Commit 9e7e66334583 for kernel

commit 9e7e6633458362db72427b48effad8d759131c35
Merge: 00d07402df81 d9c8c45e6d2f
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Thu Jun 18 08:16:21 2026 -0700

    Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma

    Pull rdma updates from Jason Gunthorpe:
     "Many AI driven bug fixes, and several big driver API cleanups

       - Driver bug fixes and minor cleanups in mlx5, hns, rxe, efa, siw,
         rtrs, mana, irdma, mlx4. Commonly error path flows, integer
         arithmetic overflows on unsafe data, out of bounds access, and use
         after free issues under races.

       - Second half of the new udata API for drivers focusing on uAPI
         response

       - bnxt_re supports more options for QP creation that will allow a dv
         path in rdma-core

       - Untangle the module dependencies so drivers don't link to
         ib_uverbs.ko as was originall intended

       - Provide a new way to handle umems with a consistent simplified uAPI
         and update several drivers to use it. This brings dmabuf support to
         more places and more drivers

       - Support for mlx5 rate limit and packet pacing for UD and UC

       - A batch of fixes for the new shared FRMR pools infrastructure"

    * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: (148 commits)
      RDMA/irdma: Replace waitqueue and flag with completion
      RDMA/hns: Fix memory leak of bonding resources
      RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg
      docs: infiniband: correct name of option to enable the ib_uverbs module
      RDMA/bnxt_re: Reject GET_TOGGLE_MEM when toggle page was not allocated
      RDMA/bnxt_re: Fail DBR related page allocation UAPIs if the feature is disabled
      RDMA/bnxt_re: Avoid repeated requests to allocate WC pages
      RDMA/bnxt_re: Proper rollback if the ioremap fails
      RDMA/bnxt_re: Add a max slot check for SQ
      RDMA/bnxt_re: Avoid displaying the kernel pointer
      RDMA/bnxt_re: Free CQ toggle page after firmware teardown
      RDMA/bnxt_re: Free SRQ toggle page after firmware teardown
      RDMA/bnxt_re: Initialize dpi variable to zero
      ABI: sysfs-class-infiniband: minor cleanup
      RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one
      RDMA/mlx5: Fix undefined shift of user RQ WQE size
      RDMA/mlx5: Remove raw RSS QP restrack tracking
      RDMA/mlx5: Remove DCT restrack tracking
      RDMA/mlx5: Drop FRMR pool handle on UMR revoke failure
      RDMA/core: Add ib_frmr_pool_drop for unrecoverable handles
      ...

diff --cc drivers/infiniband/hw/mana/qp.c
index d3ee30b64f53,39d9cdcc5df4..60926f39ab9d
--- a/drivers/infiniband/hw/mana/qp.c
+++ b/drivers/infiniband/hw/mana/qp.c
@@@ -241,15 -210,11 +241,11 @@@ static int mana_ib_create_qp_rss(struc
  					 ucmd.rx_hash_key_len,
  					 ucmd.rx_hash_key);
  	if (ret)
 -		goto fail;
 +		goto free_vport;

- 	ret = ib_copy_to_udata(udata, &resp, sizeof(resp));
- 	if (ret) {
- 		ibdev_dbg(&mdev->ib_dev,
- 			  "Failed to copy to udata create rss-qp, %d\n",
- 			  ret);
+ 	ret = ib_respond_udata(udata, resp);
+ 	if (ret)
  		goto err_disable_vport_rx;
- 	}

  	kfree(mana_ind_table);