[PATCH] fix read past end of array in md/linear.c