afs: Fix afs_dynroot_readdir() to not use the RCU read lock

afs_dynroot_readdir() uses the RCU read lock to walk the cell list whilst
emitting cell automount entries - but dir_emit() may write to a userspace
buffer, thereby causing a fault to occur and waits to happen.

Fix afs_dynroot_readdir() to get a shared lock on net->cells_lock instead.

This can be triggered by enabling lockdep, preconfiguring a number of
cells, doing "mount -t afs none /afs -o dyn" (or using the kafs-client
package with afs.mount systemd unit enabled) and then doing "ls /afs".

Fixes: 1d0b929f ("afs: Change dynroot to create contents on demand")
Reported-by:  <syzbot+3b6c5c6a1d0119b687a1@syzkaller.appspotmail.com>
Reported-by:  <syzbot+8245611446194a52150d@syzkaller.appspotmail.com>
Reported-by:  <syzbot+1aa62e6852a6ad1c7944@syzkaller.appspotmail.com>
Reported-by:  <syzbot+54e6c2176ba76c56217e@syzkaller.appspotmail.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Link: https://lore.kernel.org/1638014.1744145189@warthog.procyon.org.uk


cc: Marc Dionne <marc.dionne@auristor.com>
cc: linux-afs@lists.infradead.org
cc: linux-fsdevel@vger.kernel.org
Signed-off-by: Christian Brauner <brauner@kernel.org>