ipc/msg.c: fix percpu_counter use after free

These percpu counters are referenced in free_ipcs->freeque, so destroy
them later.

Fixes: 72d1e611

 ("ipc/msg: mitigate the lock contention with percpu counter")
Reported-by:  <syzbot+96e659d35b9d6b541152@syzkaller.appspotmail.com>
Tested-by: Mark Rutland <mark.rutland@arm.com>
Cc: Jiebin Sun <jiebin.sun@intel.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>