fuse: fix page dereference after free

After unlock_request() pages from the ap->pages[] array may be put (e.g. by
aborting the connection) and the pages can be freed.

Prevent use after free by grabbing a reference to the page before calling
unlock_request().

The original patch was created by Pradeep P V K.

Change-Id: I895fe861028b40a1930b9600436ef6d34c02d7c3
Reported-by: Pradeep P V K <ppvk@codeaurora.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Patch-mainline: linux-fsdevel@vger.kernel.org @ 14/09/2020, 13:41
Signed-off-by: Pradeep P V K <ppvk@codeaurora.org>