The end_sync_read function forwards the read operation (r1_bh) that completed by the raid1_reschedule_retry function. The r1_bh->cmd value is SPECIAL. If the R1BH_Uptodate bit is not set a message is printed and md_done_sync is called - but raid1_free_buf is not called. Look a few lines above at the "!sum_bhs" case for comparison.
mark
--- raid1.c.orig 2004-03-23 16:09:48.000000000 -0700 +++ raid1.c 2004-03-23 16:09:18.000000000 -0700 @@ -1252,6 +1252,7 @@ printk (IO_ERROR, partition_name(bh->b_dev), bh->b_blocknr); md_done_sync(mddev, bh->b_size>>9, 0); + raid1_free_buf(r1_bh); } break;