m_tag leak?

[JINMEI Tatuya / 神明達哉]

While tracking a different issue, I felt I just got confused.  From a
very quick look at m_freem() and m_free(), it looks there is a leakage
of m_tag.  This is the definition of m_freem() in rev. 1.160 of
uipc_mbuf.c:

void
m_freem(struct mbuf *mb)
{

	while (mb != NULL)
		mb = m_free(mb);
}

And the following is the definition of m_free() (defined in
sys/mbuf.h, rev 1.187)

static __inline
struct mbuf *
m_free(struct mbuf *m)
{
	struct mbuf *n = m->m_next;

	if (m->m_flags & M_EXT)
		mb_free_ext(m);
	else
		uma_zfree(zone_mbuf, m);
	return n;
}

Doesn't this mean an m_tag attached to the mbuf to be freed, if any,
will remain without any reference?  Perhaps I'm missing something very
trivial.  It would be appreciated if someone could clarify that.

Thanks,

					JINMEI, Tatuya
					Communication Platform Lab.
					Corporate R&D Center, Toshiba Corp.
					jinmei at isl.rdc.toshiba.co.jp