[BUG] mtd: use-after-free in blktrans_notify_remove()

[Farhad Alemi]

Hello Miquel Raynal, Richard Weinberger,

While fuzzing Linux 7.1-rc5 with syzkaller, as part of research at ASU's
SEFCOM lab, we hit the crash below. Crash reports can be found here:

  https://github.com/farhad-alemi/public_bug_reports/tree/main/112-mtd-uaf-blktrans_notify_remove/

  ==================================================================
  BUG: KASAN: slab-use-after-free in blktrans_notify_remove+0x8a/0x160
drivers/mtd/mtd_blkdevs.c:451
  Read of size 8 at addr ffff888121a4a208 by task syz.0.894/19075
  CPU: 0 UID: 0 PID: 19075 Comm: syz.0.894 Not tainted 7.1.0-rc5 #1
PREEMPT(full)
  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS
1.16.3-debian-1.16.3-2 04/01/2014
  Call Trace:
  <TASK>
  dump_stack_lvl+0x94/0xd0 lib/dump_stack.c:120
  print_address_description+0x55/0x1e0 mm/kasan/report.c:378

Our reproducer.c is available upon request.

Happy to test a patch if that would help.

Regards,