take note of the tio->io field before freeing tio.
--- diff/drivers/md/dm.c	2003-11-26 10:18:39.000000000 +0000
+++ source/drivers/md/dm.c	2003-11-26 10:18:45.000000000 +0000
@@ -366,8 +366,9 @@
 
 	else if (r < 0) {
 		/* error the io and bail out */
+		struct dm_io *io = tio->io;
 		free_tio(tio->io->md, tio);
-		dec_pending(tio->io, -EIO);
+		dec_pending(io, -EIO);
 	}
 }