From: Jens Axboe <axboe@suse.de>

blk_execute_rq() can oops in wait_for_completion(), if the request has
completed before we call wait_for_completion() because blk_end_sync_rq()
clears ->waiting when it is entered.  Fix this by always using the on-stack
completion variable instead.

Signed-off-by: Jens Axboe <axboe@suse.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
---

 25-akpm/drivers/block/ll_rw_blk.c |    2 +-
 1 files changed, 1 insertion(+), 1 deletion(-)

diff -puN drivers/block/ll_rw_blk.c~blk_execute_rq-oops-on-fast-completion drivers/block/ll_rw_blk.c
--- 25/drivers/block/ll_rw_blk.c~blk_execute_rq-oops-on-fast-completion	2005-02-02 16:35:11.794260552 -0800
+++ 25-akpm/drivers/block/ll_rw_blk.c	2005-02-02 16:35:11.800259640 -0800
@@ -2210,7 +2210,7 @@ int blk_execute_rq(request_queue_t *q, s
 	rq->end_io = blk_end_sync_rq;
 	elv_add_request(q, rq, ELEVATOR_INSERT_BACK, 1);
 	generic_unplug_device(q);
-	wait_for_completion(rq->waiting);
+	wait_for_completion(&wait);
 	rq->waiting = NULL;
 
 	if (rq->errors)
_