Merge tag 'md/3.11-fixes' of git://neil.brown.name/md

Pull md fixes from Neil Brown:
 "Two more bugfixes for md in 3.11

  Both marked for -stable, both since 3.3.  I guess I should spend more
  time testing..."

* tag 'md/3.11-fixes' of git://neil.brown.name/md:
  md/raid5: fix interaction of 'replace' and 'recovery'.
  md/raid10: remove use-after-free bug.

3 files changed, 18 insertions, 6 deletions

diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 957a719e8c2f..df7b0a06b0ea 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -2290,12 +2290,18 @@ static void recovery_request_write(struct mddev *mddev, struct r10bio *r10_bio)
         d = r10_bio->devs[1].devnum;
         wbio = r10_bio->devs[1].bio;
         wbio2 = r10_bio->devs[1].repl_bio;
+        /* Need to test wbio2->bi_end_io before we call
+         * generic_make_request as if the former is NULL,
+         * the latter is free to free wbio2.
+         */
+        if (wbio2 && !wbio2->bi_end_io)
+                wbio2 = NULL;
         if (wbio->bi_end_io) {
                 atomic_inc(&conf->mirrors[d].rdev->nr_pending);
                 md_sync_acct(conf->mirrors[d].rdev->bdev, bio_sectors(wbio));
                 generic_make_request(wbio);
         }
-        if (wbio2 && wbio2->bi_end_io) {
+        if (wbio2) {
                 atomic_inc(&conf->mirrors[d].replacement->nr_pending);
                 md_sync_acct(conf->mirrors[d].replacement->bdev,
                              bio_sectors(wbio2));
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 2bf094a587cb..78ea44336e75 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -3462,6 +3462,7 @@ static void handle_stripe(struct stripe_head *sh)
                     test_and_clear_bit(STRIPE_SYNC_REQUESTED, &sh->state)) {
                         set_bit(STRIPE_SYNCING, &sh->state);
                         clear_bit(STRIPE_INSYNC, &sh->state);
+                        clear_bit(STRIPE_REPLACED, &sh->state);
                 }
                 spin_unlock(&sh->stripe_lock);
         }
@@ -3607,19 +3608,23 @@ static void handle_stripe(struct stripe_head *sh)
                         handle_parity_checks5(conf, sh, &s, disks);
         }
 
-        if (s.replacing && s.locked == 0
-            && !test_bit(STRIPE_INSYNC, &sh->state)) {
+        if ((s.replacing || s.syncing) && s.locked == 0
+            && !test_bit(STRIPE_COMPUTE_RUN, &sh->state)
+            && !test_bit(STRIPE_REPLACED, &sh->state)) {
                 /* Write out to replacement devices where possible */
                 for (i = 0; i < conf->raid_disks; i++)
-                        if (test_bit(R5_UPTODATE, &sh->dev[i].flags) &&
-                            test_bit(R5_NeedReplace, &sh->dev[i].flags)) {
+                        if (test_bit(R5_NeedReplace, &sh->dev[i].flags)) {
+                                WARN_ON(!test_bit(R5_UPTODATE, &sh->dev[i].flags));
                                 set_bit(R5_WantReplace, &sh->dev[i].flags);
                                 set_bit(R5_LOCKED, &sh->dev[i].flags);
                                 s.locked++;
                         }
-                set_bit(STRIPE_INSYNC, &sh->state);
+                if (s.replacing)
+                        set_bit(STRIPE_INSYNC, &sh->state);
+                set_bit(STRIPE_REPLACED, &sh->state);
         }
         if ((s.syncing || s.replacing) && s.locked == 0 &&
+            !test_bit(STRIPE_COMPUTE_RUN, &sh->state) &&
             test_bit(STRIPE_INSYNC, &sh->state)) {
                 md_done_sync(conf->mddev, STRIPE_SECTORS, 1);
                 clear_bit(STRIPE_SYNCING, &sh->state);
diff --git a/drivers/md/raid5.h b/drivers/md/raid5.h
index b0b663b119a8..70c49329ca9a 100644
--- a/drivers/md/raid5.h
+++ b/drivers/md/raid5.h
@@ -306,6 +306,7 @@ enum {
         STRIPE_SYNC_REQUESTED,
         STRIPE_SYNCING,
         STRIPE_INSYNC,
+        STRIPE_REPLACED,
         STRIPE_PREREAD_ACTIVE,
         STRIPE_DELAYED,
         STRIPE_DEGRADED,