md/raid5-cache: fix null-ptr-deref for r5l_flush_stripe_to_raid()

In the Linux kernel, the following vulnerability has been resolved:

md/raid5-cache: fix null-ptr-deref for r5l_flush_stripe_to_raid()

r5l_flush_stripe_to_raid() will check if the list 'flushing_ios' is

empty, and then submit 'flush_bio', however, r5l_log_flush_endio()

is clearing the list first and then clear the bio, which will cause

null-ptr-deref:

T1: submit flush io

raid5d

handle_active_stripes

r5l_flush_stripe_to_raid

// list is empty

// add 'io_end_ios' to the list

bio_init

submit_bio

// io1

T2: io1 is done

r5l_log_flush_endio

list_splice_tail_init

// clear the list

T3: submit new flush io

...

r5l_flush_stripe_to_raid

// list is empty

// add 'io_end_ios' to the list

bio_init

bio_uninit

// clear bio->bi_blkg

submit_bio

// null-ptr-deref

Fix this problem by clearing bio before clearing the list in

r5l_log_flush_endio().