panic when removing pccard

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I experience the following panic on a few days old -current :

If i insert and then remove a pcmcia card using the ubsa module
(Vodafone Mobile Connect, which actually is Huawei E630 UMTS/HSDPA modem)
the machine panics, because i think the order of removal of the devices
by the kernel is not correct. I'm not sure because i don't have -STABLE
machine with pcmcia now, but i think this problem does not exist there.

Here is what happens when card is inserted :

ohci0: <NEC uPD 9210 USB controller> mem 0xc0212000-0xc0212fff irq 11 at
device 0.0 on cardbus0
ohci0: [GIANT-LOCKED]
ohci0: [ITHREAD]
usb4: OHCI version 1.0
usb4: <NEC uPD 9210 USB controller> on ohci0
usb4: USB revision 1.0
uhub4: <NEC OHCI root hub, class 9/0, rev 1.00/1.00, addr 1> on usb4
uhub4: 1 port with 1 removable, self powered
ohci1: <NEC uPD 9210 USB controller> mem 0xc0213000-0xc0213fff irq 11 at
device 0.1 on cardbus0
ohci1: [GIANT-LOCKED]
ohci1: [ITHREAD]
usb5: OHCI version 1.0
usb5: <NEC uPD 9210 USB controller> on ohci1
usb5: USB revision 1.0
uhub5: <NEC OHCI root hub, class 9/0, rev 1.00/1.00, addr 1> on usb5
uhub5: 1 port with 1 removable, self powered
ucom0: <HUAWEI Technologies HUAWEI Mobile, class 0/0, rev 1.10/0.00,
addr 2> on uhub4
ucom0: HUAWEI Technologies HUAWEI Mobile, rev 1.10/0.00, addr 2

Then card eject :

ucom0: detached
(null): at uhub4 port 1 (addr 2) disconnected


Fatal trap 12: page fault while in kernel mode
fault virtual address   = 0x400
fault code              = supervisor read, page not present
instruction pointer     = 0x20:0xc0661e84
stack pointer           = 0x28:0xd4d63b4c
frame pointer           = 0x28:0xd4d63b6c
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, def32 1, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 31 (cbb0 event thread)
[thread pid 31 tid 100027 ]
Stopped at kobj_delete+0x14:      movl    0x400(%eax),%ebx
db> bt
Tracing pid 31 tid 100027 td 0xc2a76440
kobj_delete(c2ef0000,c0955ce0,c2ef0000cc2eeee00,d4d63bac,...) at
kobj_delete+0x14
device_delete_child(c2eef400,c2ef0000,c2bdfc80,c2bdfc80,4,...) at
device_delete_child+0x94
usb_disconnect_port(c2eefab0,c2eef400,c0955c60,c2bdfbd0,c2eefa80,...) at
usb_disconnect_port+0xdc
uhub_detach(c2eef400,c29c6850,c094c12c,d4d63c00,c065ca19,...) at
uhub_detach+0x74
device_detach(c2eef400,c2ef0000,c2ef3000,c2eef200,d4d63c30,...) at
device_detach+0x68
device_delete_child(c2eef200,c2eef400,c2ef3000,c2eeed00,d4d63c50,...) at
device_delete_child+0x31
device_delete_child(c2eeed00,c2eef200,c2935060,d4d63c50,c2eeed00,...) at
device_delete_child+0x1c
ohci_pci_detach(c2eeed00,c29b5050,c094c12c,c065a875,8,...) at
ohci_pci_detach+0xb1
device_detach(c2eeed00,d4d63cb0,d4d63cb4,c2a76440,d4d63cc4,...) at
device_detach+0x68
cardbus_detach_card(c2a7aa80,c2a5bbd4,fa,202,0,...) at
cardbus_detach_card+0xcd
cbb_event_thread(c2a5b800,d4d63d38,0,0,0,...) at cbb_event_thread+0x1a9
fork_exit(c05643a0,c2a5b800,d4d63d38) at fork_exit+0x2a
fork_trampoline() at fork_trampoline+0x8
- --- trap 0, eip = 0, esp = 0xd4d63d70, ebp = 0 ---
db>

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (FreeBSD)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFGaRPwHNAJ/fLbfrkRAvBBAKDBvNUcw8MlcqKRfXCgfxAicdOeCgCeOkDx
UPIkSmz66g2e4wWSqCiab4I=
=t5Xr
-----END PGP SIGNATURE-----