io_uring/msg_ring: don't leave potentially dangling ->tctx pointer

io_uring/msg_ring: don't leave potentially dangling ->tctx pointer

[ Upstream commit 69a62e03f896a7382671877b6ad6aab87c53e9c3 ]

For remote posting of messages, req->tctx is assigned even though it
is never used. Rather than leave a dangling pointer, just clear it to
NULL and use the previous check for a valid submitter_task to gate on
whether or not the request should be terminated.

Reported-by: Jann Horn <jannh@google.com>
Fixes: b6f58a3f4aa8 ("io_uring: move struct io_kiocb from task_struct to io_uring_task")
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>