Kernel crash via split-bio error-path double free

Use-after-free in the Btrfs I/O path in affected Linux releases allows local users to crash the kernel through split read bio errors. In btrfs_submit_chunk(), a mapping failure on the second half of a split read bio calls btrfs_bio_end_io(), whose original end handler frees the parent bio while the submitted first half still references its iterator. Reachability requires local file I/O on a mounted Btrfs filesystem, a bio crossing stripes, and a later mapping error; the resulting stale access or second free corrupts kernel memory and crashes the system.