From: Mikulas Patocka <[email-masked]>

We queue work on keventd queue --- so this queue must be flushed in the
destructor. Otherwise, keventd could access mirror_set after it was freed.

Signed-off-by: Mikulas Patocka <[email-masked]>
Signed-off-by: Alasdair G Kergon <[email-masked]>
Cc: [email-masked]

---
 drivers/md/dm-raid1.c |    1 +
 1 files changed, 1 insertion(+)

Index: linux-2.6.28-rc4/drivers/md/dm-raid1.c
===================================================================
--- linux-2.6.28-rc4.orig/drivers/md/dm-raid1.c	2008-11-13 21:20:02.000000000 +0000
+++ linux-2.6.28-rc4/drivers/md/dm-raid1.c	2008-11-13 21:21:15.000000000 +0000
@@ -1032,6 +1032,7 @@ static void mirror_dtr(struct dm_target 
 
 	del_timer_sync(&ms->timer);
 	flush_workqueue(ms->kmirrord_wq);
+	flush_scheduled_work();
 	dm_kcopyd_client_destroy(ms->kcopyd_client);
 	destroy_workqueue(ms->kmirrord_wq);
 	free_context(ms, ti, ms->nr_mirrors);