gadgetfs: use-after-free in ->aio_read()