From: NeilBrown As the unplug timer can potentially fire at any time, and and it access data that is released by the md ->stop function, we need to del_timer_sync before releasing that data. Signed-off-by: Neil Brown Signed-off-by: Andrew Morton --- 25-akpm/drivers/md/linear.c | 1 + 25-akpm/drivers/md/multipath.c | 1 + 25-akpm/drivers/md/raid0.c | 1 + 25-akpm/drivers/md/raid1.c | 1 + 25-akpm/drivers/md/raid10.c | 1 + 25-akpm/drivers/md/raid5.c | 1 + 25-akpm/drivers/md/raid6main.c | 1 + 7 files changed, 7 insertions(+) diff -puN drivers/md/linear.c~md-delete-unplug-timer-before-shutting-down-md-array drivers/md/linear.c --- 25/drivers/md/linear.c~md-delete-unplug-timer-before-shutting-down-md-array Wed Nov 3 14:55:00 2004 +++ 25-akpm/drivers/md/linear.c Wed Nov 3 14:55:00 2004 @@ -231,6 +231,7 @@ static int linear_stop (mddev_t *mddev) { linear_conf_t *conf = mddev_to_conf(mddev); + del_timer_sync(&mddev->queue->unplug_timer); /* the unplug fn references 'conf'*/ kfree(conf->hash_table); kfree(conf); diff -puN drivers/md/multipath.c~md-delete-unplug-timer-before-shutting-down-md-array drivers/md/multipath.c --- 25/drivers/md/multipath.c~md-delete-unplug-timer-before-shutting-down-md-array Wed Nov 3 14:55:00 2004 +++ 25-akpm/drivers/md/multipath.c Wed Nov 3 14:55:00 2004 @@ -566,6 +566,7 @@ static int multipath_stop (mddev_t *mdde md_unregister_thread(mddev->thread); mddev->thread = NULL; + del_timer_sync(&mddev->queue->unplug_timer); /* the unplug fn references 'conf'*/ mempool_destroy(conf->pool); kfree(conf->multipaths); kfree(conf); diff -puN drivers/md/raid0.c~md-delete-unplug-timer-before-shutting-down-md-array drivers/md/raid0.c --- 25/drivers/md/raid0.c~md-delete-unplug-timer-before-shutting-down-md-array Wed Nov 3 14:55:00 2004 +++ 25-akpm/drivers/md/raid0.c Wed Nov 3 14:55:00 2004 @@ -385,6 +385,7 @@ static int raid0_stop (mddev_t *mddev) { raid0_conf_t *conf = mddev_to_conf(mddev); + del_timer_sync(&mddev->queue->unplug_timer); /* the unplug fn references 'conf'*/ kfree (conf->hash_table); conf->hash_table = NULL; kfree (conf->strip_zone); diff -puN drivers/md/raid10.c~md-delete-unplug-timer-before-shutting-down-md-array drivers/md/raid10.c --- 25/drivers/md/raid10.c~md-delete-unplug-timer-before-shutting-down-md-array Wed Nov 3 14:55:00 2004 +++ 25-akpm/drivers/md/raid10.c Wed Nov 3 14:55:00 2004 @@ -1744,6 +1744,7 @@ static int stop(mddev_t *mddev) md_unregister_thread(mddev->thread); mddev->thread = NULL; + del_timer_sync(&mddev->queue->unplug_timer); /* the unplug fn references 'conf'*/ if (conf->r10bio_pool) mempool_destroy(conf->r10bio_pool); if (conf->mirrors) diff -puN drivers/md/raid1.c~md-delete-unplug-timer-before-shutting-down-md-array drivers/md/raid1.c --- 25/drivers/md/raid1.c~md-delete-unplug-timer-before-shutting-down-md-array Wed Nov 3 14:55:00 2004 +++ 25-akpm/drivers/md/raid1.c Wed Nov 3 14:55:00 2004 @@ -1293,6 +1293,7 @@ static int stop(mddev_t *mddev) md_unregister_thread(mddev->thread); mddev->thread = NULL; + del_timer_sync(&mddev->queue->unplug_timer); /* the unplug fn references 'conf'*/ if (conf->r1bio_pool) mempool_destroy(conf->r1bio_pool); if (conf->mirrors) diff -puN drivers/md/raid5.c~md-delete-unplug-timer-before-shutting-down-md-array drivers/md/raid5.c --- 25/drivers/md/raid5.c~md-delete-unplug-timer-before-shutting-down-md-array Wed Nov 3 14:55:00 2004 +++ 25-akpm/drivers/md/raid5.c Wed Nov 3 14:55:00 2004 @@ -1707,6 +1707,7 @@ static int stop (mddev_t *mddev) mddev->thread = NULL; shrink_stripes(conf); free_pages((unsigned long) conf->stripe_hashtbl, HASH_PAGES_ORDER); + del_timer_sync(&mddev->queue->unplug_timer); /* the unplug fn references 'conf'*/ kfree(conf); mddev->private = NULL; return 0; diff -puN drivers/md/raid6main.c~md-delete-unplug-timer-before-shutting-down-md-array drivers/md/raid6main.c --- 25/drivers/md/raid6main.c~md-delete-unplug-timer-before-shutting-down-md-array Wed Nov 3 14:55:00 2004 +++ 25-akpm/drivers/md/raid6main.c Wed Nov 3 14:55:00 2004 @@ -1878,6 +1878,7 @@ static int stop (mddev_t *mddev) mddev->thread = NULL; shrink_stripes(conf); free_pages((unsigned long) conf->stripe_hashtbl, HASH_PAGES_ORDER); + del_timer_sync(&mddev->queue->unplug_timer); /* the unplug fn references 'conf'*/ kfree(conf); mddev->private = NULL; return 0; _