[linux-dvb] kernel oops unloading bugdet_ci

[syrius.ml@no-log.org]

I'm using kernel 2.6.10-rc3-bk13 + today's dvb-kernel cvs head.
(single cpu, i386, no preempt (also happens with preempt))
my system has a technotrend ff dvb-s and the budget card is also
a tt (but without the ci)

easy to reproduce: (after a fresh reboot, no dvb module loaded yet)
modprobe budget_ci
then
modprobe -r budget_ci
(modprobe segfaults)
(also happens with a rmmod budget_ci)

=>
Dec 21 20:39:18 dvb kernel: saa7146: unregister extension 'budget_ci dvb'.
Dec 21 20:39:18 dvb kernel: Unable to handle kernel NULL pointer dereference at virtual address 00000000
Dec 21 20:39:18 dvb kernel:  printing eip:
Dec 21 20:39:18 dvb kernel: c8a51b97
Dec 21 20:39:18 dvb kernel: *pde = 00000000
Dec 21 20:39:18 dvb kernel: Oops: 0000 [#1]
Dec 21 20:39:18 dvb kernel: Modules linked in: lirc_serial lirc_dev ipv6 nfs lockd sunrpc budget_ci tda1004x budget_core dvb_ttpci dvb_core saa7146_vv video_buf saa7146 v4l1_compat v4l2_common videodev ves1820 stv0299 tda8083 stv0297 sp8870 firmware_class ves1x93 ttpci_eeprom 3c59x snd_via82xx snd_ac97_codec snd_pcm snd_timer snd_page_alloc gameport snd_mpu401_uart snd_rawmidi snd_seq_device snd soundcore uhci_hcd usbcore via_agp agpgart parport_pc parport pcspkr evdev adm1021 eeprom w83781d i2c_sensor i2c_viapro i2c_isa i2c_core rtc unix raid1 linear md dm_bbr dm_mirror dm_mod
Dec 21 20:39:18 dvb kernel: CPU:    0
Dec 21 20:39:18 dvb kernel: EIP:    0060:[<c8a51b97>]    Not tainted VLI
Dec 21 20:39:18 dvb kernel: EFLAGS: 00010246   (2.6.10-rc3-bk13) 
Dec 21 20:39:18 dvb kernel: EIP is at dvb_unregister_frontend+0x27/0xac [dvb_core]
Dec 21 20:39:18 dvb kernel: eax: 00000000   ebx: 00000000   ecx: 00000000   edx: 06c13000
Dec 21 20:39:18 dvb kernel: esi: c7112cfc   edi: c6dfae00   ebp: c7cf9c44   esp: c62c1e54
Dec 21 20:39:18 dvb kernel: ds: 007b   es: 007b   ss: 0068
Dec 21 20:39:18 dvb kernel: Process modprobe (pid: 4122, threadinfo=c62c0000 task=c789e020)
Dec 21 20:39:18 dvb kernel: Stack: 0000004b c62c1e78 c7cf9c00 c1256000 c8a98769 c7112cfc c6d49580 c03912a0 
Dec 21 20:39:18 dvb kernel:        c7cf9c00 c6dfae00 c7cf9c00 c8a0dbc0 c6dfae00 00000001 00000001 00000082 
Dec 21 20:39:18 dvb kernel:        c6f51000 06f51000 c6a6d000 06a6d000 c6c13000 06c13000 00000000 00000000 
Dec 21 20:39:18 dvb kernel: Call Trace:
Dec 21 20:39:18 dvb kernel:  [<c8a98769>] budget_ci_detach+0x89/0xa0 [budget_ci]
Dec 21 20:39:18 dvb kernel:  [<c8a0dbc0>] saa7146_remove_one+0xa0/0x1a0 [saa7146]
Dec 21 20:39:18 dvb kernel:  [<c01c256b>] pci_device_remove+0x3b/0x40
Dec 21 20:39:18 dvb kernel:  [<c020b8f6>] device_release_driver+0x86/0x90
Dec 21 20:39:18 dvb kernel:  [<c020b92b>] driver_detach+0x2b/0x40
Dec 21 20:39:18 dvb kernel:  [<c020bdfc>] bus_remove_driver+0x4c/0x90
Dec 21 20:39:18 dvb kernel:  [<c020c3c3>] driver_unregister+0x13/0x30
Dec 21 20:39:18 dvb kernel:  [<c01c27d6>] pci_unregister_driver+0x16/0x30
Dec 21 20:39:18 dvb kernel:  [<c8a0ddcf>] saa7146_unregister_extension+0x2f/0x70 [saa7146]
Dec 21 20:39:18 dvb kernel:  [<c8a9878f>] budget_ci_exit+0xf/0x11 [budget_ci]
Dec 21 20:39:18 dvb kernel:  [<c012d055>] sys_delete_module+0x165/0x1a0
Dec 21 20:39:18 dvb kernel:  [<c0140069>] get_user_pages+0x209/0x3b0
Dec 21 20:39:18 dvb kernel:  [<c0143b54>] sys_munmap+0x44/0x70
Dec 21 20:39:18 dvb kernel:  [<c0102f7d>] sysenter_past_esp+0x52/0x75
Dec 21 20:39:18 dvb kernel: Code: 00 00 00 00 83 ec 10 a1 30 cc a5 c8 89 74 24 0c 8b 74 24 14 85 c0 89 5c 24 08 8b 5e 0c 75 77 ff 0d 74 c5 a5 c8 0f 88 75 01 00 00 <8b> 03 89 04 24 e8 bf 78 ff ff 89 34 24 e8 77 f3 ff ff 8b 06 8b 

it does not happen with dvb-ttpci. (i mean if i load/unload dvb-ttpci
instead, it doesn't make the kernel oops when unloading dvb-ttpci)
nor it happens with 2.4.29-pre2 + yesterday 2.4 branch of dvb-kernel.
(with both drivers in that case :))

Thanks.

--