btrfs: fix use-after-free of cmp workspace pages