Merge patch series "afs: Miscellaneous fixes"

David Howells <dhowells@redhat.com> says:

(1) Fix afs_fs_fetch_data() to set call->async.

(2) Fix afs_fs_fetch_data() to subtract transferred from len instead of
    adding it.

(3) Fix a UAF when sending a message if the call is completed so quickly
    that the sending code hasn't finished with it when it gets freed.

* patches from https://patch.msgid.link/20260723113452.566619-1-dhowells@redhat.com:
  afs: Fix UAF when sending a message
  afs: Fix afs_fs_fetch_data() to subtract transferred from len
  afs: Fix afs_fs_fetch_data() to set call->async

Link: https://patch.msgid.link/20260723113452.566619-1-dhowells@redhat.com
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>