Commit 311aa68319f6 for kernel

commit 311aa68319f6a3d64a1e6d940d885830c7acba4c
Merge: e812928be2ee d6c58f4eb3d0
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Thu Feb 12 17:05:20 2026 -0800

    Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma

    Pull rdma updates from Jason Gunthorpe:
     "Usual smallish cycle. The NFS biovec work to push it down into RDMA
      instead of indirecting through a scatterlist is pretty nice to see,
      been talked about for a long time now.

       - Various code improvements in irdma, rtrs, qedr, ocrdma, irdma, rxe

       - Small driver improvements and minor bug fixes to hns, mlx5, rxe,
         mana, mlx5, irdma

       - Robusness improvements in completion processing for EFA

       - New query_port_speed() verb to move past limited IBA defined speed
         steps

       - Support for SG_GAPS in rts and many other small improvements

       - Rare list corruption fix in iwcm

       - Better support different page sizes in rxe

       - Device memory support for mana

       - Direct bio vec to kernel MR for use by NFS-RDMA

       - QP rate limiting for bnxt_re

       - Remote triggerable NULL pointer crash in siw

       - DMA-buf exporter support for RDMA mmaps like doorbells"

    * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: (66 commits)
      RDMA/mlx5: Implement DMABUF export ops
      RDMA/uverbs: Add DMABUF object type and operations
      RDMA/uverbs: Support external FD uobjects
      RDMA/siw: Fix potential NULL pointer dereference in header processing
      RDMA/umad: Reject negative data_len in ib_umad_write
      IB/core: Extend rate limit support for RC QPs
      RDMA/mlx5: Support rate limit only for Raw Packet QP
      RDMA/bnxt_re: Report QP rate limit in debugfs
      RDMA/bnxt_re: Report packet pacing capabilities when querying device
      RDMA/bnxt_re: Add support for QP rate limiting
      MAINTAINERS: Drop RDMA files from Hyper-V section
      RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc
      svcrdma: use bvec-based RDMA read/write API
      RDMA/core: add rdma_rw_max_sge() helper for SQ sizing
      RDMA/core: add MR support for bvec-based RDMA operations
      RDMA/core: use IOVA-based DMA mapping for bvec RDMA operations
      RDMA/core: add bio_vec based RDMA read/write API
      RDMA/irdma: Use kvzalloc for paged memory DMA address array
      RDMA/rxe: Fix race condition in QP timer handlers
      RDMA/mana_ib: Add device‑memory support
      ...

diff --cc drivers/infiniband/hw/mana/cq.c
index 7600412b0739,2dce1b677115..974dd610dcbf
--- a/drivers/infiniband/hw/mana/cq.c
+++ b/drivers/infiniband/hw/mana/cq.c
@@@ -55,11 -54,6 +54,10 @@@ int mana_ib_create_cq(struct ib_cq *ibc
  							  ibucontext);
  		doorbell = mana_ucontext->doorbell;
  	} else {
- 		is_rnic_cq = true;
 +		if (attr->cqe > U32_MAX / COMP_ENTRY_SIZE / 2 + 1) {
 +			ibdev_dbg(ibdev, "CQE %d exceeding limit\n", attr->cqe);
 +			return -EINVAL;
 +		}
  		buf_size = MANA_PAGE_ALIGN(roundup_pow_of_two(attr->cqe * COMP_ENTRY_SIZE));
  		cq->cqe = buf_size / COMP_ENTRY_SIZE;
  		err = mana_ib_create_kernel_queue(mdev, buf_size, GDMA_CQ, &cq->queue);