ext4: wait for log to commit when umounting

There is a potential race when a transaction is committing right when
the file system is being umounting.  This could reduce in a race
because EXT4_SB(sb)->s_group_info could be freed in ext4_put_super
before the commit code calls a callback so the mballoc code can
release freed blocks in the transaction, resulting in a panic trying
to access the freed s_group_info.

The fix is to wait for the transaction to finish committing before we
shutdown the multiblock allocator.  

Signed-off-by: Josef Bacik <josef@redhat.com>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>

1 files changed, 6 insertions, 4 deletions

diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 30476daf966e..8ab0c9518473 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -603,10 +603,6 @@ static void ext4_put_super(struct super_block *sb)
         if (sb->s_dirt)
                 ext4_commit_super(sb, 1);
 
-        ext4_release_system_zone(sb);
-        ext4_mb_release(sb);
-        ext4_ext_release(sb);
-        ext4_xattr_put_super(sb);
         if (sbi->s_journal) {
                 err = jbd2_journal_destroy(sbi->s_journal);
                 sbi->s_journal = NULL;
@@ -614,6 +610,12 @@ static void ext4_put_super(struct super_block *sb)
                         ext4_abort(sb, __func__,
                                    "Couldn't clean up the journal");
         }
+
+        ext4_release_system_zone(sb);
+        ext4_mb_release(sb);
+        ext4_ext_release(sb);
+        ext4_xattr_put_super(sb);
+
         if (!(sb->s_flags & MS_RDONLY)) {
                 EXT4_CLEAR_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_RECOVER);
                 es->s_state = cpu_to_le16(sbi->s_mount_state);