Merge tag 'md/4.1-rc4-fixes' of git://neil.brown.name/md

Pull md bugfixes from Neil Brown:
 "I have a few more raid5 bugfixes pending, but I want them to get a bit
  more review first.  In the meantime:

   - one serious RAID0 data corruption - caused by recent bugfix that
     wasn't reviewed properly.

   - one raid5 fix in new code (a couple more of those to come).

   - one little fix to stop static analysis complaining about silly rcu
     annotation"

* tag 'md/4.1-rc4-fixes' of git://neil.brown.name/md:
  md/bitmap: remove rcu annotation from pointer arithmetic.
  md/raid0: fix restore to sector variable in raid0_make_request
  raid5: fix broken async operation chain

3 files changed, 10 insertions, 3 deletions

diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c
index 2bc56e2a3526..135a0907e9de 100644
--- a/drivers/md/bitmap.c
+++ b/drivers/md/bitmap.c
@@ -177,11 +177,16 @@ static struct md_rdev *next_active_rdev(struct md_rdev *rdev, struct mddev *mdde
          * nr_pending is 0 and In_sync is clear, the entries we return will
          * still be in the same position on the list when we re-enter
          * list_for_each_entry_continue_rcu.
+         *
+         * Note that if entered with 'rdev == NULL' to start at the
+         * beginning, we temporarily assign 'rdev' to an address which
+         * isn't really an rdev, but which can be used by
+         * list_for_each_entry_continue_rcu() to find the first entry.
          */
         rcu_read_lock();
         if (rdev == NULL)
                 /* start at the beginning */
-                rdev = list_entry_rcu(&mddev->disks, struct md_rdev, same_set);
+                rdev = list_entry(&mddev->disks, struct md_rdev, same_set);
         else {
                 /* release the previous rdev and start from there. */
                 rdev_dec_pending(rdev, mddev);
diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c
index 6a68ef5246d4..efb654eb5399 100644
--- a/drivers/md/raid0.c
+++ b/drivers/md/raid0.c
@@ -524,6 +524,9 @@ static void raid0_make_request(struct mddev *mddev, struct bio *bio)
                          ? (sector & (chunk_sects-1))
                          : sector_div(sector, chunk_sects));
 
+                /* Restore due to sector_div */
+                sector = bio->bi_iter.bi_sector;
+
                 if (sectors < bio_sectors(bio)) {
                         split = bio_split(bio, sectors, GFP_NOIO, fs_bio_set);
                         bio_chain(split, bio);
@@ -531,7 +534,6 @@ static void raid0_make_request(struct mddev *mddev, struct bio *bio)
                         split = bio;
                 }
 
-                sector = bio->bi_iter.bi_sector;
                 zone = find_zone(mddev->private, &sector);
                 tmp_dev = map_sector(mddev, zone, sector, &sector);
                 split->bi_bdev = tmp_dev->bdev;
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 1ba97fdc6df1..b9f2b9cc6060 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -1822,7 +1822,7 @@ again:
         } else
                 init_async_submit(&submit, 0, tx, NULL, NULL,
                                   to_addr_conv(sh, percpu, j));
-        async_gen_syndrome(blocks, 0, count+2, STRIPE_SIZE,  &submit);
+        tx = async_gen_syndrome(blocks, 0, count+2, STRIPE_SIZE,  &submit);
         if (!last_stripe) {
                 j++;
                 sh = list_first_entry(&sh->batch_list, struct stripe_head,