From d57fe88fe21c69e17850caf366c5faa252084fd2 Mon Sep 17 00:00:00 2001
From: NeilBrown <neilb@suse.de>
Date: Mon, 3 Aug 2009 10:59:56 +1000
Subject: [PATCH] --- yaml --- r: 156201 b: refs/heads/master c:
 3673f305faf1bc66ead751344f8262ace851ff44 h: refs/heads/master i:   156199:
 d54e9bf353e8037792529e73190cb78f115f7f1a v: v3

---
 [refs]                | 2 +-
 trunk/drivers/md/md.c | 7 ++++++-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/[refs] b/[refs]
index b1282d44de9a..894db008b32d 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 3a981b03f38dc3b8a69b77cbc679e66c1318a44a
+refs/heads/master: 3673f305faf1bc66ead751344f8262ace851ff44
diff --git a/trunk/drivers/md/md.c b/trunk/drivers/md/md.c
index c194955aecae..249b2896d4ea 100644
--- a/trunk/drivers/md/md.c
+++ b/trunk/drivers/md/md.c
@@ -1308,7 +1308,12 @@ static int super_1_validate(mddev_t *mddev, mdk_rdev_t *rdev)
 	}
 	if (mddev->level != LEVEL_MULTIPATH) {
 		int role;
-		role = le16_to_cpu(sb->dev_roles[rdev->desc_nr]);
+		if (rdev->desc_nr < 0 ||
+		    rdev->desc_nr >= le32_to_cpu(sb->max_dev)) {
+			role = 0xffff;
+			rdev->desc_nr = -1;
+		} else
+			role = le16_to_cpu(sb->dev_roles[rdev->desc_nr]);
 		switch(role) {
 		case 0xffff: /* spare */
 			break;