From: Mikulas Patocka We queue work on keventd queue --- so this queue must be flushed in the destructor. Otherwise, keventd could access mirror_set after it was freed. Signed-off-by: Mikulas Patocka Signed-off-by: Alasdair G Kergon Cc: stable@kernel.org --- drivers/md/dm-raid1.c | 1 + 1 files changed, 1 insertion(+) Index: linux-2.6.28-rc4/drivers/md/dm-raid1.c =================================================================== --- linux-2.6.28-rc4.orig/drivers/md/dm-raid1.c 2008-11-13 21:20:02.000000000 +0000 +++ linux-2.6.28-rc4/drivers/md/dm-raid1.c 2008-11-13 21:21:15.000000000 +0000 @@ -1032,6 +1032,7 @@ static void mirror_dtr(struct dm_target del_timer_sync(&ms->timer); flush_workqueue(ms->kmirrord_wq); + flush_scheduled_work(); dm_kcopyd_client_destroy(ms->kcopyd_client); destroy_workqueue(ms->kmirrord_wq); free_context(ms, ti, ms->nr_mirrors);