Andrew,

If you do not want to go with the retry-based AIO in mm, here is
the AIO ref count patch against 2.6.0-test9.  This is a bit different
than the version in -mm, but accomplishes the same thing -- the submit
path holds an extra reference until just before returning.  This fixes
the referencing a free kiocb.

Without this patch on test9 (with PAGEALLOC_DEBUG), I get:
 
Unable to handle kernel paging request at virtual address df4fbf90
 printing eip:
c0143dc4
*pde = 0007f067
*pte = 1f4fb000
Oops: 0002 [#1]
CPU:    1
EIP:    0060:[<c0143dc4>]    Not tainted
EFLAGS: 00210287
EIP is at generic_file_aio_write_nolock+0x936/0xbbd
eax: 019d0000   ebx: 06400000   ecx: df4fbf90   edx: 00000000
esi: 00000000   edi: e700de88   ebp: df533eb4   esp: df533dc0
ds: 007b   es: 007b   ss: 0068
Process aiodio_sparse (pid: 1824, threadinfo=df532000 task=e66e29b0)
Stack: 00000001 df4fbf58 df533ecc 019c0000 00000000 00000001 00000001 df533e04
       00200286 c148fc10 00000000 00200286 db234d94 df533e18 f7a89218 019d0000
       00000000 df533e18 c011dd46 f65dbdf8 ffffffff 00000041 df533e50 00010000
Call Trace:
 [<c011dd46>] kernel_map_pages+0x28/0x5d
 [<c0144162>] generic_file_aio_write+0x86/0xa4
 [<c01a12d7>] ext3_file_write+0x3f/0xcc
 [<c018c948>] io_submit_one+0x2b5/0x2f7
 [<c018ca67>] sys_io_submit+0xdd/0x143
 [<c010a6c7>] syscall_call+0x7/0xb


I'm working on the other AIO fixes against mainline.

Thanks,

Daniel