md/raid10: Fix bug when activating a hot-spare.

This is a fairly serious bug in RAID10.

When a RAID10 array is degraded and a hot-spare is activated, the
spare does not take up the empty slot, but rather replaces the first
working device.
This is likely to make the array non-functional.   It would normally
be possible to recover the data, but that would need care and is not
guaranteed.

This bug was introduced in commit
   2bb77736ae5dca0a189829fbb7379d43364a9dac
which first appeared in 3.1.

Cc: stable@kernel.org
Signed-off-by: NeilBrown <neilb@suse.de>

diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 132c18ef86658ce29bafdaa82773eacf52534bc5..c025a8276dc18b5844e7a6870b42236ac45bd86c 100644 (file)
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -1355,7 +1355,7 @@ static int raid10_add_disk(struct mddev *mddev, struct md_rdev *rdev)
                struct mirror_info *p = &conf->mirrors[mirror];
                if (p->recovery_disabled == mddev->recovery_disabled)
                        continue;
-               if (!p->rdev)
+               if (p->rdev)
                        continue;
 
                disk_stack_limits(mddev->gendisk, rdev->bdev,