> device_unregister(cm_dev->device); > + kfree(cm_dev); Is this really correct? Couldn't something (eg an open file from sysfs) still have a reference to cm_dev->device even after device_unregister() returns, in which case this ends up freeing an object that's still live?