[PATCH] IDE error handling fixes

In 2.6.15.1 I encountered some IDE crashes when unplugging IDE cables to
emulate disk errors.  Below is a patch against 2.6.16 which I think still
applies.

1.  The first BUG_ON could trigger when a PREFLUSH IO fails (it would
   fail the original barrier request which hasn't been marked REQ_STARTED
   yet).

2. the rq could have been dequeued already (same as 1).

3.  HWGROUP(drive)->rq could be NULL because of the ide_error() several
   lines earlier.
Signed-off-by: Hua Zhong <hzhong@gmail.com>
Cc: Bartlomiej Zolnierkiewicz <B.Zolnierkiewicz@elka.pw.edu.pl>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

drivers/ide/ide-io.c

@@ -59,8 +59,6 @@ static int __ide_end_request(ide_drive_t *drive, struct request *rq,
 {
 	int ret = 1;
 
-	BUG_ON(!blk_rq_started(rq));
-
 	/*
 	 * if failfast is set on a request, override number of sectors and
 	 * complete the whole request right now
@@ -82,6 +80,7 @@ static int __ide_end_request(ide_drive_t *drive, struct request *rq,
 
 	if (!end_that_request_first(rq, uptodate, nr_sectors)) {
 		add_disk_randomness(rq->rq_disk);
+		if (!list_empty(&rq->queuelist))
 			blkdev_dequeue_request(rq);
 		HWGROUP(drive)->rq = NULL;
 		end_that_request_last(rq, uptodate);
@@ -1346,6 +1345,10 @@ static ide_startstop_t ide_dma_timeout_retry(ide_drive_t *drive, int error)
 	 * make sure request is sane
 	 */
 	rq = HWGROUP(drive)->rq;
+
+	if (!rq)
+		goto out;
+
 	HWGROUP(drive)->rq = NULL;
 
 	rq->errors = 0;