[PATCH net v4 0/2] net/rds: RDMA-CM event handler fixes for non-IB devices

Hi all,

This is v4 of Aohan Mei's fix for the uninitialized transport pointer
in the RDMA-CM event handler (v1 at [1], v2 at [2], v3 at [3]), now a
two-patch set.

  Patch 1 is the fix itself.  v3 only rejected a connect request
  arriving on a non-IB device; the active side can bind an id to one
  as well, and resolving a route on an iWARP id leaves
  cm_id->route.path_rec unset, which the ROUTE_RESOLVED case
  dereferences.  Such a connection is now dropped at ADDR_RESOLVED
  instead of resolving a route.

  Patch 2 fixes a neighbouring problem in the same case: a synchronous
  rdma_resolve_route() failure was handed back to the rdma_cm, which
  then destroyed an id RDS still owns as ic->i_cm_id and would later
  disconnect and destroy again from the connection's shutdown.

On net-next the rdma_cm ids RDS creates are restricted to IB devices
(commit c7fca8aae6fe), which makes the non-IB cases impossible there;
these are the fixes stable kernels without that API need.

Changes since v3 [3]:
 - Patch 1 also drops a connection whose address resolved to a non-IB
   device, before a route is resolved on it (review of v3).
 - New patch 2 for the rdma_resolve_route() failure return.
 - Rebased onto current net.

Changes since v2 [2]:
 - Carried forward; the rejection is limited to
   RDMA_CM_EVENT_CONNECT_REQUEST so that rdma_cm does not destroy
   connection ids RDS still owns.

[1] https://lore.kernel.org/netdev/20260824111701.2979194-1-ljp1205831794@gmail.com/ (local)
[2] https://lore.kernel.org/netdev/20260825021223.3483044-1-ljp1205831794@gmail.com/ (local)
[3] https://lore.kernel.org/netdev/20260928044507.335883-1-achender@kernel.org/ (local)

Thank you,
Allison


Allison Henderson (1):
  net/rds: don't let the rdma_cm destroy an id RDS still owns on route
    failure

Aohan Mei (1):
  net: rds: fix uninitialized trans dereference in CM event handler

 net/rds/rdma_transport.c | 38 +++++++++++++++++++++++++++++++++-----
 1 file changed, 33 insertions(+), 5 deletions(-)

-- 
2.25.1