From: Peter Osterlund It oopses on module unload in the kobject layer due to misordered destruction of things. And we need to initialise the unplug timer in blk_alloc_queue(), because we kill that timer in blk_alloc_queue()'s companion function, blk_cleanup_queue(). drivers/block/ll_rw_blk.c | 2 +- drivers/block/loop.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff -puN drivers/block/loop.c~loop-oops-fix drivers/block/loop.c --- 25/drivers/block/loop.c~loop-oops-fix 2003-08-18 22:28:54.000000000 -0700 +++ 25-akpm/drivers/block/loop.c 2003-08-18 22:28:54.000000000 -0700 @@ -1238,8 +1238,8 @@ void loop_exit(void) int i; for (i = 0; i < max_loop; i++) { - blk_put_queue(loop_dev[i].lo_queue); del_gendisk(disks[i]); + blk_put_queue(loop_dev[i].lo_queue); put_disk(disks[i]); } devfs_remove("loop"); diff -puN drivers/block/ll_rw_blk.c~loop-oops-fix drivers/block/ll_rw_blk.c --- 25/drivers/block/ll_rw_blk.c~loop-oops-fix 2003-08-18 22:28:54.000000000 -0700 +++ 25-akpm/drivers/block/ll_rw_blk.c 2003-08-18 22:28:54.000000000 -0700 @@ -214,7 +214,6 @@ void blk_queue_make_request(request_queu if (q->unplug_delay == 0) q->unplug_delay = 1; - init_timer(&q->unplug_timer); INIT_WORK(&q->unplug_work, blk_unplug_work, q); q->unplug_timer.function = blk_unplug_timeout; @@ -1268,6 +1267,7 @@ request_queue_t *blk_alloc_queue(int gfp return NULL; memset(q, 0, sizeof(*q)); + init_timer(&q->unplug_timer); atomic_set(&q->refcnt, 1); return q; } _