Panic in devfs

Hi,

I initially forwarded this to PHK, but got no reply so I'm posting it here.

I have caught a panic related to devfs while working on the new USB stack. 
Backtrace:

uma_zalloc_arg()
malloc()
free_unr()
devfs_free()
destroy_devl()
destroy_dev()
ttyfree()
...
...

The problem is that the lock, "devmtx", see "kern_conf.c" line 61, is locked 
when allocating memory. Maybe you have to call this "free_unr()" out of 
order?

void
devfs_free(struct cdev *cdev)
{
        struct cdev_priv *cdp;

        cdp = cdev->si_priv;
        if (cdev->si_cred != NULL)
                crfree(cdev->si_cred);
        if (cdp->cdp_inode > 0)
                free_unr(devfs_inos, cdp->cdp_inode); XXX cannot call this 
here because this function allocates memory XXX
        if (cdp->cdp_maxdirent > 0) 
                free(cdp->cdp_dirents, M_DEVFS2);
        free(cdp, M_CDEVP);
}

Can someone fix this and commit a patch to head, or should I make a PR out of 
this?

--HPS