--- /dev/null
+From stable-bounces@linux.kernel.org Mon May 1 12:18:09 2006
+Message-Id: <200605011917.k41JHbeT005552@shell0.pdx.osdl.net>
+To: torvalds@osdl.org
+From: akpm@osdl.org
+Date: Mon, 01 May 2006 12:15:44 -0700
+Cc: neilb@suse.de, stable@kernel.org
+Subject: md: Avoid oops when attempting to fix read errors on raid10
+
+
+From: NeilBrown <neilb@suse.de>
+
+We should add to the counter for the rdev *after* checking if the rdev is
+NULL!!!
+
+Signed-off-by: Neil Brown <neilb@suse.de>
+Signed-off-by: Andrew Morton <akpm@osdl.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/raid10.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- linux-2.6.16.12.orig/drivers/md/raid10.c
++++ linux-2.6.16.12/drivers/md/raid10.c
+@@ -1436,9 +1436,9 @@ static void raid10d(mddev_t *mddev)
+ sl--;
+ d = r10_bio->devs[sl].devnum;
+ rdev = conf->mirrors[d].rdev;
+- atomic_add(s, &rdev->corrected_errors);
+ if (rdev &&
+ test_bit(In_sync, &rdev->flags)) {
++ atomic_add(s, &rdev->corrected_errors);
+ if (sync_page_io(rdev->bdev,
+ r10_bio->devs[sl].addr +
+ sect + rdev->data_offset,