Explicitly hold a reference to the cdev we have just cloned. This

closes the race where the cdev was reclaimed before it ever made it
back to devfs lookup.

16 files changed, 26 insertions, 5 deletions

diff --git a/sys/cam/scsi/scsi_target.c b/sys/cam/scsi/scsi_target.c
index 6b07425..b60c805 100644
--- a/sys/cam/scsi/scsi_target.c
+++ b/sys/cam/scsi/scsi_target.c
@@ -1035,6 +1035,7 @@ targclone(void *arg, char *name, int namelen, struct cdev **dev)
 		return;
 	*dev = make_dev(&targ_cdevsw, unit2minor(u), UID_ROOT, GID_WHEEL,
 			0600, "targ%d", u);
+	dev_ref(*dev);
 	(*dev)->si_flags |= SI_CHEAPCLONE;
 }
 
diff --git a/sys/coda/coda_fbsd.c b/sys/coda/coda_fbsd.c
index d68b63f..ac6ad48 100644
--- a/sys/coda/coda_fbsd.c
+++ b/sys/coda/coda_fbsd.c
@@ -120,6 +120,7 @@ static void coda_fbsd_clone(arg, name, namelen, dev)
 	return;
 
     *dev = make_dev(&codadevsw,unit2minor(u),UID_ROOT,GID_WHEEL,0600,"cfs%d",u);
+    dev_ref(*dev);
     mnt = malloc(sizeof(struct coda_mntinfo), M_CODA, M_WAITOK|M_ZERO);
     LIST_INSERT_HEAD(&coda_mnttbl, mnt, mi_list);
 }
diff --git a/sys/dev/firewire/fwdev.c b/sys/dev/firewire/fwdev.c
index 79c74af..ecd56c4 100644
--- a/sys/dev/firewire/fwdev.c
+++ b/sys/dev/firewire/fwdev.c
@@ -875,6 +875,7 @@ found:
 	*dev = make_dev(&firewire_cdevsw, MAKEMINOR(devflag[i], unit, sub),
 		       UID_ROOT, GID_OPERATOR, 0660,
 		       "%s%d.%d", devnames[i], unit, sub);
+	dev_ref(*dev);
 	(*dev)->si_flags |= SI_CHEAPCLONE;
 	dev_depends(sc->dev, *dev);
 	return;
diff --git a/sys/dev/nmdm/nmdm.c b/sys/dev/nmdm/nmdm.c
index cd3b5f3..e61a05f 100644
--- a/sys/dev/nmdm/nmdm.c
+++ b/sys/dev/nmdm/nmdm.c
@@ -147,6 +147,7 @@ nmdm_clone(void *arg, char *name, int nameen, struct cdev **dev)
 		*dev = d1->si_drv2;
 	else
 		*dev = d1;
+	dev_ref(*dev);
 }
 
 static void
diff --git a/sys/dev/snp/snp.c b/sys/dev/snp/snp.c
index bd4bcac..8be2b19 100644
--- a/sys/dev/snp/snp.c
+++ b/sys/dev/snp/snp.c
@@ -643,8 +643,10 @@ snp_clone(arg, name, namelen, dev)
 	if (i)
 		*dev = make_dev(&snp_cdevsw, unit2minor(u),
 		     UID_ROOT, GID_WHEEL, 0600, "snp%d", u);
-	if (*dev != NULL)
+	if (*dev != NULL) {
+		dev_ref(*dev);
 		(*dev)->si_flags |= SI_CHEAPCLONE;
+	}
 }
 
 static int
diff --git a/sys/dev/sound/pcm/dsp.c b/sys/dev/sound/pcm/dsp.c
index 5d3aa52..689bec6 100644
--- a/sys/dev/sound/pcm/dsp.c
+++ b/sys/dev/sound/pcm/dsp.c
@@ -1174,6 +1174,7 @@ dsp_clone(void *arg, char *name, int namelen, struct cdev **dev)
 
 		if ((pdev->si_drv1 == NULL) && (pdev->si_drv2 == NULL)) {
 			*dev = pdev;
+			dev_ref(*dev);
 			return;
 		}
 	}
diff --git a/sys/dev/sound/pcm/mixer.c b/sys/dev/sound/pcm/mixer.c
index 5846847..9feccf6 100644
--- a/sys/dev/sound/pcm/mixer.c
+++ b/sys/dev/sound/pcm/mixer.c
@@ -494,8 +494,10 @@ mixer_clone(void *arg, char *name, int namelen, struct cdev **dev)
 		return;
 	if (strcmp(name, "mixer") == 0) {
 		sd = devclass_get_softc(pcm_devclass, snd_unit);
-		if (sd != NULL)
+		if (sd != NULL) {
 			*dev = sd->mixer_dev;
+			dev_ref(*dev);
+		}
 	}
 }
 
diff --git a/sys/dev/vkbd/vkbd.c b/sys/dev/vkbd/vkbd.c
index 57a40ed..a02dd3a 100644
--- a/sys/dev/vkbd/vkbd.c
+++ b/sys/dev/vkbd/vkbd.c
@@ -168,8 +168,10 @@ vkbd_dev_clone(void *arg, char *name, int namelen, struct cdev **dev)
 	if (clone_create(&vkbd_dev_clones, &vkbd_dev_cdevsw, &unit, dev, 0)) {
 		*dev = make_dev(&vkbd_dev_cdevsw, unit2minor(unit),
 			UID_ROOT, GID_WHEEL, 0600, DEVICE_NAME "%d", unit);
-		if (*dev != NULL)
+		if (*dev != NULL) {
+			dev_ref(*dev);
 			(*dev)->si_flags |= SI_CHEAPCLONE;
+		}
 	}
 }
 
diff --git a/sys/fs/coda/coda_fbsd.c b/sys/fs/coda/coda_fbsd.c
index d68b63f..ac6ad48 100644
--- a/sys/fs/coda/coda_fbsd.c
+++ b/sys/fs/coda/coda_fbsd.c
@@ -120,6 +120,7 @@ static void coda_fbsd_clone(arg, name, namelen, dev)
 	return;
 
