In the Linux kernel, the following vulnerability has been resolved:
block: don't call rqqosops->done_bio if the bio isn't tracked
rq_qos framework is only applied on request based driver, so:
1) rqqosdone_bio() needn't to be called for bio based driver
2) rqqosdone_bio() needn't to be called for bio which isn't tracked, such as bios ended from error handling code.
Especially in bio_endio():
1) request queue is referred via bio->bibdev->bddisk->queue, which may be gone since request queue refcount may not be held in above two cases
2) q->rqqos may be freed in blkcleanupqueue() when calling into _rqqosdone_bio()
Fix the potential kernel panic by not calling rqqosops->donebio if the bio isn't tracked. This way is safe because both iocrqosdonebio() and blkcgiolatencydone_bio() are nop if the bio isn't tracked.