2 files changed, 17 insertions, 10 deletions

diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index 32323f0afd89..f4622dd8fc59 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -1099,12 +1099,11 @@ read_again:
                 bio_list_add(&conf->pending_bio_list, mbio);
                 spin_unlock_irqrestore(&conf->device_lock, flags);
         }
-        r1_bio_write_done(r1_bio);
-
-        /* In case raid1d snuck in to freeze_array */
-        wake_up(&conf->wait_barrier);
-
+        /* Mustn't call r1_bio_write_done before this next test,
+         * as it could result in the bio being freed.
+         */
         if (sectors_handled < (bio->bi_size >> 9)) {
+                r1_bio_write_done(r1_bio);
                 /* We need another r1_bio.  It has already been counted
                  * in bio->bi_phys_segments
                  */
@@ -1117,6 +1116,11 @@ read_again:
                 goto retry_write;
         }
 
+        r1_bio_write_done(r1_bio);
+
+        /* In case raid1d snuck in to freeze_array */
+        wake_up(&conf->wait_barrier);
+
         if (do_sync || !bitmap || !plugged)
                 md_wakeup_thread(mddev->thread);
 
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index f6873fc8e5ee..d7a8468ddeab 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -1132,13 +1132,12 @@ retry_write:
                 spin_unlock_irqrestore(&conf->device_lock, flags);
         }
 
-        /* Remove the bias on 'remaining' */
-        one_write_done(r10_bio);
-
-        /* In case raid10d snuck in to freeze_array */
-        wake_up(&conf->wait_barrier);
+        /* Don't remove the bias on 'remaining' (one_write_done) until
+         * after checking if we need to go around again.
+         */
 
         if (sectors_handled < (bio->bi_size >> 9)) {
+                one_write_done(r10_bio);
                 /* We need another r10_bio.  It has already been counted
                  * in bio->bi_phys_segments.
                  */
@@ -1152,6 +1151,10 @@ retry_write:
                 r10_bio->state = 0;
                 goto retry_write;
         }
+        one_write_done(r10_bio);
+
+        /* In case raid10d snuck in to freeze_array */
+        wake_up(&conf->wait_barrier);
 
         if (do_sync || !mddev->bitmap || !plugged)
                 md_wakeup_thread(mddev->thread);