CVE-2026-99166: net: rds: fix uninitialized trans dereference in CM event handler

In the Linux kernel, the following vulnerability has been resolved:

net: rds: fix uninitialized trans dereference in CM event handler

rdsrdmacmeventhandlercmn() assigns trans only when the RDMA device is an InfiniBand CA (RDMANODEIBCA). On any other device type, e.g. an iWARP RNIC such as siw, trans stays uninitialized, but the event switch dereferences it: unconditionally in the RDMACMEVENTCONNECTREQUEST case via trans->cmhandleconnect(), and (with a connection context) in the ROUTERESOLVED and ESTABLISHED cases.

An RDS listener on an iWARP device therefore crashes the kernel as soon as a connect request arrives: with CONFIGINITSTACKALLZERO the wild load becomes a NULL dereference at offset 0xa0 (&trans->cmhandleconnect) in the iwcmwq workqueue.

GCC masks the bug in default builds by folding the uninitialized load into &rdsibtransport; Clang-built kernels take the real uninitialized path and oops.

The active side can land on a non-IB device too: the id that rdsibconnpathconnect() creates is not restricted to a node type, so rdmaresolveaddr() binds it to whichever device serves the local address, and an iWARP RNIC on the same netdev qualifies. The crash there is different: resolving a route on an iWARP id never fills in cmid->route.pathrec, and the ROUTERESOLVED case writes pathrec[0].sl before it calls into the transport.

The iWARP transport was dropped long ago and IB is the only transport left, so make that explicit: initialize trans to &rdsibtransport at declaration, drop the conditional assignment, reject a connect request that arrives on a non-IB device, and drop a connection whose address resolved to one instead of resolving a route on it. The rejection is limited to RDMACMEVENTCONNECTREQUEST on purpose: a non-zero return from the handler makes rdmacm destroy the id the event was delivered on, which is right for the request's freshly created id but would free a connection id that RDS still owns for any other event. On the active side the id stays ic->icmid and the connection's shutdown destroys it, so that case returns 0.

[achender: reject only on RDMACMEVENTCONNECTREQUEST instead of bailing out for every event on a non-IB device, so that rdmacm does not destroy connection ids RDS still tracks; drop a connection whose address resolved to a non-IB device before a route is resolved on it; changelog adjusted]