CVE-2026-98443: xfs: fix cursor and pointer handling when recovering iunlink buckets

In the Linux kernel, the following vulnerability has been resolved:

xfs: fix cursor and pointer handling when recovering iunlink buckets

LOLLM pointed out a bug in xlogrecoveriunlinkbucket:

1. We don't null out previp after releasing it, which can lead to UAF problems if the inodegc flush call in the loop fails.

at which point I noticed even more bugs:

2. If the inodegc flush inside the loop fails, we also leak @ip.

3. We set prevagino to agino having already advanced agino, which results in inodes with iprevunlinked set to itself.

4. If we exit the bottom of the loop with previp set, then previp aliases ip and we also set its iprevunlinked to itself.

Bugs 3 and 4 introduce loops into the unlinked list, though these loops don't surface because we immediately flush each unlinked inode after loading it.

Fix all of these issues.