ism_stop frees session while CAM/ic_action and sysctl handlers can still dereference it (UAF)

Summary

ism_stop() tears session down in-place: calls ic_lost_target() drops from sc->isc_sess destroy_dev()s cdev uninits all mutexes i_freeopt()s options then sets sc->sessions[sp->sid]=NULL and finally kfree()s sp. CAM ic_action() reads sc->sessions[target_id] and dereferences sp with NO lock and per-session sysctl handlers hold raw sp pointer from arg1 no lifetime guarantee. Window between ic_lost_target() reporting device lost and sc->sessions[sid]=NULL during which CAM ccb or sysctl read can obtain about-to-be-freed sp and dereference it after kfree(). sysctl_ctx_free removes OIDs but does not wait for handlers already executing.