Git-commit: 78eaa0d4cbcdb345992fa3dd22b3bcbb473cc064
From: NeilBrown <neilb@suse.de>
Subject: Fix two bug affecting RAID10 reshape
Patch-mainline: submitted for 3.11
References: -

1/ If a reshape of a RAID10 to fewer devices is interrupted,
 then when the array is reassembled setup_conf will allocate
 "conf->mirrors" too small, resulting in memory access errors or corruption.

2/ A sanity test in 'run' tested the wrong value.  This has nearly
   zero impact.

Acked-by: NeilBrown <neilb@suse.de>
Signed-off-by: Neil Brown <neilb@suse.de>

---
 drivers/md/raid10.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- linux-3.0-SLE11-SP2.orig/drivers/md/raid10.c
+++ linux-3.0-SLE11-SP2/drivers/md/raid10.c
@@ -2640,7 +2640,7 @@ static conf_t *setup_conf(mddev_t *mddev
 
 	/* FIXME calc properly */
 	conf->mirrors = kzalloc(sizeof(struct mirror_info)*(mddev->raid_disks +
-							    max(0,mddev->delta_disks)),
+							    max(0,-mddev->delta_disks)),
 				GFP_KERNEL);
 	if (!conf->mirrors)
 		goto out;
@@ -2773,7 +2773,7 @@ static int run(mddev_t *mddev)
 		    conf->geo.far_offset == 0)
 			goto out_free_conf;
 		if (conf->prev.far_copies != 1 &&
-		    conf->geo.far_offset == 0)
+		    conf->prev.far_offset == 0)
 			goto out_free_conf;
 	}
 
