io_uring: fix fget leak when fs don't support nowait buffered read

In the Linux kernel, the following vulnerability has been resolved:

io_uring: fix fget leak when fs don't support nowait buffered read

Heming reported a BUG when using io_uring doing link-cp on ocfs2. [1]

Do the following steps can reproduce this BUG:

mount -t ocfs2 /dev/vdc /mnt/ocfs2

cp testfile /mnt/ocfs2/

./link-cp /mnt/ocfs2/testfile /mnt/ocfs2/testfile.1

umount /mnt/ocfs2

Then umount will fail, and it outputs:

umount: /mnt/ocfs2: target is busy.

While tracing umount, it blames mnt_get_count() not return as expected.

Do a deep investigation for fget()/fput() on related code flow, I've

finally found that fget() leaks since ocfs2 doesn't support nowait

buffered read.

io_issue_sqe

|-io_assign_file // do fget() first

|-io_read

|-io_iter_do_read

|-ocfs2_file_read_iter // return -EOPNOTSUPP

|-kiocb_done

|-io_rw_done

|-__io_complete_rw_common // set REQ_F_REISSUE

|-io_resubmit_prep

|-io_req_prep_async // override req->file, leak happens

This was introduced by commit a196c78b5443 in v5.18. Fix it by don't

re-assign req->file if it has already been assigned.

[1] https://lore.kernel.org/ocfs2-devel/[email protected]/T/#t