Comment 6 for bug 605124

Looks like it fails when i915 loads:

[ 11.262370] i915 0000:00:02.0: power state changed by ACPI to D0
[ 11.262427] i915 0000:00:02.0: power state changed by ACPI to D0
[ 11.262437] i915 0000:00:02.0: PCI INT A -> GSI 16 (level, low) -> IRQ 16
[ 11.262443] i915 0000:00:02.0: setting latency timer to 64
[ 11.287021] BUG: unable to handle kernel NULL pointer dereference at (null)
[ 11.287368] IP: [<c05cb14a>] __mutex_lock_slowpath+0x9a/0x140
[ 11.287647] *pde = 7ce57067
[ 11.287790] Oops: 0002 [#1] SMP
[ 11.287957] last sysfs file: /sys/module/snd_rawmidi/initstate
[ 11.288226] Modules linked in: snd_rawmidi(+) i915(+) snd_seq_midi_event snd_seq drm_kms_helper iwlcore snd_timer mac80211 snd_seq_device drm snd yenta_socket pcmcia_rsrc intel_agp cfg80211 psmouse tpm_tis serio_raw pcmcia_core nvram i2c_algo_bit video tpm tpm_bios soundcore snd_page_alloc agpgart output lp parport usbhid hid firewire_ohci sdhci_pci firewire_core ahci sdhci led_class crc_itu_t e1000e libahci
[ 11.289012]
[ 11.289012] Pid: 370, comm: plymouthd Not tainted 2.6.35-7-generic #12-Ubuntu 7764CTO/7764CTO
[ 11.289012] EIP: 0060:[<c05cb14a>] EFLAGS: 00010246 CPU: 1
[ 11.289012] EIP is at __mutex_lock_slowpath+0x9a/0x140
[ 11.289012] EAX: 00000000 EBX: f40aaa90 ECX: f40aaa98 EDX: f6a77ec0
[ 11.289012] ESI: f40aaa94 EDI: f40aaa90 EBP: f6a77ed8 ESP: f6a77eb4
[ 11.289012] DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
[ 11.289012] Process plymouthd (pid: 370, ti=f6a76000 task=f70fe580 task.ti=f6a76000)
[ 11.289012] Stack:
[ 11.289012] f6a77ec4 f70fe580 f40aaa98 f40aaa98 00000000 f6a77ed8 f40aaa90 f45be700
[ 11.289012] <0> f40aaa90 f6a77ee8 c05cb095 f45be700 f45be700 f6a77efc f8393dc3 f45be700
[ 11.289012] <0> f45be760 f40aa800 f6a77f44 f838b337 00000001 f839be25 f839b220 f839d590
[ 11.289012] Call Trace:
[ 11.289012] [<c05cb095>] ? mutex_lock+0x25/0x40
[ 11.289012] [<f8393dc3>] ? drm_fb_release+0x23/0x70 [drm]
[ 11.289012] [<f838b337>] ? drm_release+0x3e7/0x4c0 [drm]
[ 11.289012] [<c021a13f>] ? __fput+0xdf/0x1f0
[ 11.289012] [<c021a26d>] ? fput+0x1d/0x30
[ 11.289012] [<c0216b5c>] ? filp_close+0x4c/0x80
[ 11.289012] [<c0216c05>] ? sys_close+0x75/0xc0
[ 11.289012] [<c05cc7dc>] ? syscall_call+0x7/0xb
[ 11.289012] Code: 83 79 18 63 7f b3 8d 76 00 8d 73 04 89 f0 e8 5e 11 00 00 8d 53 08 89 55 e4 8d 55 e8 8b 43 0c 89 53 0c 8b 4d e4 89 45 ec 89 4d e8 <89> 10 8b 45 e0 ba ff ff ff ff 89 45 f0 89 d0 87 03 83 f8 01 74
[ 11.289012] EIP: [<c05cb14a>] __mutex_lock_slowpath+0x9a/0x140 SS:ESP 0068:f6a77eb4
[ 11.289012] CR2: 0000000000000000
[ 11.383770] ---[ end trace b880c9a6dbf71a43 ]---
[ 11.399765] alloc irq_desc for 44 on node -1
[ 11.400053] alloc kstat_irqs on node -1
[ 11.401879] i915 0000:00:02.0: irq 44 for MSI/MSI-X
[ 11.403369] [drm] set up 7M of stolen space

iirc there were some changes to fb teardown recently, checking now.