--- /dev/null
+From afbaa90b80b1ec66e5137cc3824746bfdf559b18 Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb@suse.de>
+Date: Thu, 12 Apr 2012 16:05:06 +1000
+Subject: md/bitmap: prevent bitmap_daemon_work running while initialising bitmap
+
+From: NeilBrown <neilb@suse.de>
+
+commit afbaa90b80b1ec66e5137cc3824746bfdf559b18 upstream.
+
+If a bitmap is added while the array is active, it is possible
+for bitmap_daemon_work to run while the bitmap is being
+initialised.
+This is particularly a problem if bitmap_daemon_work sees
+bitmap->filemap as non-NULL before it has been filled in properly.
+So hold bitmap_info.mutex while filling in ->filemap
+to prevent problems.
+
+This patch is suitable for any -stable kernel, though it might not
+apply cleanly before about 3.1.
+
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/bitmap.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/md/bitmap.c
++++ b/drivers/md/bitmap.c
+@@ -1819,7 +1819,9 @@ int bitmap_load(struct mddev *mddev)
+ * re-add of a missing device */
+ start = mddev->recovery_cp;
+
++ mutex_lock(&mddev->bitmap_info.mutex);
+ err = bitmap_init_from_disk(bitmap, start);
++ mutex_unlock(&mddev->bitmap_info.mutex);
+
+ if (err)
+ goto out;
--- /dev/null
+From f4380a915823dbed0bf8e3cf502ebcf2b7c7f833 Mon Sep 17 00:00:00 2001
+From: majianpeng <majianpeng@gmail.com>
+Date: Thu, 12 Apr 2012 16:04:47 +1000
+Subject: md/raid1,raid10: Fix calculation of 'vcnt' when processing error recovery.
+
+From: majianpeng <majianpeng@gmail.com>
+
+commit f4380a915823dbed0bf8e3cf502ebcf2b7c7f833 upstream.
+
+If r1bio->sectors % 8 != 0,then the memcmp and a later
+memcpy will omit the last bio_vec.
+
+This is suitable for any stable kernel since 3.1 when bad-block
+management was introduced.
+
+Signed-off-by: majianpeng <majianpeng@gmail.com>
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/raid1.c | 3 ++-
+ drivers/md/raid10.c | 4 ++--
+ 2 files changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -1669,6 +1669,7 @@ static int process_checks(struct r1bio *
+ struct r1conf *conf = mddev->private;
+ int primary;
+ int i;
++ int vcnt;
+
+ for (primary = 0; primary < conf->raid_disks * 2; primary++)
+ if (r1_bio->bios[primary]->bi_end_io == end_sync_read &&
+@@ -1678,9 +1679,9 @@ static int process_checks(struct r1bio *
+ break;
+ }
+ r1_bio->read_disk = primary;
++ vcnt = (r1_bio->sectors + PAGE_SIZE / 512 - 1) >> (PAGE_SHIFT - 9);
+ for (i = 0; i < conf->raid_disks * 2; i++) {
+ int j;
+- int vcnt = r1_bio->sectors >> (PAGE_SHIFT- 9);
+ struct bio *pbio = r1_bio->bios[primary];
+ struct bio *sbio = r1_bio->bios[i];
+ int size;
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -1742,6 +1742,7 @@ static void sync_request_write(struct md
+ struct r10conf *conf = mddev->private;
+ int i, first;
+ struct bio *tbio, *fbio;
++ int vcnt;
+
+ atomic_set(&r10_bio->remaining, 1);
+
+@@ -1756,10 +1757,10 @@ static void sync_request_write(struct md
+ first = i;
+ fbio = r10_bio->devs[i].bio;
+
++ vcnt = (r10_bio->sectors + (PAGE_SIZE >> 9) - 1) >> (PAGE_SHIFT - 9);
+ /* now find blocks with errors */
+ for (i=0 ; i < conf->copies ; i++) {
+ int j, d;
+- int vcnt = r10_bio->sectors >> (PAGE_SHIFT-9);
+
+ tbio = r10_bio->devs[i].bio;
+
+@@ -1825,7 +1826,6 @@ static void sync_request_write(struct md
+ */
+ for (i = 0; i < conf->copies; i++) {
+ int j, d;
+- int vcnt = r10_bio->sectors >> (PAGE_SHIFT-9);
+
+ tbio = r10_bio->devs[i].repl_bio;
+ if (!tbio || !tbio->bi_end_io)