For me this actually manages to trigger an oops after a zillion VFS: busy inodes on changed media or resized disk sr1 This is on 2.6.38-10-generic #44-Ubuntu SMP and also on a different machine (with the same USB stick) on a 3.0rc3 kernel I built with a similar backtrace. [17175.349990] BUG: unable to handle kernel NULL pointer dereference at 0000000000000002 [17175.350050] IP: [] init_groups+0x2/0xa0 [17175.350092] PGD 17e1d1067 PUD 1ea6a8067 PMD 0 [17175.350130] Oops: 0002 [#1] SMP [17175.350157] last sysfs file: /sys/devices/pci0000:00/0000:00:1a.0/usb1/1-1/1-1.4/1-1.4:1.0/bInterfaceSubClass [17175.350214] CPU 6 [17175.350227] Modules linked in: nls_utf8 isofs sha256_generic cryptd aes_x86_64 aes_generic ip6table_filter ip6_tables binfmt_misc dm_crypt ipt_MASQUERADE iptable_nat nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_state nf_conntrack ipt_REJECT xt_CHECKSUM iptable_mangle xt_tcpudp iptable_filter ip_tables x_tables bridge stp kvm_intel kvm snd_hda_codec_hdmi snd_hda_codec_via snd_hda_intel snd_hda_codec snd_hwdep snd_seq_midi snd_pcm snd_rawmidi ppdev snd_seq_midi_event snd_seq snd_timer snd_seq_device lp snd soundcore snd_page_alloc parport_pc parport radeon ttm usbhid firewire_ohci usb_storage uas hid r8169 firewire_core drm_kms_helper pata_via crc_itu_t drm i2c_algo_bit configfs [17175.350740] [17175.350752] Pid: 1779, comm: umount Tainted: G W 2.6.38-10-generic #44-Ubuntu To Be Filled By O.E.M. To Be Filled By O.E.M./P55M Pro [17175.350838] RIP: 0010:[] [] init_groups+0x2/0xa0 [17175.350891] RSP: 0018:ffff88014d0b3b30 EFLAGS: 00010002 [17175.350924] RAX: 0000000000000002 RBX: ffff88017e0686d0 RCX: 0000000000000010 [17175.350968] RDX: ffffffff81a255c0 RSI: 0000000000000000 RDI: ffff88017e0686d0 [17175.351011] RBP: ffff88014d0b3b38 R08: 0000000000000000 R09: ffff88021a5878a0 [17175.351053] R10: ffff88021a5878a0 R11: 0000000000000005 R12: 0000000000000000 [17175.351096] R13: 0000000000000001 R14: ffff88014d0b3d01 R15: ffff88021a5878a0 [17175.351141] FS: 00007eff431d5760(0000) GS:ffff8800c7580000(0000) knlGS:0000000000000000 [17175.351191] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [17175.351224] CR2: 0000000000000002 CR3: 000000014d94e000 CR4: 00000000000006e0 [17175.351267] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [17175.351311] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [17175.351355] Process umount (pid: 1779, threadinfo ffff88014d0b2000, task ffff8801436b8000) [17175.351405] Stack: [17175.351418] ffffffff812bd1ed ffff88014d0b3b98 ffffffff812c2e18 ffff88014d0b3b78 [17175.351471] 0000000000000082 0000000000000000 ffff880100000010 0000000000000000 [17175.351520] ffff88017e0686d0 0000000000000000 0000000000000010 ffff88014d0b3db8 [17175.351573] Call Trace: [17175.351594] [] ? elv_may_queue+0x1d/0x20 [17175.351628] [] get_request+0x48/0x3f0 [17175.351664] [] get_request_wait+0x29/0x1a0 [17175.351702] [] ? find_get_pages_tag+0x40/0x120 [17175.351744] [] ? try_to_wake_up+0x244/0x3e0 [17175.351778] [] blk_get_request+0x6c/0xa0 [17175.351811] [] scsi_execute+0x48/0x160 [17175.351842] [] scsi_execute_req+0xca/0x140 [17175.351877] [] ioctl_internal_command.clone.4+0x61/0x1b0 [17175.351917] [] ? fsnotify_clear_marks_by_inode+0x95/0xf0 [17175.351957] [] scsi_set_medium_removal+0x7e/0xb0 [17175.351993] [] ? isofs_destroy_inode+0x1c/0x20 [isofs] [17175.352032] [] sr_lock_door+0x20/0x30 [17175.352064] [] cdrom_release+0xe7/0x140 [17175.352094] [] sr_block_release+0x38/0x60 [17175.352124] [] __blkdev_put+0x16c/0x1b0 [17175.352154] [] blkdev_put+0xd2/0x170 [17175.352183] [] kill_block_super+0x4e/0x80 [17175.352213] [] deactivate_locked_super+0x45/0x70 [17175.352245] [] deactivate_super+0x4a/0x70 [17175.352276] [] mntput_no_expire+0xa4/0xf0 [17175.352306] [] sys_umount+0x60/0xd0 [17175.352333] [] system_call_fastpath+0x16/0x1b [17175.352364] Code: 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 a8 55 a2 81 ff ff ff ff a8 55 a2 81 ff ff ff ff 00 00 00 00 00 00 00 00 34 02 <00> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [17175.352631] RIP [] init_groups+0x2/0xa0 [17175.352663] RSP [17175.352681] CR2: 0000000000000002 [17175.365957] ---[ end trace 7664560b4e26c23d ]--- [17195.912249] usb 1-1.4: USB disconnect, address 3 root@major:~#