block: check flags of claimed slave bdev to fix uaf for bd_holder_dir

hulk inclusion
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I60QE9
CVE: NA

--------------------------------

As explained in 0eb44012 ("block: fix use after free for
bd_holder_dir"), we should make sure the "disk" is still live and
then grab a reference to 'bd_holder_dir'. However, the "disk"
should be "the claimed slave bdev" rather than "the holding disk".

Fixes: 0eb44012 ("block: fix use after free for bd_holder_dir")
Signed-off-by: NLi Lingfeng <lilingfeng3@huawei.com>
Reviewed-by: NYu Kuai <yukuai3@huawei.com>
Reviewed-by: NJason Yan <yanaijie@huawei.com>
Signed-off-by: NYongqiang Liu <liuyongqiang13@huawei.com>

fs/block_dev.c

@@ -1310,7 +1310,7 @@ int bd_link_disk_holder(struct block_device *bdev, struct gendisk *disk)
 	 * the holder directory.  Hold on to it.
 	 */
 	down_read(&bdev->bd_disk->lookup_sem);
-	if (!(disk->flags & GENHD_FL_UP)) {
+	if (!(bdev->bd_disk->flags & GENHD_FL_UP)) {
 		up_read(&bdev->bd_disk->lookup_sem);
 		return -ENODEV;
 	}