From: Xueshi Hu <redacted>

When an IO error happens, reschedule_retry() will increase
r1conf::nr_queued, which makes freeze_array() unblocked. However, before
all r1bio in the memory pool are released, the memory pool should not be
modified.

Signed-off-by: Xueshi Hu <redacted>
---
 drivers/md/raid1.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index dd25832eb045..ce48cb3af301 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c

@@ -3298,6 +3298,13 @@ static int raid1_reshape(struct mddev *mddev)
 
 	freeze_array(conf, 0);
 
+	if (unlikely(atomic_read(conf->nr_queued))) {
+		kfree(newpoolinfo);
+		mempool_exit(&newpool);
+		unfreeze_array(conf);
+		return -EBUSY;
+	}
+
 	/* ok, everything is stopped */
 	oldpool = conf->r1bio_pool;
 	conf->r1bio_pool = newpool;

-- 
2.40.1