iomap: fix a use after free in iomap_dio_rw

	loff_t pos = iocb->ki_pos, start = pos;

	loff_t end = iocb->ki_pos + count - 1, ret = 0;

	unsigned int flags = IOMAP_DIRECT;

	bool wait_for_completion = is_sync_kiocb(iocb);

	struct blk_plug plug;

	struct iomap_dio *dio;

	dio->end_io = end_io;

	dio->error = 0;

	dio->flags = 0;

	dio->wait_for_completion = is_sync_kiocb(iocb);

	dio->submit.iter = iter;

	dio->submit.waiter = current;

		dio_warn_stale_pagecache(iocb->ki_filp);

	ret = 0;

	if (iov_iter_rw(iter) == WRITE && !dio->wait_for_completion &&

	if (iov_iter_rw(iter) == WRITE && !wait_for_completion &&

	    !inode->i_sb->s_dio_done_wq) {

		ret = sb_init_dio_done_wq(inode->i_sb);

		if (ret < 0)

		if (ret <= 0) {

			/* magic error code to fall back to buffered I/O */

			if (ret == -ENOTBLK) {

				dio->wait_for_completion = true;

				wait_for_completion = true;

				ret = 0;

			}

			break;

	if (dio->flags & IOMAP_DIO_WRITE_FUA)

		dio->flags &= ~IOMAP_DIO_NEED_SYNC;

	/*

	 * We are about to drop our additional submission reference, which

	 * might be the last reference to the dio.  There are three three

	 * different ways we can progress here:

	 *

	 *  (a) If this is the last reference we will always complete and free

	 *	the dio ourselves.

	 *  (b) If this is not the last reference, and we serve an asynchronous

	 *	iocb, we must never touch the dio after the decrement, the

	 *	I/O completion handler will complete and free it.

	 *  (c) If this is not the last reference, but we serve a synchronous

	 *	iocb, the I/O completion handler will wake us up on the drop

	 *	of the final reference, and we will complete and free it here

	 *	after we got woken by the I/O completion handler.

	 */

	dio->wait_for_completion = wait_for_completion;

	if (!atomic_dec_and_test(&dio->ref)) {

		if (!dio->wait_for_completion)

		if (!wait_for_completion)

			return -EIOCBQUEUED;

		for (;;) {

		__set_current_state(TASK_RUNNING);

	}

	ret = iomap_dio_complete(dio);

	return ret;

	return iomap_dio_complete(dio);

out_free_dio:

	kfree(dio);