use-after-free access in bt_iter()

[pragalla@codeaurora.org]

Hi Jens, Bart,

This is with regards to use-after-free access in bt_iter().
i saw this got discussed and reported on many separate threads but could 
see
more discussions and conversations over the solution was made on [1]
as pointed in [2].

[1] 
https://lore.kernel.org/linux-block/1545261885.185366.488.camel@acm.org/
[2] https://lkml.org/lkml/2019/2/14/942

A similar issue was reported again on 5.4 kernel during internal 
stability testing.

<2> Unable to handle kernel paging request at virtual address 
ffffff8107929600
<2> Mem abort info:
<2>   ESR = 0x96000007
<2>   EC = 0x25: DABT (current EL), IL = 32 bits
<2>   SET = 0, FnV = 0
<2>   EA = 0, S1PTW = 0
<2> Data abort info:
<2>   ISV = 0, ISS = 0x00000007
<2>   CM = 0, WnR = 0
<2> swapper pgtable: 4k pages, 39-bit VAs, pgdp=00000000a2603000
<2> [ffffff8107929600] pgd=00000001bf909003, pud=00000001bf909003, 
pmd=00000001bf8cc003, pte=0068000187929f12
<2> Internal error: Oops: 96000007 [#1] PREEMPT SMP
<2> Skip md ftrace buffer dump for: 0x1609e0

<2> CPU: 0 PID: 220 Comm: kworker/0:1H Tainted: G S      W  O      
5.4.61-qgki-debug-g85faaf6 #2
<2> Workqueue: kblockd blk_mq_timeout_work
<2> pstate: 20c00005 (nzCv daif +PAN +UAO)
<2> pc : bt_for_each+0x114/0x1a4
<2> lr : bt_for_each+0xe0/0x1a4
<2> sp : ffffffc017f7bc60
<2> x29: ffffffc017f7bc80 x28: 0000000000000001
<2> x27: 0000000000000008 x26: 0000000000000001
<2> x25: 0000000000000001 x24: 0000000000000008
<2> x23: ffffff8107bcd800 x22: ffffff810872bd10
<2> x21: ffffffd764e6ea50 x20: 0000000000000008
<2> x19: 0000000000000000 x18: ffffffc017f51030
<2> x17: 0000000005f5e100 x16: 0000000000000000
<2> x15: ffffffffff84bf5c x14: 0000000000000598
<2> x13: 0000000000000008 x12: 00000000212d4a53
<2> x11: 00000000000000ff x10: 0000000000000000
<2> x9 : ffffff810872cd00 x8 : 0000000000000009
<2> x7 : 0000000000000000 x6 : ffffffd763890758
<2> x5 : 0000000000000000 x4 : 0000000000000000
<2> x3 : ffffffc017f7bd20 x2 : 0000000000000001
<2> x1 : ffffff8107929600 x0 : 0000000000000001
<2> Call trace:
<2>  bt_for_each+0x114/0x1a4
<2>  blk_mq_queue_tag_busy_iter+0xd8/0x1a4
<2>  blk_mq_timeout_work+0xd4/0x1c0
<2>  process_one_work+0x280/0x460
<2>  worker_thread+0x27c/0x4dc
<2>  kthread+0x160/0x170
<2>  ret_from_fork+0x10/0x18

Is this issue got fixed on any latest kernel ? if so, can you please 
help point the patch ?
If not got fixed, can we have a final solution ? i can even help in 
testing the solution.

Thanks and Regards,
Pradeep