kthread_stop never returns

[Roman Kagan]

  Hi Duncan,

I'm having a problem with usbatm2 apparently related to the use of
kthread_stop in udsl_usb_disconnect.

The .heavy_init thread starts up fine, loads the firmware and exits.
But then if I unplug the modem I get 

drivers/usb/atm/usbatm2.c: udsl_instance_disconnect entered

message but it never enters my .unbind method, and further USB events
are ingnored (i.e. khubd is stuck waiting for the disconnect to return).
The only place where this can happen is kthread_stop as I don't provide
.atm_stop method.

If instead of unplugging I try to modprobe -r cxacru2, I get the
following oops:

usbcore: deregistering driver cxacru
drivers/usb/atm/usbatm2.c: udsl_instance_disconnect entered
Unable to handle kernel NULL pointer dereference at virtual address 00000003
 printing eip:
c013fb23
*pde = 00000000
Oops: 0000 [#1]
PREEMPT 
Modules linked in: md5 ipv6 af_packet ppp_generic slhc br2684 cxacru2 usbatm2 crc32 atm nls_utf8 nls_cp1251 vfat fat nls_base lp parport_pc parport 8250 serial_core floppy psmouse pcspkr rtc snd_bt87x ir_kbd_gpio ir_common tuner bttv video_buf firmware_c
lass v4l2_common btcx_risc videodev snd_intel8x0 snd_ac97_codec snd_pcm snd_timer snd soundcore snd_page_alloc i2c_i801 uhci_hcd usbcore i2c_i810 i2c_algo_bit i2c_core intel_agp agpgart ide_cd cdrom ext2 mbcache ide_disk piix ide_core
CPU:    0
EIP:    0060:[<c013fb23>]    Not tainted VLI
EFLAGS: 00010086   (2.6.10) 
EIP is at cache_flusharray+0x33/0xf0
eax: d3db8000   ebx: c125c398   ecx: c125af58   edx: c125af58
esi: d2748000   edi: 00000286   ebp: ffffffff   esp: d3db9e6c
ds: 007b   es: 007b   ss: 0068
Process modprobe (pid: 1969, threadinfo=d3db8000 task=d208c080)
Stack: 000037b8 00000282 d3db9e9c 20000000 c125c398 d2748000 00000286 d3db8000 
       c013fe0d c125af58 c125c398 d3d40580 d279ecc0 d275c000 c0117483 d2748000 
       00000000 d3d40580 c012e658 d3d40580 d279ecc0 d275c000 c0119f97 d4aeae60 
Call Trace:
 [<c013fe0d>] kfree+0x5d/0x70
 [<c0117483>] free_task+0x13/0x30
 [<c012e658>] kthread_stop+0x78/0x7a
 [<c0119f97>] printk+0x17/0x20
 [<d4aea4b7>] usbatm_disconnect+0x227/0x280 [usbatm2]
 [<d48b2128>] usb_unbind_interface+0x78/0x80 [usbcore]
 [<c01ec3d6>] device_release_driver+0x86/0x90
 [<c01ec3fe>] driver_detach+0x1e/0x30
 [<c01ec91c>] bus_remove_driver+0x4c/0x90
 [<c01ecf10>] driver_unregister+0x10/0x20
 [<d48b2214>] usb_deregister+0x34/0x50 [usbcore]
 [<d4aef6df>] cxacru_cleanup+0xf/0x11 [cxacru2]
 [<c0130c8d>] sys_delete_module+0x14d/0x160
 [<c0156261>] sys_write+0x51/0x80
 [<c01030c9>] sysenter_past_esp+0x52/0x75
Code: 5c 24 10 8b 4c 24 24 89 74 24 14 89 7c 24 18 89 6c 24 1c 8b 40 08 89 44 24 0c b8 00 e0 ff ff 21 e0 ff 40 14 8b 69 30 85 ed 74 0a <8b> 45 04 8b 55 00 29 d0 75 68 89 0c 24 8b 5c 24 28 8b 44 24 0c 
 <6>note: modprobe[1969] exited with preempt_count 1
drivers/usb/atm/cxacru2.c: submitting read urb for cm 0x88 failed
cxacru 2-2:1.0: poll status: error -90

(The last two lines (endlessly repeated) are the messages from my status
polling function, as the polling is stopped in .unbind.)

It looks like kthread_stop doesn't like being called on an already
exited kthread (I'm not fluent with kthread_* yet).  Or is it due to me
doing something weird in heavy_init?

Cheers,
  Roman.