block, bfq: fix uaf for bfqq in bic_set_bfqq()