Harden xprtrdma connect and reply handling

This series is the result of an LLM-assisted review of the xprtrdma
code base, addressing eight defects in the xprtrdma connect and
reply-handling paths.

A design thread runs through the reply- and send-path fixes: in this
transport, WR-associated resources are reclaimed only by
completions. Each Receive completion consumes one posted Receive, so
every exit from rpcrdma_reply_handler() must either transfer
ownership of the rep or recycle it and post a replacement; exits
that do neither leak the rep and let a misbehaving peer drain the
Receive queue (patches 5 and 7). On the send side, a sendctx slot is
reclaimed only when a Send completion sweeps past it, so a
preparation failure that posts no Send WR has to rewind the ring
head explicitly instead of waiting for a completion that will never
arrive (patch 8).

One ordering constraint: the credit clamp moves ahead of every
branch that can reach the repost tail (patch 6) before the
malformed-reply exits are rerouted through that tail (patch 7). The
rerouted exits refill against rb_credits, the most recently accepted
credit grant, and the earlier clamp guarantees that value is bounded
by re_max_requests rather than taken raw from the wire.

Receive buffer sizing follows from state that outlives the
receive threshold is renegotiated on every connect, so a surviving
rep's receive buffer can be smaller than the new connection
requires. The series resizes undersized buffers at repost time
rather than freeing all reps at disconnect, which would reintroduce
the allocation churn that commit 0e13dd9ea8be removed (patch 4).

This series applied on top of 7.1-rc4 plus
https://lore.kernel.org/linux-nfs/20260526141405.39877-3-...

---
Chris Mason (3):
      xprtrdma: Fix ep kref imbalance on ADDR_CHANGE
      xprtrdma: Initialize re_id before removal registration
      xprtrdma: Fix bcall rep leak and unbounded peek

Chuck Lever (5):
      xprtrdma: Check frwr_wp_create() during connect
      xprtrdma: Resize reply buffers before reposting receives
      xprtrdma: Sanitize the reply credit grant after parsing
      xprtrdma: Repost Receive buffers for malformed replies
      xprtrdma: Return sendctx slot after Send preparation failure

 net/sunrpc/xprtrdma/rpc_rdma.c  | 29 ++++++++----
 net/sunrpc/xprtrdma/verbs.c     | 99 ++++++++++++++++++++++++++++++++++++-----
 net/sunrpc/xprtrdma/xprt_rdma.h |  2 +
 3 files changed, 111 insertions(+), 19 deletions(-)
---
base-commit: ed42a6289b2164998fc29370789dcff40ed50159
change-id: 20260604-xprtrdma-refcount-d2a8c36563d4

Best regards,
--  
Chuck Lever <chuck.lever@oracle.com>