I'm chasing down a segfault in an extant kernel module, and have
tracked it to a wake_up_interruptible(). Trying to get the simplest
case, I've modified a new module, and get the (? a, anyway) segfault.
I know it isn't guaranteed to be the same one, mine is embedded in a
few places, in an interrupt handler and a close, the example is in
loading a module, which may not even be legal, but at least if I can
understand why I can get closer to figuring out what's going on in the
real module...

Here's the example code:
--------
#define MODULE
#define __KERNEL__

#include
#include
#include
#include
#include

DECLARE_WAIT_QUEUE_HEAD(wq);

static int __init mymodule_init(void)
{
wake_up_interruptible(&wq);
return 0;
}

static void __exit mymodule_exit(void)
{
return;
}

module_init(mymodule_init);
module_exit(mymodule_exit);
--------
Compiled with with:

cc -c -Wall -O1 -c -o mymodule.o mymodule.c
(no warnings, no errors)

copied to /lib/modules/.../misc

kernel version 2.4.18

Segfault: (cat /proc/kmsg &; insmod mymodule)
Using /lib/modules/2.4.18-xxxxx/misc/mymodule.o
Warning: loading /lib/modules/2.4.18-xxxxx/misc/mymodule.o will taint
the kernel: no license
See http://www.tux.org/lkml/#export-tainted for information about
tainted modules
<1>Unable to handle kernel paging request at virtual address 63702f00
<4> printing eip:
<4>c010fc03
<1>*pde = 00000000
<4>Oops: 0000
<4>CPU: 0
<4>EIP: 0010:[] Tainted: P
<4>EFLAGS: 00010097
<4>eax: c48172f8 ebx: c325a000 ecx: 63702f00 edx: c325a000
<4>esi: c48172f4 edi: 00000040 ebp: c325bf18 esp: c325bef8
<4>ds: 0018 es: 0018 ss: 0018
<4>Process insmod (pid: 523, stackpage=c325b000)
<4>Stack: c0202d3c 00000001 00000282 00000001 c48172f4 c4817000
00000000 00000040
<4> c325bf28 c481707a 00000000 00000000 08062aef c0113c97
00000000 c3233000
<4> 00000087 c3235000 00000060 ffffffea 00000008 c3f80980
00000060 c4814000
<4>Call Trace: [] [] [] []
[]
<4>
<4>Code: 8b 01 85 45 ec 0f 84 7c 00 00 00 c7 45 e0 00 00 00 00 9c 5f
<4> <6>note: insmod[523] exited with preempt_count 2
Segmentation fault

(xxxxx is company stuff; kernel isn't quite PV 2.4.18, but I doubt
that's relevant here - I do know there's another kernel module using
wake_up_interruptible() quite happily)

Now... obviously, when I call wake_up_interruptible() nothing is
sleeping on the wait queue. I *assume* that's okay, since it should
wake up all or no tasks.

Also, as I said, I'm not certain that it's legal to manipulate a wait
queue in a module init / deinit call. I'm a clueless newbie when it
comes to kernel modules. I don't see anything in "Linux Device
Drivers" to tell me I can't, but then, I don't see anything that would
tell me why this is illegal.

I'd much appreciate some help.