md: flush ->event_work before stopping array.

commit ee5d004fd0591536a061451eba2b187092e9127c upstream.

The 'event_work' worker used by dm-raid may still be running
when the array is stopped.  This can result in an oops.

So flush the workqueue on which it is run after detaching
and before destroying the device.

Reported-by: Heinz Mauelshagen <heinzm@redhat.com>
Signed-off-by: NeilBrown <neilb@suse.com>
Fixes: 9d09e663d550 ("dm: raid456 basic support")
[lizf: Backported to 3.4: adjust context]
Signed-off-by: Zefan Li <lizefan@huawei.com>

diff --git a/drivers/md/md.c b/drivers/md/md.c
index 25f0cb59ebf0725aca7a07ce23d9fa2396b1855e..a875348e819e344429a4b52726a500eb8ba8adb2 100644 (file)
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -5127,6 +5127,8 @@ static void __md_stop(struct mddev *mddev)
        if (mddev->pers->sync_request && mddev->to_remove == NULL)
                mddev->to_remove = &md_redundancy_group;
        module_put(mddev->pers->owner);
+       /* Ensure ->event_work is done */
+       flush_workqueue(md_misc_wq);
        mddev->pers = NULL;
        clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
 }