Commit 9207d47f966b for kernel

commit 9207d47f966be9f4d52e7e0119ac2b7a7e366f3e
Merge: 4e3865471388 0c99acbc8b6c
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Tue May 5 09:11:52 2026 -0700

    Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma

    Pull rdma fixes from Jason Gunthorpe:

     - Several error unwind misses on system calls in mlx5, mana, ocrdma,
       vmw_pvrdma, mlx4, and hns

     - More rxe bugs processing network packets

     - User triggerable races in mlx5 when destroying and creating the same
       same object when the FW returns the same object ID

     - Incorrect passing of an IPv6 address through netlink
       RDMA_NL_LS_OP_IP_RESOLVE

     - Add memory ordering for mlx5's lock avoidance pattenr

     - Protect mana from kernel memory overflow

     - Use safe patterns for xarray/radix_tree look up in mlx5 and hns

    * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: (24 commits)
      RDMA/hns: Fix unlocked call to hns_roce_qp_remove()
      RDMA/hns: Fix xarray race in hns_roce_create_qp_common()
      RDMA/hns: Fix xarray race in hns_roce_create_srq()
      RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()
      RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq()
      RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path
      RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp()
      RDMA/ocrdma: Clarify the mm_head searching
      RDMA/mana: Fix error unwind in mana_ib_create_qp_rss()
      RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss()
      RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss()
      RDMA/mana: Validate rx_hash_key_len
      RDMA/mlx5: Add missing store/release for lock elision pattern
      RDMA/mlx5: Restore zero-init to mlx5_ib_modify_qp() ucmd
      RDMA/ionic: Fix typo in format string
      RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation
      RDMA/core: Fix rereg_mr use-after-free race
      IB/core: Fix IPv6 netlink message size in ib_nl_ip_send_msg()
      RDMA/mlx5: Fix UAF in DCT destroy due to race with create
      RDMA/mlx5: Fix UAF in SRQ destroy due to race with create
      ...