[Bug 273418] [panic] Repeating kernel panic on open(/dev/console)

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=273418

--- Comment #38 from Konstantin Belousov <kib@FreeBSD.org> ---
Or better, this one.  Previous patch would leak refcount on non-cloned cdevs.

commit 0da5656dd70cd5a41c7fb3f4f1c5b8d7f72b9801
Author: Konstantin Belousov <kib@FreeBSD.org>
Date:   Thu Sep 21 13:47:14 2023 +0300

    tun/tap: correct ref count on cloned cdevs

    PR:     273418

    (cherry picked from commit 07fda41d2a2df0d0d422f30a8a2353de5f0d9c3e)

diff --git a/sys/net/if_tuntap.c b/sys/net/if_tuntap.c
index b81c2149a62f..723749c0dca9 100644
--- a/sys/net/if_tuntap.c
+++ b/sys/net/if_tuntap.c
@@ -541,6 +541,8 @@ tun_clone_create(struct if_clone *ifc, char *name, size_t
len, caddr_t params)
        /* find any existing device, or allocate new unit number */
        dev = NULL;
        i = clone_create(&drv->clones, &drv->cdevsw, &unit, &dev, 0);
+       if (i == 0)
+               dev_ref(dev);
        /* No preexisting struct cdev *, create one */
        if (i != 0)
                i = tun_create_device(drv, unit, NULL, &dev, name);
@@ -596,6 +598,8 @@ tunclone(void *arg, struct ucred *cred, char *name, int
namelen,

        /* find any existing device, or allocate new unit number */
        i = clone_create(&drv->clones, &drv->cdevsw, &u, dev, 0);
+       if (i == 0) {
+               dev_ref(*dev);
        if (i) {
                if (append_unit) {
                        namelen = snprintf(devname, sizeof(devname), "%s%d",

-- 
You are receiving this mail because:
You are the assignee for the bug.