diff --git a/hw/ide/core.c b/hw/ide/core.c
index 6d96c3a8c3f0fd97f983128c900dbd5cab79b338..1bedad29de3aad91c277e79dd0ce4ed565dcfe94 100644
--- a/hw/ide/core.c
+++ b/hw/ide/core.c
@@ -705,6 +705,7 @@ void ide_cancel_dma_sync(IDEState *s)
      * whole DMA operation will be submitted to disk with a single
      * aio operation with preadv/pwritev.
      */
+    assert(s->blk);
     if (s->bus->dma->aiocb) {
         trace_ide_cancel_dma_sync_remaining();
         blk_drain(s->blk);
diff --git a/hw/ide/pci.c b/hw/ide/pci.c
index 4c6fb9a68ee2e61a83374c108493fda73440a0b3..ac291858d7cf3fab357c26dd8fbd9302b4f7143a 100644
--- a/hw/ide/pci.c
+++ b/hw/ide/pci.c
@@ -295,7 +295,10 @@ void bmdma_cmd_writeb(BMDMAState *bm, uint32_t val)
     /* Ignore writes to SSBM if it keeps the old value */
     if ((val & BM_CMD_START) != (bm->cmd & BM_CMD_START)) {
         if (!(val & BM_CMD_START)) {
-            ide_cancel_dma_sync(idebus_active_if(bm->bus));
+            IDEState *s = idebus_active_if(bm->bus);
+            if (s->blk) {
+                ide_cancel_dma_sync(s);
+            }
             bm->status &= ~BM_STATUS_DMAING;
         } else {
             bm->cur_addr = bm->addr;
diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index e74143ccc36c1b669a08468ea10c54a562146de6..a26d82d945e1c70d379c7f16662ab3c1123e171a 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -249,6 +249,9 @@ static void pci_change_irq_level(PCIDevice *pci_dev, int irq_num, int change)
     PCIBus *bus;
     for (;;) {
         bus = pci_get_bus(pci_dev);
+        if (!bus) {
+            return;
+        }
         irq_num = bus->map_irq(pci_dev, irq_num);
         if (bus->set_irq)
             break;