ide_map_buffer() and ide_unmap_buffer() could cause imbalanced calls

to bio_kmap/kunmap_irq(), which would screw the preemption count. pass
in rq to ide_unmap_buffer() as well to make the right decision.

drivers/ide/ide-disk.c

@@ -173,7 +173,7 @@ static ide_startstop_t read_intr (ide_drive_t *drive)
 		drive->name, rq->sector, rq->sector+nsect-1,
 		(unsigned long) rq->buffer+(nsect<<9), rq->nr_sectors-nsect);
 #endif
-	ide_unmap_buffer(to, &flags);
+	ide_unmap_buffer(rq, to, &flags);
 	rq->sector += nsect;
 	rq->errors = 0;
 	i = (rq->nr_sectors -= nsect);
@@ -227,7 +227,7 @@ static ide_startstop_t write_intr (ide_drive_t *drive)
 				unsigned long flags;
 				char *to = ide_map_buffer(rq, &flags);
 				taskfile_output_data(drive, to, SECTOR_WORDS);
-				ide_unmap_buffer(to, &flags);
+				ide_unmap_buffer(rq, to, &flags);
 				if (HWGROUP(drive)->handler != NULL)
 					BUG();
 				ide_set_handler(drive, &write_intr, WAIT_CMD, NULL);
@@ -304,7 +304,7 @@ int ide_multwrite (ide_drive_t *drive, unsigned int mcount)
 		 * re-entering us on the last transfer.
 		 */
 		taskfile_output_data(drive, buffer, nsect<<7);
-		ide_unmap_buffer(buffer, &flags);
+		ide_unmap_buffer(rq, buffer, &flags);
 	} while (mcount);
 
         return 0;
@@ -522,7 +522,7 @@ static ide_startstop_t do_rw_disk (ide_drive_t *drive, struct request *rq, unsig
 				BUG();
 			ide_set_handler(drive, &write_intr, WAIT_CMD, NULL);
 			taskfile_output_data(drive, to, SECTOR_WORDS);
-			ide_unmap_buffer(to, &flags);
+			ide_unmap_buffer(rq, to, &flags);
 		}
 		return ide_started;
 	}

drivers/ide/ide-taskfile.c

@@ -60,7 +60,7 @@
 #endif
 
 #define task_map_rq(rq, flags)		ide_map_buffer((rq), (flags))
-#define task_unmap_rq(rq, buf, flags)	ide_unmap_buffer((buf), (flags))
+#define task_unmap_rq(rq, buf, flags)	ide_unmap_buffer((rq), (buf), (flags))
 
 inline u32 task_read_24 (ide_drive_t *drive)
 {

include/linux/ide.h

@@ -894,9 +894,10 @@ extern inline void *ide_map_buffer(struct request *rq, unsigned long *flags)
 	return rq->buffer + task_rq_offset(rq);
 }
 
-extern inline void ide_unmap_buffer(char *buffer, unsigned long *flags)
+extern inline void ide_unmap_buffer(struct request *rq, char *buffer, unsigned long *flags)
 {
-	bio_kunmap_irq(buffer, flags);
+	if (rq->bio)
+		bio_kunmap_irq(buffer, flags);
 }
 
 #define IDE_CHIPSET_PCI_MASK	\