srpt: Use the same CM selector during login cleanup

The IB/CM and RDMA/CM callers of srpt_cm_req_recv() provide exactly one
connection identifier. Context setup branches on ib_cm_id, while error
cleanup branches on rdma_cm_id. Smatch loses the relationship between
the pointers and reports a possible NULL ib_cm_id dereference.

Select the connection identifier by ib_cm_id in both places and document
the caller contract. This preserves cleanup for both supported paths
and makes the control flow consistent without suppressing diagnostics.

srpt/src/ib_srpt.c

@@ -2522,6 +2522,8 @@ static u16 srpt_next_comp_vector(struct srpt_port *sport)
  * @src_addr: GID (IB/CM) or IP address (RDMA/CM) of the port that submitted
  * the login request.
  *
+ * Exactly one of ib_cm_id and rdma_cm_id must be provided.
+ *
  * Ownership of the cm_id is transferred to the target session if this
  * function returns zero. Otherwise the caller remains the owner of cm_id.
  */
@@ -2825,10 +2827,10 @@ free_rsp_cache:
 	kmem_cache_destroy(ch->rsp_buf_cache);
 
 free_ch:
-	if (rdma_cm_id)
-		rdma_cm_id->context = NULL;
-	else
+	if (ib_cm_id)
 		ib_cm_id->context = NULL;
+	else
+		rdma_cm_id->context = NULL;
 	kfree(ch);
 	ch = NULL;