Crash in module

[Marcus Gruendler <runner tamalin de>]

Hi,

I have a module which composes parts of a html file into a whole html file 
and delivers it to the client. In a request i can give a parameter which 
tells the module how many parts there are.

Inside my module I have to remember which part I've already sent to the 
client. I store this counter in the req->private element. Each part is stored 
in /var/www/html/<amount>/file*.html and my module just issues a 
TUX_ACTION_GET/SEND_OBJECT (yes, in the event driven way).

But when TUX reaches the first call to tux(TUX_ACTION_GET_OBJECT, req) it 
crashes whith this BUG() message:

kernel BUG at input.c:178!
invalid operand: 0000
CPU:    0
EIP:    0010:[lookup_url+1051/1288]
EFLAGS: 00010202
...
Process async IO 0/2 (pid: 768, stackpage=c0f87000)
...
Call Trace: [timer_bug_msg+19681/30016] [user_get_object+47/304] 
[tux_schedule_atom+155/164] [cachemiss_thread+204/428] [kernel_thread+40/56] 
...

What am I doing wrong? Here's the module code:

int TUXAPI_handle_events (user_req_t *req)
{
  int ret = TUX_RETURN_USERSPACE_REQUEST;

  switch (req->event) {
  case 0:
    write (req->sock, REPLY_HEADER, REPLY_HEADER_LEN);
    req->http_status = 200;
    
    if (req->query[0]) 
      req->private = (void*)0;
    else {
      ret = tux(TUX_ACTION_FINISH_CLOSE_REQ, req);
      break;
    }
    req->event = 1;
    break;

  case 1:
    if ( (long)req->private < atoi( req->query ) ) {
      req->event = 2;
      sprintf( req->objectname, "/%s/file%ld.html", req->query, 
(long)req->private );
      req->private = (void*)((long)req->private + 1);
      
      ret = tux(TUX_ACTION_GET_OBJECT, req);
    }
    else {
      ret = tux(TUX_ACTION_FINISH_CLOSE_REQ, req);
      break;
    }
    break;
  case 2:
    req->event = 1;
    ret = tux(TUX_ACTION_SEND_OBJECT, req);
    break;
  }
  return ret;
}

-- 
Marcus Gruendler
eMail: runner@tamalin.de
WWW: http://www.tamalin.de/runner/index.html