CVE-2026-98961: btrfs: unlock inode and extent in caller when io_uring read extent fails

In the Linux kernel, the following vulnerability has been resolved:

btrfs: unlock inode and extent in caller when iouring read extent fails

btrfsuringreadextent() runs only after btrfsencodedread() has taken the inode shared lock and the extent lock. On failure it used to unlock in outfail, and a pages-array allocation failure returned -ENOMEM without unlocking at all.

Unlock in the caller instead on all failure returns, matching the copytouser() error path. The deferred -EIOCBQUEUED path still unlocks in btrfsuringreadfinished().