From: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>

ioctx_alloc() leaks an mm->mm_count ref on an error path.