take note of the tio->io field before freeing tio.
--- diff/drivers/md/dm.c	2003-10-29 14:52:12.000000000 +0000
+++ source/drivers/md/dm.c	2003-10-29 14:52:18.000000000 +0000
@@ -370,8 +370,9 @@
 
 	else if (r < 0) {
 		/* error the io and bail out */
+		struct dm_io *io = tio->io;
 		free_tio(tio->io->md, tio);
-		dec_pending(tio->io, -EIO);
+		dec_pending(io, -EIO);
 	}
 }