IB/srpt: Simplify srpt_handle_tsk_mgmt()

Let the target core check task existence instead of the SRP target
driver. Additionally, let the target core check the validity of the
task management request instead of the ib_srpt driver.

This patch fixes the following kernel crash:

BUG: unable to handle kernel NULL pointer dereference at 0000000000000001
IP: [<ffffffffa0565f37>] srpt_handle_new_iu+0x6d7/0x790 [ib_srpt]
Oops: 0002 [#1] SMP
Call Trace:
 [<ffffffffa05660ce>] srpt_process_completion+0xde/0x570 [ib_srpt]
 [<ffffffffa056669f>] srpt_compl_thread+0x13f/0x160 [ib_srpt]
 [<ffffffff8109726f>] kthread+0xcf/0xe0
 [<ffffffff81613cfc>] ret_from_fork+0x7c/0xb0

Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
Fixes: 3e4f574857ee ("ib_srpt: Convert TMR path to target_submit_tmr")
Tested-by: Alex Estrin <alex.estrin@intel.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Cc: Nicholas Bellinger <nab@linux-iscsi.org>
Cc: Sagi Grimberg <sagig@mellanox.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Doug Ledford <dledford@redhat.com>
static int srpt_perform_rdmas(struct srpt_rdma_ch *ch,
			      struct srpt_send_ioctx *ioctx)
{
	struct ib_send_wr *bad_wr;
	int sq_wr_avail, ret, i;
	enum dma_data_direction dir;
	const int n_rdma = ioctx->n_rdma;

	dir = ioctx->cmd.data_direction;
	if (dir == DMA_TO_DEVICE) {
		/* write */
		ret = -ENOMEM;
		sq_wr_avail = atomic_sub_return(n_rdma, &ch->sq_wr_avail);
		if (sq_wr_avail < 0) {
			pr_warn("IB send queue full (needed %d)\n",
				n_rdma);
			goto out;
		}
	}

	for (i = 0; i < n_rdma; i++) {
		struct ib_send_wr *wr = &ioctx->rdma_wrs[i].wr;

		wr->opcode = (dir == DMA_FROM_DEVICE) ?
				IB_WR_RDMA_WRITE : IB_WR_RDMA_READ;

		if (i == n_rdma - 1) {
			/* only get completion event for the last rdma read */
			if (dir == DMA_TO_DEVICE) {
				wr->send_flags = IB_SEND_SIGNALED;
				ioctx->rdma_cqe.done = srpt_rdma_read_done;
			} else {
				ioctx->rdma_cqe.done = srpt_rdma_write_done;
			}
			wr->wr_cqe = &ioctx->rdma_cqe;
			wr->next = NULL;
		} else {
			wr->wr_cqe = NULL;
			wr->next = &ioctx->rdma_wrs[i + 1].wr;
		}
	}

	ret = ib_post_send(ch->qp, &ioctx->rdma_wrs->wr, &bad_wr);
	if (ret)
		pr_err("%s[%d]: ib_post_send() returned %d for %d/%d\n",
				 __func__, __LINE__, ret, i, n_rdma);
out:
	if (unlikely(dir == DMA_TO_DEVICE && ret < 0))
		atomic_add(n_rdma, &ch->sq_wr_avail);
	return ret;
}

static int srpt_perform_rdmas(struct srpt_rdma_ch *ch,
			      struct srpt_send_ioctx *ioctx)
{
	struct ib_send_wr *bad_wr;
	int sq_wr_avail, ret, i;
	enum dma_data_direction dir;
	const int n_rdma = ioctx->n_rdma;

	dir = ioctx->cmd.data_direction;
	if (dir == DMA_TO_DEVICE) {
		/* write */
		ret = -ENOMEM;
		sq_wr_avail = atomic_sub_return(n_rdma, &ch->sq_wr_avail);
		if (sq_wr_avail < 0) {
			pr_warn("IB send queue full (needed %d)\n",
				n_rdma);
			goto out;
		}
	}

	for (i = 0; i < n_rdma; i++) {
		struct ib_send_wr *wr = &ioctx->rdma_wrs[i].wr;

		wr->opcode = (dir == DMA_FROM_DEVICE) ?
				IB_WR_RDMA_WRITE : IB_WR_RDMA_READ;

		if (i == n_rdma - 1) {
			/* only get completion event for the last rdma read */
			if (dir == DMA_TO_DEVICE) {
				wr->send_flags = IB_SEND_SIGNALED;
				ioctx->rdma_cqe.done = srpt_rdma_read_done;
			} else {
				ioctx->rdma_cqe.done = srpt_rdma_write_done;
			}
			wr->wr_cqe = &ioctx->rdma_cqe;
			wr->next = NULL;
		} else {
			wr->wr_cqe = NULL;
			wr->next = &ioctx->rdma_wrs[i + 1].wr;
		}
	}

	ret = ib_post_send(ch->qp, &ioctx->rdma_wrs->wr, &bad_wr);
	if (ret)
		pr_err("%s[%d]: ib_post_send() returned %d for %d/%d\n",
				 __func__, __LINE__, ret, i, n_rdma);
out:
	if (unlikely(dir == DMA_TO_DEVICE && ret < 0))
		atomic_add(n_rdma, &ch->sq_wr_avail);
	return ret;
}
