Index: xen-3.3.1-testing/tools/ioemu-remote/hw/ide.c
===================================================================
--- xen-3.3.1-testing.orig/tools/ioemu-remote/hw/ide.c
+++ xen-3.3.1-testing/tools/ioemu-remote/hw/ide.c
@@ -908,8 +908,12 @@ static inline void ide_dma_submit_check(
 
 static inline void ide_set_irq(IDEState *s)
 {
-    BMDMAState *bm = s->bmdma;
-    if (!s->bs) return; /* yikes */
+    BMDMAState *bm;
+
+    if (!s || !s->bs) return; /* yikes */
+
+    bm = s->bmdma;
+
     if (!(s->cmd & IDE_CMD_DISABLE_IRQ)) {
         if (bm) {
             bm->status |= BM_STATUS_INT;
@@ -1094,15 +1098,13 @@ static void ide_read_dma_cb(void *opaque
     int n;
     int64_t sector_num;
 
+    if (!s || !s->bs) return; /* yikes */
+
     if (ret < 0) {
 	ide_dma_error(s);
 	return;
     }
 
-    if (!s->bs) return; /* yikes */
-
-    if (!s->bs) return; /* yikes */
-
     n = s->io_buffer_size >> 9;
     sector_num = ide_get_sector(s);
     if (n > 0) {
@@ -1222,15 +1224,13 @@ static void ide_write_dma_cb(void *opaqu
     int n;
     int64_t sector_num;
 
+    if (!s || !s->bs) return; /* yikes */
+
     if (ret < 0) {
 	ide_dma_error(s);
 	return;
     }
 
-    if (!s->bs) return; /* yikes */
-
-    if (!s->bs) return; /* yikes */
-
     n = s->io_buffer_size >> 9;
     sector_num = ide_get_sector(s);
     if (n > 0) {
@@ -1290,7 +1290,7 @@ static void ide_flush_cb(void *opaque, i
 {
     IDEState *s = opaque;
 
-    if (!s->bs) return; /* yikes */
+    if (!s || !s->bs) return; /* yikes */
 
     if (ret) {
         /* We are completely doomed.  The IDE spec does not permit us
@@ -1536,9 +1536,7 @@ static void ide_atapi_cmd_read_dma_cb(vo
     IDEState *s = bm->ide_if;
     int data_offset, n;
 
-    if (!s->bs) return; /* yikes */
-
-    if (!s->bs) return; /* yikes */
+    if (!s || !s->bs) return; /* yikes */
 
     if (ret < 0) {
         ide_atapi_io_error(s, ret);
@@ -2119,9 +2117,7 @@ static void cdrom_change_cb(void *opaque
     IDEState *s = opaque;
     uint64_t nb_sectors;
 
-    if (!s->bs) return; /* yikes */
-
-    if (!s->bs) return; /* yikes */
+    if (!s || !s->bs) return; /* yikes */
 
     /* XXX: send interrupt too */
     bdrv_get_geometry(s->bs, &nb_sectors);