel pointer RDMA/bnxt_re: Free CQ toggle page after firmware teardown RDMA/bnxt_re: Free SRQ toggle page after firmware teardown RDMA/bnxt_re: Initialize dpi variable to zero ABI: sysfs-class-infiniband: minor cleanup RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one RDMA/mlx5: Fix undefined shift of user RQ WQE size RDMA/mlx5: Remove raw RSS QP restrack tracking RDMA/mlx5: Remove DCT restrack tracking RDMA/mlx5: Drop FRMR pool handle on UMR revoke failure RDMA/core: Add ib_frmr_pool_drop for unrecoverable handles ...