There's a problem in 9p's interaction with netfslib whereby a crash occurs
because the 9p_fid structs get forcibly destroyed during client teardown
(without paying attention to their refcounts) before netfslib has finished
with them.  However, it's not a simple case of deferring the clunking that
p9_fid_put() does as that requires the p9_client record to still be
present.

The problem is that netfslib has to unlock pages and clear the IN_PROGRESS
flag before destroying the objects involved - including the fid - and, in
any case, nothing checks to see if writeback completed barring looking at
the page flags.

Fix this by keeping a count of outstanding I/O requests (of any type) and
waiting for it to quiesce during inode eviction.

Reported-by:  <syzbot+df038d463cca332e8414@syzkaller.appspotmail.com>
Link: https://lore.kernel.org/all/0000000000005be0aa061846f8d6@google.com/


Reported-by:  <syzbot+d7c7a495a5e466c031b6@syzkaller.appspotmail.com>
Link: h...