[BUG]
There is a possible use-after-free bug when running generic/095.

  BUG: Unable to handle kernel data access on write at 0x6b6b6b6b6b6b725b
  Faulting instruction address: 0xc000000000283654
  c000000000283078 do_raw_spin_unlock+0x88/0x230
  c0000000012b1e14 _raw_spin_unlock_irqrestore+0x44/0x90
  c000000000a918dc btrfs_subpage_clear_writeback+0xac/0xe0
  c0000000009e0458 end_bio_extent_writepage+0x158/0x270
  c000000000b6fd14 bio_endio+0x254/0x270
  c0000000009fc0f0 btrfs_end_bio+0x1a0/0x200
  c000000000b6fd14 bio_endio+0x254/0x270
  c000000000b781fc blk_update_request+0x46c/0x670
  c000000000b8b394 blk_mq_end_request+0x34/0x1d0
  c000000000d82d1c lo_complete_rq+0x11c/0x140
  c000000000b880a4 blk_complete_reqs+0x84/0xb0
  c0000000012b2ca4 __do_softirq+0x334/0x680
  c0000000001dd878 irq_exit+0x148/0x1d0
  c000000000016f4c do_IRQ+0x20c/0x240
  c000000000009240 hardware_interrupt_common_virt+0x1b0/0x1c0

[CAUSE]
There is very small race window like the following in generic/095.

	Thread 1		|		Thread 2
--------------------------------+------------------------------------
   end_bio_extent_writepage()	| btrfs_releasepage()
   |- spin_lock_irqsave()	| |
   |- end_page_writeback()	| |
   |				| |- if (PageWriteback() ||...)
   |				| |- clear_page_extent_mapped()
   |				|    |- kfree(subpage);
   |- spin_unlock_irqrestore().

The race can also happen between writeback and btrfs_invalidatepage(),
although that would be much harder as btrfs_invalidatepage() has much
more work to do before the clear_page_extent_mapped() call.

[FIX]
For btrfs_subpage_clear_writeback(), we don't really need to put
end_page_writepage() call into the spinlock critical section.

By just checking the bitmap in the critical section and call
end_page_writeback() outside of the critical section, we can avoid such
use-after-free bug.

Reported-by: Ritesh Harjani <redacted>
Tested-by: Ritesh Harjani <redacted>
Signed-off-by: Qu Wenruo <redacted>
---
  fs/btrfs/subpage.c | 5 ++++-
  1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/fs/btrfs/subpage.c b/fs/btrfs/subpage.c
index 696485ab68a2..c5abf9745c10 100644
--- a/fs/btrfs/subpage.c
+++ b/fs/btrfs/subpage.c

@@ -420,13 +420,16 @@ void btrfs_subpage_clear_writeback(const struct btrfs_fs_info *fs_info,
  {
  	struct btrfs_subpage *subpage = (struct btrfs_subpage *)page->private;
  	u16 tmp = btrfs_subpage_calc_bitmap(fs_info, page, start, len);
+	bool finished = false;
  	unsigned long flags;
  
  	spin_lock_irqsave(&subpage->lock, flags);
  	subpage->writeback_bitmap &= ~tmp;
  	if (subpage->writeback_bitmap == 0)
-		end_page_writeback(page);
+		finished = true;
  	spin_unlock_irqrestore(&subpage->lock, flags);
+	if (finished)
+		end_page_writeback(page);