blk-mq: don't grab rq's refcount in blk_mq_check_expired()

	unsigned long *next = priv;

	/*

	 * Just do a quick check if it is expired before locking the request in

	 * so we're not unnecessarilly synchronizing across CPUs.

	 */

	if (!blk_mq_req_expired(rq, next))

		return true;

	/*

	 * We have reason to believe the request may be expired. Take a

	 * reference on the request to lock this request lifetime into its

	 * currently allocated context to prevent it from being reallocated in

	 * the event the completion by-passes this timeout handler.

	 *

	 * If the reference was already released, then the driver beat the

	 * timeout handler to posting a natural completion.

	 */

	if (!refcount_inc_not_zero(&rq->ref))

		return true;

	/*

	 * The request is now locked and cannot be reallocated underneath the

	 * timeout handler's processing. Re-verify this exact request is truly

	 * expired; if it is not expired, then the request was completed and

	 * reallocated as a new request.

	 * blk_mq_queue_tag_busy_iter() has locked the request, so it cannot

	 * be reallocated underneath the timeout handler's processing, then

	 * the expire check is reliable. If the request is not expired, then

	 * it was completed and reallocated as a new request after returning

	 * from blk_mq_check_expired().

	 */

	if (blk_mq_req_expired(rq, next))

		blk_mq_rq_timed_out(rq, reserved);

	blk_mq_put_rq_ref(rq);

	return true;

}