fuse: fix io-uring list corruption for terminated non-committed requests

When a request is terminated before it has been committed, the request
is not removed from the queue's list. This leaves a dangling list entry
that leads to list corruption and use-after-free issues.

Remove the request from the queue's list for terminated non-committed
requests.

Signed-off-by: Joanne Koong <[e-mail]>
Fixes: c090c8abae4b ("fuse: Add io-uring sqe commit and fetch support")
Cc: [e-mail]
Reviewed-by: Bernd Schubert <[e-mail]>
Signed-off-by: Miklos Szeredi <[e-mail]>

fs/fuse/dev_uring.c

···
 	lockdep_assert_not_held(&queue->lock);
 	spin_lock(&queue->lock);
 	ent->fuse_req = NULL;
+	list_del_init(&req->list);
 	if (test_bit(FR_BACKGROUND, &req->flags)) {
 		queue->active_background--;
 		spin_lock(&fc->bg_lock);