[PATCH] Fix use-after-free with log and quotas

[Lachlan McIlroy <lachlan@xxxxxxx>]

Destroying the quota stuff on unmount can access the log - ie XFS_QM_DONE()
ends up in xfs_dqunlock() which calls xfs_trans_unlocked_item() and then
xfs_log_move_tail().  By this time the log has already been destroyed.
Just move the cleanup of the quota code earlier in xfs_unmountfs() before
the call to xfs_log_unmount().  Moving XFS_QM_DONE() up near
XFS_QM_DQPURGEALL() seems like a good spot.

--- a/fs/xfs/xfs_mount.c        2008-09-12 18:24:09.000000000 +1000
+++ b/fs/xfs/xfs_mount.c        2008-09-12 18:31:22.000000000 +1000
@@ -1245,6 +1245,9 @@ xfs_unmountfs(

        XFS_QM_DQPURGEALL(mp, XFS_QMOPT_QUOTALL | XFS_QMOPT_UMOUNTING);

+       if (mp->m_quotainfo)
+               XFS_QM_DONE(mp);
+
        /*
         * Flush out the log synchronously so that we know for sure
         * that nothing is pinned.  This is important because bflush()
@@ -1297,8 +1300,6 @@ xfs_unmountfs(
        xfs_errortag_clearall(mp, 0);
#endif
        xfs_free_perag(mp);
-       if (mp->m_quotainfo)
-               XFS_QM_DONE(mp);
}

STATIC void