IB/srp: Fix srp_create_target() error handling

Avoid that the following kernel oops occurs if memory pool
allocation fails:

BUG: unable to handle kernel NULL pointer dereference at (null)
IP: [<ffffffffa048d0a0>] ib_drain_rq+0x0/0x20 [ib_core]
Call Trace:
[<ffffffffa04af386>] srp_create_target+0xca6/0x13a9 [ib_srp]
[<ffffffff813cc863>] dev_attr_store+0x13/0x20
[<ffffffff81214b50>] sysfs_kf_write+0x40/0x50
[<ffffffff81213f1c>] kernfs_fop_write+0x13c/0x180
[<ffffffff81197683>] __vfs_write+0x23/0xf0
[<ffffffff81198744>] vfs_write+0xa4/0x1a0
[<ffffffff81199a44>] SyS_write+0x44/0xa0
[<ffffffff8159e3e9>] entry_SYSCALL_64_fastpath+0x1c/0xac

Fixes: 1dc7b1f10dcb ("IB/srp: use the new CQ API")
Signed-off-by: Bart Van Assche <[e-mail]>
Reviewed-by: Leon Romanovsky <[e-mail]>
Tested-by: Laurence Oberman <[e-mail]>
Cc: Christoph Hellwig <[e-mail]>
Cc: Sagi Grimberg <[e-mail]>
Cc: <[e-mail]> # v4.5+
Signed-off-by: Doug Ledford <[e-mail]>

drivers/infiniband/ulp/srp/ib_srp.c

···
 
 /**
  * srp_destroy_qp() - destroy an RDMA queue pair
- * @ch: SRP RDMA channel.
+ * @qp: RDMA queue pair.
  *
  * Drain the qp before destroying it.  This avoids that the receive
  * completion handler can access the queue pair while it is
  * being destroyed.
  */
-static void srp_destroy_qp(struct srp_rdma_ch *ch)
+static void srp_destroy_qp(struct ib_qp *qp)
 {
-	ib_drain_rq(ch->qp);
-	ib_destroy_qp(ch->qp);
+	ib_drain_rq(qp);
+	ib_destroy_qp(qp);
 }
 
 static int srp_create_ch_ib(struct srp_rdma_ch *ch)
···
 	}
 
 	if (ch->qp)
-		srp_destroy_qp(ch);
+		srp_destroy_qp(ch->qp);
 	if (ch->recv_cq)
 		ib_free_cq(ch->recv_cq);
 	if (ch->send_cq)
···
 	return 0;
 
 err_qp:
-	srp_destroy_qp(ch);
+	srp_destroy_qp(qp);
 
 err_send_cq:
 	ib_free_cq(send_cq);
···
 			ib_destroy_fmr_pool(ch->fmr_pool);
 	}
 
-	srp_destroy_qp(ch);
+	srp_destroy_qp(ch->qp);
 	ib_free_cq(ch->send_cq);
 	ib_free_cq(ch->recv_cq);