[PATCH 6.8 052/336] Fix a potential infinite loop in extract_user_to_sg()