ublk: fix use-after-free in ublk_partition_scan_work

In the Linux kernel, the following vulnerability has been resolved:

ublk: fix use-after-free in ublk_partition_scan_work

A race condition exists between the async partition scan work and device

teardown that can lead to a use-after-free of ub->ub_disk:

1. ublk_ctrl_start_dev() schedules partition_scan_work after add_disk()

2. ublk_stop_dev() calls ublk_stop_dev_unlocked() which does:

- del_gendisk(ub->ub_disk)

- ublk_detach_disk() sets ub->ub_disk = NULL

- put_disk() which may free the disk

3. The worker ublk_partition_scan_work() then dereferences ub->ub_disk

leading to UAF

Fix this by using ublk_get_disk()/ublk_put_disk() in the worker to hold

a reference to the disk during the partition scan. The spinlock in

ublk_get_disk() synchronizes with ublk_detach_disk() ensuring the worker

either gets a valid reference or sees NULL and exits early.

Also change flush_work() to cancel_work_sync() to avoid running the

partition scan work unnecessarily when the disk is already detached.