From: Dan Williams <dan.j.williams@intel.com>
Date: Tue, 15 Sep 2009 18:34:20 +0000 (-0700)
Subject: imsm: fix spare promotion
X-Git-Tag: mdadm-3.0.1~2^2~6
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=709743c554c78b4bbc4483a3ba6845909d4db6ba;p=thirdparty%2Fmdadm.git

imsm: fix spare promotion

1/ Fix an off by one error when detecting whether the device allocation
   loop succeeded or not
2/ Update ->num_raid_devs before copying to avoid a segmentation fault

Signed-off-by: Dan Williams <dan.j.williams@intel.com>
---

diff --git a/super-intel.c b/super-intel.c
index 782519e9..4e2b75f0 100644
--- a/super-intel.c
+++ b/super-intel.c
@@ -1499,18 +1499,17 @@ static int compare_super_imsm(struct supertype *st, struct supertype *tst)
 			dv->next = first->devlist;
 			first->devlist = dv;
 		}
-		if (i <= sec->anchor->num_raid_devs) {
+		if (i < sec->anchor->num_raid_devs) {
 			/* allocation failure */
 			free_devlist(first);
 			fprintf(stderr, "imsm: failed to associate spare\n"); 
 			return 3;
 		}
-		for (i = 0; i < sec->anchor->num_raid_devs; i++)
-			imsm_copy_dev(get_imsm_dev(first, i), get_imsm_dev(sec, i));
-
 		first->anchor->num_raid_devs = sec->anchor->num_raid_devs;
 		first->anchor->orig_family_num = sec->anchor->orig_family_num;
 		first->anchor->family_num = sec->anchor->family_num;
+		for (i = 0; i < sec->anchor->num_raid_devs; i++)
+			imsm_copy_dev(get_imsm_dev(first, i), get_imsm_dev(sec, i));
 	}
 
 	return 0;