[PATCH 6.6 054/301] Fix a potential infinite loop in extract_user_to_sg()