block: use after free bug in __blkdev_get