tree 242c639d1e110f241e802e6b0a27a670deb8b174
parent 80119ef5c8153e0a6cc5edf00c083dc98a9bd348
author NeilBrown <neilb@suse.de> 1211573072 -0700
committer Linus Torvalds <torvalds@linux-foundation.org> 1211648169 -0700

md: fix possible oops when removing a bitmap from an active array

It is possible to add a write-intent bitmap to an active array, or remove
the bitmap that is there.

When we do with the 'quiesce' the array, which causes make_request to
block in "wait_barrier()".

However we are sampling the value of "mddev->bitmap" before the
wait_barrier call, and using it afterwards.  This can result in using a
bitmap structure that has been freed.

Signed-off-by: Neil Brown <neilb@suse.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>