md/raid1: call free_r1bio() before allow_barrier() in raid_end_bio_io()

After allow_barrier, a concurrent raid1_reshape() will replace old mempool
and r1conf::raid_disks. Move allow_barrier() to the end of raid_end_bio_io(),
so that r1bio can be freed safely.

Reviewed-by: Yu Kuai <yukuai3@huawei.com>
Signed-off-by: Xueshi Hu <xueshi.hu@smartx.com>
Link: https://lore.kernel.org/r/20230814135356.1113639-2-xueshi.hu@smartx.com
Signed-off-by: Song Liu <song@kernel.org>

diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index c18b7c096c8dfbf496cf2dcdc1077ad992802efa..642c8bae0df0cc4c805a692df0c63a06f3ac2516 100644 (file)
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -311,6 +311,7 @@ static void raid_end_bio_io(struct r1bio *r1_bio)
 {
        struct bio *bio = r1_bio->master_bio;
        struct r1conf *conf = r1_bio->mddev->private;
+       sector_t sector = r1_bio->sector;
 
        /* if nobody has done the final endio yet, do it now */
        if (!test_and_set_bit(R1BIO_Returned, &r1_bio->state)) {
@@ -321,13 +322,13 @@ static void raid_end_bio_io(struct r1bio *r1_bio)
 
                call_bio_endio(r1_bio);
        }
+
+       free_r1bio(r1_bio);
        /*
         * Wake up any possible resync thread that waits for the device
         * to go idle.  All I/Os, even write-behind writes, are done.
         */
-       allow_barrier(conf, r1_bio->sector);
-
-       free_r1bio(r1_bio);
+       allow_barrier(conf, sector);
 }
 
 /*