Explicitly hold a reference to the cdev we have just cloned. This

closes the race where the cdev was reclaimed before it ever made it
back to devfs lookup.

6 files changed, 12 insertions, 3 deletions

diff --git a/sys/dev/firewire/fwdev.c b/sys/dev/firewire/fwdev.c
index 79c74af..ecd56c4 100644
--- a/sys/dev/firewire/fwdev.c
+++ b/sys/dev/firewire/fwdev.c
@@ -875,6 +875,7 @@ found:
 	*dev = make_dev(&firewire_cdevsw, MAKEMINOR(devflag[i], unit, sub),
 		       UID_ROOT, GID_OPERATOR, 0660,
 		       "%s%d.%d", devnames[i], unit, sub);
+	dev_ref(*dev);
 	(*dev)->si_flags |= SI_CHEAPCLONE;
 	dev_depends(sc->dev, *dev);
 	return;
diff --git a/sys/dev/nmdm/nmdm.c b/sys/dev/nmdm/nmdm.c
index cd3b5f3..e61a05f 100644
--- a/sys/dev/nmdm/nmdm.c
+++ b/sys/dev/nmdm/nmdm.c
@@ -147,6 +147,7 @@ nmdm_clone(void *arg, char *name, int nameen, struct cdev **dev)
 		*dev = d1->si_drv2;
 	else
 		*dev = d1;
+	dev_ref(*dev);
 }
 
 static void
diff --git a/sys/dev/snp/snp.c b/sys/dev/snp/snp.c
index bd4bcac..8be2b19 100644
--- a/sys/dev/snp/snp.c
+++ b/sys/dev/snp/snp.c
@@ -643,8 +643,10 @@ snp_clone(arg, name, namelen, dev)
 	if (i)
 		*dev = make_dev(&snp_cdevsw, unit2minor(u),
 		     UID_ROOT, GID_WHEEL, 0600, "snp%d", u);
-	if (*dev != NULL)
+	if (*dev != NULL) {
+		dev_ref(*dev);
 		(*dev)->si_flags |= SI_CHEAPCLONE;
+	}
 }
 
 static int
diff --git a/sys/dev/sound/pcm/dsp.c b/sys/dev/sound/pcm/dsp.c
index 5d3aa52..689bec6 100644
--- a/sys/dev/sound/pcm/dsp.c
+++ b/sys/dev/sound/pcm/dsp.c
@@ -1174,6 +1174,7 @@ dsp_clone(void *arg, char *name, int namelen, struct cdev **dev)
 
 		if ((pdev->si_drv1 == NULL) && (pdev->si_drv2 == NULL)) {
 			*dev = pdev;
+			dev_ref(*dev);
 			return;
 		}
 	}
diff --git a/sys/dev/sound/pcm/mixer.c b/sys/dev/sound/pcm/mixer.c
index 5846847..9feccf6 100644
--- a/sys/dev/sound/pcm/mixer.c
+++ b/sys/dev/sound/pcm/mixer.c
@@ -494,8 +494,10 @@ mixer_clone(void *arg, char *name, int namelen, struct cdev **dev)
 		return;
 	if (strcmp(name, "mixer") == 0) {
 		sd = devclass_get_softc(pcm_devclass, snd_unit);
-		if (sd != NULL)
+		if (sd != NULL) {
 			*dev = sd->mixer_dev;
+			dev_ref(*dev);
+		}
 	}
 }
 
diff --git a/sys/dev/vkbd/vkbd.c b/sys/dev/vkbd/vkbd.c
index 57a40ed..a02dd3a 100644
--- a/sys/dev/vkbd/vkbd.c
+++ b/sys/dev/vkbd/vkbd.c
@@ -168,8 +168,10 @@ vkbd_dev_clone(void *arg, char *name, int namelen, struct cdev **dev)
 	if (clone_create(&vkbd_dev_clones, &vkbd_dev_cdevsw, &unit, dev, 0)) {
 		*dev = make_dev(&vkbd_dev_cdevsw, unit2minor(unit),
 			UID_ROOT, GID_WHEEL, 0600, DEVICE_NAME "%d", unit);
-		if (*dev != NULL)
+		if (*dev != NULL) {
+			dev_ref(*dev);
 			(*dev)->si_flags |= SI_CHEAPCLONE;
+		}
 	}
 }