diff --git a/[refs] b/[refs]
index 3633ee89e5c5..acef20fd9eae 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 98ba4031ab2adc8b394295e68aa4c8fe9d5060db
+refs/heads/master: c26156b2534c75bb3cdedf76f6ad1340971cf5bd
diff --git a/trunk/block/blk-map.c b/trunk/block/blk-map.c
index 4849fa36161e..0f4b4b881811 100644
--- a/trunk/block/blk-map.c
+++ b/trunk/block/blk-map.c
@@ -217,6 +217,12 @@ int blk_rq_map_user_iov(struct request_queue *q, struct request *rq,
 		return PTR_ERR(bio);
 
 	if (bio->bi_size != len) {
+		/*
+		 * Grab an extra reference to this bio, as bio_unmap_user()
+		 * expects to be able to drop it twice as it happens on the
+		 * normal IO completion path
+		 */
+		bio_get(bio);
 		bio_endio(bio, 0);
 		bio_unmap_user(bio);
 		return -EINVAL;