percpu_counter: fix CPU unplug race in percpu_counter_destroy()

We should first delete the counter from percpu_counters list
before freeing memory, or a percpu_counter_hotcpu_callback()
could dereference a NULL pointer.

Signed-off-by: Eric Dumazet <[e-mail]>
Acked-by: David S. Miller <[e-mail]>
Cc: Peter Zijlstra <[e-mail]>
Cc: Mingming Cao <[e-mail]>
Signed-off-by: Andrew Morton <[e-mail]>
Signed-off-by: Linus Torvalds <[e-mail]>

lib/percpu_counter.c

···
 	if (!fbc->counters)
 		return;
 
-	free_percpu(fbc->counters);
-	fbc->counters = NULL;
 #ifdef CONFIG_HOTPLUG_CPU
 	mutex_lock(&percpu_counters_lock);
 	list_del(&fbc->list);
 	mutex_unlock(&percpu_counters_lock);
 #endif
+	free_percpu(fbc->counters);
+	fbc->counters = NULL;
 }
 EXPORT_SYMBOL(percpu_counter_destroy);