
From: NeilBrown <neilb@cse.unsw.edu.au>

As the unplug timer can potentially fire at any time, and and it access
data that is released by the md ->stop function, we need to del_timer_sync
before releasing that data.

Signed-off-by: Neil Brown <neilb@cse.unsw.edu.au>
Signed-off-by: Andrew Morton <akpm@osdl.org>
---

 25-akpm/drivers/md/linear.c    |    1 +
 25-akpm/drivers/md/multipath.c |    1 +
 25-akpm/drivers/md/raid0.c     |    1 +
 25-akpm/drivers/md/raid1.c     |    1 +
 25-akpm/drivers/md/raid10.c    |    1 +
 25-akpm/drivers/md/raid5.c     |    1 +
 25-akpm/drivers/md/raid6main.c |    1 +
 7 files changed, 7 insertions(+)

diff -puN drivers/md/linear.c~md-delete-unplug-timer-before-shutting-down-md-array drivers/md/linear.c
--- 25/drivers/md/linear.c~md-delete-unplug-timer-before-shutting-down-md-array	Wed Nov  3 14:55:00 2004
+++ 25-akpm/drivers/md/linear.c	Wed Nov  3 14:55:00 2004
@@ -231,6 +231,7 @@ static int linear_stop (mddev_t *mddev)
 {
 	linear_conf_t *conf = mddev_to_conf(mddev);
   
+	del_timer_sync(&mddev->queue->unplug_timer); /* the unplug fn references 'conf'*/
 	kfree(conf->hash_table);
 	kfree(conf);
 
diff -puN drivers/md/multipath.c~md-delete-unplug-timer-before-shutting-down-md-array drivers/md/multipath.c
--- 25/drivers/md/multipath.c~md-delete-unplug-timer-before-shutting-down-md-array	Wed Nov  3 14:55:00 2004
+++ 25-akpm/drivers/md/multipath.c	Wed Nov  3 14:55:00 2004
@@ -566,6 +566,7 @@ static int multipath_stop (mddev_t *mdde
 
 	md_unregister_thread(mddev->thread);
 	mddev->thread = NULL;
+	del_timer_sync(&mddev->queue->unplug_timer); /* the unplug fn references 'conf'*/
 	mempool_destroy(conf->pool);
 	kfree(conf->multipaths);
 	kfree(conf);
diff -puN drivers/md/raid0.c~md-delete-unplug-timer-before-shutting-down-md-array drivers/md/raid0.c
--- 25/drivers/md/raid0.c~md-delete-unplug-timer-before-shutting-down-md-array	Wed Nov  3 14:55:00 2004
+++ 25-akpm/drivers/md/raid0.c	Wed Nov  3 14:55:00 2004
@@ -385,6 +385,7 @@ static int raid0_stop (mddev_t *mddev)
 {
 	raid0_conf_t *conf = mddev_to_conf(mddev);
 
+	del_timer_sync(&mddev->queue->unplug_timer); /* the unplug fn references 'conf'*/
 	kfree (conf->hash_table);
 	conf->hash_table = NULL;
 	kfree (conf->strip_zone);
diff -puN drivers/md/raid10.c~md-delete-unplug-timer-before-shutting-down-md-array drivers/md/raid10.c
--- 25/drivers/md/raid10.c~md-delete-unplug-timer-before-shutting-down-md-array	Wed Nov  3 14:55:00 2004
+++ 25-akpm/drivers/md/raid10.c	Wed Nov  3 14:55:00 2004
@@ -1744,6 +1744,7 @@ static int stop(mddev_t *mddev)
 
 	md_unregister_thread(mddev->thread);
 	mddev->thread = NULL;
+	del_timer_sync(&mddev->queue->unplug_timer); /* the unplug fn references 'conf'*/
 	if (conf->r10bio_pool)
 		mempool_destroy(conf->r10bio_pool);
 	if (conf->mirrors)
diff -puN drivers/md/raid1.c~md-delete-unplug-timer-before-shutting-down-md-array drivers/md/raid1.c
--- 25/drivers/md/raid1.c~md-delete-unplug-timer-before-shutting-down-md-array	Wed Nov  3 14:55:00 2004
+++ 25-akpm/drivers/md/raid1.c	Wed Nov  3 14:55:00 2004
@@ -1293,6 +1293,7 @@ static int stop(mddev_t *mddev)
 
 	md_unregister_thread(mddev->thread);
 	mddev->thread = NULL;
+	del_timer_sync(&mddev->queue->unplug_timer); /* the unplug fn references 'conf'*/
 	if (conf->r1bio_pool)
 		mempool_destroy(conf->r1bio_pool);
 	if (conf->mirrors)
diff -puN drivers/md/raid5.c~md-delete-unplug-timer-before-shutting-down-md-array drivers/md/raid5.c
--- 25/drivers/md/raid5.c~md-delete-unplug-timer-before-shutting-down-md-array	Wed Nov  3 14:55:00 2004
+++ 25-akpm/drivers/md/raid5.c	Wed Nov  3 14:55:00 2004
@@ -1707,6 +1707,7 @@ static int stop (mddev_t *mddev)
 	mddev->thread = NULL;
 	shrink_stripes(conf);
 	free_pages((unsigned long) conf->stripe_hashtbl, HASH_PAGES_ORDER);
+	del_timer_sync(&mddev->queue->unplug_timer); /* the unplug fn references 'conf'*/
 	kfree(conf);
 	mddev->private = NULL;
 	return 0;
diff -puN drivers/md/raid6main.c~md-delete-unplug-timer-before-shutting-down-md-array drivers/md/raid6main.c
--- 25/drivers/md/raid6main.c~md-delete-unplug-timer-before-shutting-down-md-array	Wed Nov  3 14:55:00 2004
+++ 25-akpm/drivers/md/raid6main.c	Wed Nov  3 14:55:00 2004
@@ -1878,6 +1878,7 @@ static int stop (mddev_t *mddev)
 	mddev->thread = NULL;
 	shrink_stripes(conf);
 	free_pages((unsigned long) conf->stripe_hashtbl, HASH_PAGES_ORDER);
+	del_timer_sync(&mddev->queue->unplug_timer); /* the unplug fn references 'conf'*/
 	kfree(conf);
 	mddev->private = NULL;
 	return 0;
_
