In __map_buffer(), the call to dm_table_find_target() will never return a
NULL pointer (provided every DM device table has a valid "targets" array,
which should be the case). It may, however, return a pointer to a blank target
record (since there are always a KEYS_PER_NODE-multiple of target records
in the B-tree, but not all of these target records are necessarily used).
This will occur when DM receives an I/O request past the end of a device.
(You'd think this shouldn't happen, but it does - generic_make_request()
will allow an I/O one sector past the end of a device with an even number
of sectors.)

Instead of checking for a NULL return from dm_table_find_target(), check
for a valid "type" field in the returned target.
[Kevin Corry]

--- diff/drivers/md/dm.c	2003-02-13 10:42:23.000000000 +0000
+++ source/drivers/md/dm.c	2003-03-27 09:40:12.000000000 +0000
@@ -351,7 +351,7 @@
 	struct dm_target *ti;
 
 	ti = dm_table_find_target(md->map, bh->b_rsector);
-	if (!ti)
+	if (!ti->type)
 		return -EINVAL;
 
 	/* hook the end io request fn */