Avoid references to 'pe->primary_pe' after freeing 'pe'. Signed-Off-By: Alasdair G Kergon Index: linux-2.6.16-rc1/drivers/md/dm-snap.c =================================================================== --- linux-2.6.16-rc1.orig/drivers/md/dm-snap.c 2006-02-22 20:43:12.000000000 +0000 +++ linux-2.6.16-rc1/drivers/md/dm-snap.c 2006-02-22 20:44:51.000000000 +0000 @@ -651,6 +651,7 @@ static void __invalidate_snapshot(struct static void pending_complete(struct pending_exception *pe, int success) { struct exception *e; + struct pending_exception *primary_pe; struct dm_snapshot *s = pe->snap; struct bio *flush = NULL; @@ -702,18 +703,20 @@ static void pending_complete(struct pend flush_bios(bio_list_get(&pe->snapshot_bios)); out: + primary_pe = pe->primary_pe; + /* * Free the pe if it's not linked to an origin write or if * it's not itself a primary pe. */ - if (!pe->primary_pe || pe->primary_pe != pe) + if (!primary_pe || primary_pe != pe) free_pending_exception(pe); /* * Free the primary pe if nothing references it. */ - if (pe->primary_pe && !atomic_read(&pe->primary_pe->sibling_count)) - free_pending_exception(pe->primary_pe); + if (primary_pe && !atomic_read(&primary_pe->sibling_count)) + free_pending_exception(primary_pe); if (flush) flush_bios(flush);