BACKPORT: block, bfq: fix UAF problem in bfqg_stats_init()

In bfq_pd_alloc(), the function bfqg_stats_init() init bfqg. If
blkg_rwstat_init() init bfqg_stats->bytes successful and init
bfqg_stats->ios failed, bfqg_stats_init() return failed, bfqg will
be freed. But blkg_rwstat->cpu_cnt is not deleted from the list of
percpu_counters. If we traverse the list of percpu_counters, It will
have UAF problem.

we should use blkg_rwstat_exit() to cleanup bfqg_stats bytes in the
above scenario.

Bug: 318099414
Bug: 314504138
Bug: 390545368
Fixes: commit fd41e603 ("bfq-iosched: stop using blkg->stat_bytes and ->stat_ios")
Signed-off-by: Zheng Liang <zhengliang6@huawei.com>
Acked-by: Tejun Heo <tj@kernel.org>
Link: https://lore.kernel.org/r/20211018024225.1493938-1-zhengliang6@huawei.com


Signed-off-by: Jens Axboe <axboe@kernel.dk>
(cherry picked from commit 2fc428f6)
Change-Id: I5f000d1ccbad4a4c0b3ed73187c82e375397c741
Signed-off-by: Bart Van Assche <bvanassche@google.com>
(cherry picked from commit bf2bb8a4)
(cherry picked from commit 84b45753)