aio: add percpu_ref_put while goto out in do_io_getevents

euler inclusion
category: bugfix
bugzilla: 10652
CVE: NA
-------------------------------------------------------------------------

Commit 05b36af7e25("aio: make sure the input "timeout" value
is valid") forget to call percpu_ref_put when ts is invalid.

Fixes: 05b36af("aio: make sure the input "timeout" value is valid")
Signed-off-by: Nyangerkun <yangerkun@huawei.com>
Reviewed-by: NYang Yingliang <yangyingliang@huawei.com>
Reviewed-by: NHou Tao <houtao1@huawei.com>
Signed-off-by: NYang Yingliang <yangyingliang@huawei.com>

fs/aio.c

@@ -2046,12 +2046,14 @@ static long do_io_getevents(aio_context_t ctx_id,
 	if (likely(ioctx)) {
 		ktime_t until;
 
-		if (!ts)
+		if (!ts) {
 			until = KTIME_MAX;
-		else if (!timespec64_valid(ts))
+		} else if (!timespec64_valid(ts)) {
+			percpu_ref_put(&ioctx->users);
 			goto out;
-		else
+		} else {
 			until = timespec64_to_ktime(*ts);
+		}
 
 		if (likely(min_nr <= nr && min_nr >= 0))
 			ret = read_events(ioctx, min_nr, nr, events, until);