gadgetfs: use-after-free in ->aio_read()

gadgetfs: use-after-free in ->aio_read()

commit f01d35a15fa04162a58b95970fc01fa70ec9dacd upstream.

AIO_PREAD requests call ->aio_read() with iovec on caller's stack, so if
we are going to access it asynchronously, we'd better get ourselves
a copy - the one on kernel stack of aio_run_iocb() won't be there
anymore.  function/f_fs.c take care of doing that, legacy/inode.c
doesn't...

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
[lizf: Backproted to 3.4:
 - adjust context
 - need kfree() after calling get_ready_ep()]
Signed-off-by: Zefan Li <lizefan@huawei.com>