Kernel panic in vsnprintf() function.

Issue

• System freezes every time after the sixth or seventh attempt while unplugging the USB from a Matrox F2408.
• Kernel panic while unplugging USB device from a Matrox F2408.

usb 3-2: USB disconnect, address 9
BUG: unable to handle kernel paging request at virtual address 7665642f
 printing eip:
c04f41d8
*pde = 00000000
Oops: 0000 [#1]
SMP 
last sysfs file: /block/sdf/size
Modules linked in: vfat fat m9x(PU) snd_usb_audio snd_usb_lib snd_rawmidi extio2_quirks(PU) autofs4 hidp l2cap bluetooth lockd sunrpc uio libcxgbi cxgb3 8021q libiscsi_tcp libiscsi2 scsi_transport_iscsi2 scsi_transport_iscsi ipv6 xfrm_nalgo crypto_api dm_multipath scsi_dh video backlight sbs power_meter hwmon i2c_ec dell_wmi wmi button battery asus_acpi ac lp sr_mod cdrom joydev snd_hda_intel snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq snd_seq_device snd_pcm_oss snd_mixer_oss snd_pcm snd_timer sg parport_pc snd_page_alloc i2c_i801 snd_hwdep tpm_tis i2c_core parport pcspkr snd tpm serio_raw tpm_bios bnx2 tg3 soundcore dm_raid45 dm_message dm_region_hash dm_mem_cache dm_snapshot dm_zero dm_mirror dm_log dm_mod usb_storage ahci libata megaraid_sas sd_mod scsi_mod ext3 jbd uhci_hcd ohci_hcd ehci_hcd
CPU:    2
EIP:    0060:[<c04f41d8>]    Tainted: P     ---- VLI
EFLAGS: 00010297   (2.6.18-308.el5 #1) 
EIP is at vsnprintf+0x344/0x4db
eax: 7665642f   ebx: ffffffff   ecx: 7665642f   edx: fffffffe
esi: f29d20a7   edi: f7fd2ea0   ebp: f2f69480   esp: f7fd2e3c
ds: 007b   es: 007b   ss: 0068
Process khubd (pid: 198, ti=f7fd2000 task=f7fdc550 task.ti=f7fd2000)
Stack: 0d62df62 f29d209d 006bcdf4 0d62dff1 ffffffff 00000000 ffffffff ffffffff 
       c0654e68 fffffffe ffffffff c0654785 fffffffe ffffffff f29d209d c06b4df4 
       c0654e6a f2f69480 c04f43d5 f7fd2e9c f7fd2e9c c04f18c4 f29d209d c0654e5d 
Call Trace:
 [<c04f43d5>] sprintf+0x1d/0x20
 [<c04f18c4>] kobject_uevent_env+0x19d/0x3fb
 [<c048cf4e>] dentry_iput+0x68/0x83
 [<c048dac2>] dput+0x22/0xed
 [<c0561722>] device_del+0x133/0x14e
 [<c0561745>] device_unregister+0x8/0x10
 [<c05941c6>] usb_remove_ep_files+0x4c/0x6e
 [<c0430030>] do_tkill+0x85/0xf2
 [<c0593e07>] usb_remove_sysfs_dev_files+0xf/0x6c
 [<c058e191>] usb_disconnect+0x98/0xd0
 [<c058ec43>] hub_thread+0x325/0x97d
 [<c0436f53>] autoremove_wake_function+0x0/0x2d
 [<c058e91e>] hub_thread+0x0/0x97d
 [<c0436e8e>] kthread+0xc0/0xee
 [<c0436dce>] kthread+0x0/0xee
 [<c0405c87>] kernel_thread_helper+0x7/0x10
 =======================
Code: e8 06 02 00 00 89 d9 ff 44 24 40 83 c4 20 eb 05 8b 0f 83 c7 04 81 f9 ff 0f 00 00 b8 15 4f 65 c0 8b 54 24 1c 0f 46 c8 89 c8 eb 06 <80> 38 00 74 07 40 4a 83 fa ff 75 f4 29 c8 f6 44 24 14 10 89 c3 
EIP: [<c04f41d8>] vsnprintf+0x344/0x4db SS:ESP 0068:f7fd2e3c