The wait_event() in there can touch the memory at *transaction after
kjournald has freed it.

Rework the code to not wait until the transaction enters T_FLUSH state: just
loop back and try against after the wakeup.