2 files changed, 16 insertions, 1 deletions

diff --git a/drivers/md/md.c b/drivers/md/md.c
index 2a9b6a07e3a2..509171ca7fa8 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -1378,6 +1378,12 @@ static int bind_rdev_to_array(mdk_rdev_t * rdev, mddev_t * mddev)
         return err;
 }
 
+static void delayed_delete(struct work_struct *ws)
+{
+        mdk_rdev_t *rdev = container_of(ws, mdk_rdev_t, del_work);
+        kobject_del(&rdev->kobj);
+}
+
 static void unbind_rdev_from_array(mdk_rdev_t * rdev)
 {
         char b[BDEVNAME_SIZE];
@@ -1390,7 +1396,12 @@ static void unbind_rdev_from_array(mdk_rdev_t * rdev)
         printk(KERN_INFO "md: unbind<%s>\n", bdevname(rdev->bdev,b));
         rdev->mddev = NULL;
         sysfs_remove_link(&rdev->kobj, "block");
-        kobject_del(&rdev->kobj);
+
+        /* We need to delay this, otherwise we can deadlock when
+         * writing to 'remove' to "dev/state"
+         */
+        INIT_WORK(&rdev->del_work, delayed_delete);
+        schedule_work(&rdev->del_work);
 }
 
 /*
@@ -3389,6 +3400,9 @@ static int do_md_stop(mddev_t * mddev, int mode)
                                 sysfs_remove_link(&mddev->kobj, nm);
                         }
 
+                /* make sure all delayed_delete calls have finished */
+                flush_scheduled_work();
+
                 export_array(mddev);
 
                 mddev->array_size = 0;
diff --git a/include/linux/raid/md_k.h b/include/linux/raid/md_k.h
index 8245c282168b..de72c49747c8 100644
--- a/include/linux/raid/md_k.h
+++ b/include/linux/raid/md_k.h
@@ -104,6 +104,7 @@ struct mdk_rdev_s
                                            * for reporting to userspace and storing
                                            * in superblock.
                                            */
+        struct work_struct del_work;    /* used for delayed sysfs removal */
 };
 
 struct mddev_s