[PATCH] floppy I/O error handling => Oops

bad_flp_intr() in floppy.c can cause an Oops if the I/O request is freed
but <errors> still points into the I/O request block.  Get the error
count out of the request block before ending the IO.

bad_flp_intr() oopsen reports:

  Andrey: http://marc.theaimsgroup.com/?l=linux-kernel&m=105837886921297&w=2
  John:   http://marc.theaimsgroup.com/?l=linux-kernel&m=106303650007125&w=2
  Barry:  http://bugme.osdl.org/show_bug.cgi?id=1033

drivers/block/floppy.c

@@ -2153,18 +2153,20 @@ static int next_valid_format(void)
 
 static void bad_flp_intr(void)
 {
+	int err_count;
+
 	if (probing){
 		DRS->probed_format++;
 		if (!next_valid_format())
 			return;
 	}
-	(*errors)++;
-	INFBOUND(DRWE->badness, *errors);
-	if (*errors > DP->max_errors.abort)
+	err_count = ++(*errors);
+	INFBOUND(DRWE->badness, err_count);
+	if (err_count > DP->max_errors.abort)
 		cont->done(0);
-	if (*errors > DP->max_errors.reset)
+	if (err_count > DP->max_errors.reset)
 		FDCS->reset = 1;
-	else if (*errors > DP->max_errors.recal)
+	else if (err_count > DP->max_errors.recal)
 		DRS->track = NEED_2_RECAL;
 }