     *dev = make_dev(&codadevsw,unit2minor(u),UID_ROOT,GID_WHEEL,0600,"cfs%d",u);
+    dev_ref(*dev);
     mnt = malloc(sizeof(struct coda_mntinfo), M_CODA, M_WAITOK|M_ZERO);
     LIST_INSERT_HEAD(&coda_mnttbl, mnt, mi_list);
 }
diff --git a/sys/fs/devfs/devfs_vnops.c b/sys/fs/devfs/devfs_vnops.c
index 8c100ef..90139c2 100644
--- a/sys/fs/devfs/devfs_vnops.c
+++ b/sys/fs/devfs/devfs_vnops.c
@@ -655,6 +655,7 @@ devfs_lookupx(ap)
 	devfs_populate(dmp);
 
 	dde = devfs_itode(dmp, cdev->si_inode);
+	dev_rel(cdev);
 
 	if (dde == NULL || *dde == NULL || *dde == DE_DELETED)
 		goto notfound;
diff --git a/sys/kern/tty_pty.c b/sys/kern/tty_pty.c
index 21d47e2..3a53294 100644
--- a/sys/kern/tty_pty.c
+++ b/sys/kern/tty_pty.c
@@ -710,6 +710,7 @@ pty_clone(void *arg, char *name, int namelen, struct cdev **dev)
 		return;
 	*dev = make_dev(&ptc_cdevsw, u,
 	    UID_ROOT, GID_WHEEL, 0666, "pty%c%r", names[u / 32], u % 32);
+	dev_ref(*dev);
 	(*dev)->si_flags |= SI_CHEAPCLONE;
 	return;
 }
diff --git a/sys/kern/tty_tty.c b/sys/kern/tty_tty.c
index c813211..8951e99 100644
--- a/sys/kern/tty_tty.c
+++ b/sys/kern/tty_tty.c
@@ -65,6 +65,7 @@ ctty_clone(void *arg, char *name, int namelen, struct cdev **dev)
 		*dev = ctty;
 	else
 		*dev = curthread->td_proc->p_session->s_ttyvp->v_rdev;
+	dev_ref(*dev);
 }
 
 static void
diff --git a/sys/net/bpf.c b/sys/net/bpf.c
index 7708504..3cce6e8 100644
--- a/sys/net/bpf.c
+++ b/sys/net/bpf.c
@@ -1605,6 +1605,7 @@ bpf_clone(arg, name, namelen, dev)
 		return;
 	*dev = make_dev(&bpf_cdevsw, unit2minor(u), UID_ROOT, GID_WHEEL, 0600,
 	    "bpf%d", u);
+	dev_ref(*dev);
 	(*dev)->si_flags |= SI_CHEAPCLONE;
 	return;
 }
diff --git a/sys/net/if_tap.c b/sys/net/if_tap.c
index 46fd276..601b95d 100644
--- a/sys/net/if_tap.c
+++ b/sys/net/if_tap.c
@@ -253,8 +253,10 @@ tapclone(arg, name, namelen, dev)
 	if (i) {
 		*dev = make_dev(&tap_cdevsw, unit2minor(unit | extra),
 		     UID_ROOT, GID_WHEEL, 0600, "%s%d", device_name, unit);
-		if (*dev != NULL)
+		if (*dev != NULL) {
+			dev_ref(*dev);
 			(*dev)->si_flags |= SI_CHEAPCLONE;
+		}
 	}
 } /* tapclone */
 
diff --git a/sys/net/if_tun.c b/sys/net/if_tun.c
index 8936110..6fe7b10 100644
--- a/sys/net/if_tun.c
+++ b/sys/net/if_tun.c
@@ -155,8 +155,10 @@ tunclone(void *arg, char *name, int namelen, struct cdev **dev)
 		/* No preexisting struct cdev *, create one */
 		*dev = make_dev(&tun_cdevsw, unit2minor(u),
 		    UID_UUCP, GID_DIALER, 0600, "tun%d", u);
-		if (*dev != NULL)
+		if (*dev != NULL) {
+			dev_ref(*dev);
 			(*dev)->si_flags |= SI_CHEAPCLONE;
+		}
 	}
 }
 
diff --git a/sys/netsmb/smb_dev.c b/sys/netsmb/smb_dev.c
index 5a3dbf7..89a1676 100644
--- a/sys/netsmb/smb_dev.c
+++ b/sys/netsmb/smb_dev.c
@@ -109,6 +109,7 @@ nsmb_dev_clone(void *arg, char *name, int namelen, struct cdev **dev)
 		return;
 	*dev = make_dev(&nsmb_cdevsw, unit2minor(u), 0, 0, 0600,
 	    NSMB_NAME"%d", u);
+	dev_ref(*dev);
 }
 
 static int