kmod: fix span refcount leaks around ternfs_unlink_span

[stevephodgson]

Summary

This PR is three commits that fix different bugs in and around ternfs_unlink_span(). They are in one PR merely because stacked changes in github suck.

Fix 1: Clarify contract of ternfs_unlink_span()

ternfs_unlink_span() here dropped a single reference while both of its callers held
two: one owned by the span cache (the rb-tree) and one owned by the caller. The
two callers disagreed about which one that put covered.

ternfs_get_span() hereexpected its own reference to survive. It looks the span up
and takes a reference under __lock:

  struct ternfs_span* span = lookup_span(&spans->__spans, offset);
  if (likely(span != NULL)) {
    atomic_inc(&span->refcount);
  }

and then, if the span has expired, unlinks it and sets span = NULL. Nothing in
that block consumes the reference it just took, and it cannot have expected
ternfs_unlink_span() to consume it: that would free the object while span was
still a live pointer. So the caller's reference was simply dropped on the floor.

Meanwhile, file_readpage() here expected the opposite. Its

                span = NULL; // unlink already reduced refcount

cleared the pointer so that the puts at the retry label and at out: would not
double free. That is self-consistent, but it leaks the cache's reference
instead, and since the span is off the rb-tree by then ternfs_free_file_spans()
cannot reclaim it at inode eviction either.

This PR gives ternfs_unlink_span() one unambiguous contract: it drops only the reference
held by the span cache, and the caller keeps its own. Move the put inside the
RB_EMPTY_NODE check while we are here -- the unconditional put was also a latent
double put, since a thread which lost a race to unlink the same span skipped the
rb_erase() but still dropped a reference it did not own. Then fix the callers to
match: ternfs_get_span() puts its own reference, and file_readpage() keeps its
pointer so the put at the retry label runs.

Fix 2: don't leak the span on a misaligned span in file_readpage

Simple error path fix

Fix 3: kmod: don't leak the span when readahead can't allocate pages

Simple error path fix