- Denote a few places where kobj class references are manipulated without

  holding the appropriate lock.
- Add a comment explaining why we bump a driver's kobj class reference
  when loading a module.

2 files changed, 6 insertions, 4 deletions

diff --git a/sys/kern/kern_linker.c b/sys/kern/kern_linker.c
index 49ad88b..53479e1 100644
--- a/sys/kern/kern_linker.c
+++ b/sys/kern/kern_linker.c
@@ -141,13 +141,14 @@ linker_add_class(linker_class_t lc)
 {
 
 	/*
-	 * We disallow any class registration passt SI_ORDER_ANY
-	 * of SI_SUB_KLD.
+	 * We disallow any class registration past SI_ORDER_ANY
+	 * of SI_SUB_KLD.  We bump the reference count to keep the
+	 * ops from being freed.
 	 */
 	if (linker_no_more_classes == 1)
 		return (EPERM);
 	kobj_class_compile((kobj_class_t) lc);
-	((kobj_class_t)lc)->refs++;	/* prevent ops being freed */
+	((kobj_class_t)lc)->refs++;	/* XXX: kobj_mtx */
 	TAILQ_INSERT_TAIL(&classes, lc, link);
 	return (0);
 }
diff --git a/sys/kern/subr_bus.c b/sys/kern/subr_bus.c
index 9edcbae..306e0d3 100644
--- a/sys/kern/subr_bus.c
+++ b/sys/kern/subr_bus.c
@@ -850,7 +850,7 @@ devclass_add_driver(devclass_t dc, driver_t *driver)
 
 	dl->driver = driver;
 	TAILQ_INSERT_TAIL(&dc->drivers, dl, link);
-	driver->refs++;
+	driver->refs++;		/* XXX: kobj_mtx */
 
 	/*
 	 * Call BUS_DRIVER_ADDED for any existing busses in this class.
@@ -930,6 +930,7 @@ devclass_delete_driver(devclass_t busclass, driver_t *driver)
 	TAILQ_REMOVE(&busclass->drivers, dl, link);
 	free(dl, M_BUS);
 
+	/* XXX: kobj_mtx */
 	driver->refs--;
 	if (driver->refs == 0)
 		kobj_class_free((kobj_class_t) driver);