UPSTREAM: epoll: be better about file lifetimes

epoll can call out to vfs_poll() with a file pointer that may race with
the last 'fput()'. That would make f_count go down to zero, and while
the ep->mtx locking means that the resulting file pointer tear-down will
be blocked until the poll returns, it means that f_count is already
dead, and any use of it won't actually get a reference to the file any
more: it's dead regardless.

Make sure we have a valid ref on the file pointer before we call down to
vfs_poll() from the epoll routines.

Bug: 341845741
Bug: 341834298
Change-Id: Iefa13cd84102ded3e104c030c8d7d0b7a8c1eab2
Link: https://lore.kernel.org/lkml/0000000000002d631f0615918f1e@google.com/


Reported-by:  <syzbot+045b454ab35fd82a35fb@syzkaller.appspotmail.com>
Reviewed-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
(cherry picked from commit 4efaa5ac)
Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.corp-partner.google.com>
(cherry picked from commit c2d23a11)