git: 3543b9600cb8 - stable/15 - iflib: null out freed mbuf in iflib_txsd_free

The branch stable/15 has been updated by kbowling:

URL: https://cgit.FreeBSD.org/src/commit/?id=3543b9600cb89c20e053abf23c8f016d2eaae804

commit 3543b9600cb89c20e053abf23c8f016d2eaae804
Author:     Andrew Gallatin <gallatin@FreeBSD.org>
AuthorDate: 2026-01-19 15:41:02 +0000
Commit:     Kevin Bowling <kbowling@FreeBSD.org>
CommitDate: 2026-10-29 05:38:10 +0000

    iflib: null out freed mbuf in iflib_txsd_free
    
    When adding the IFLIB_GET_MBUF/FLAGS, I neglected to NULL out the
    mbuf in the descriptor ring.  I didn't think this should matter as
    the I thought this code was only used when the ring was about
    to be freed. But I was wrong, and leaving a stale mbuf in there can
    cause panics.
    
    Reported by:  Marek Zarychta (https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=292547)
    Fixes: 14d93f612f26
    Sponsored by: Netflix
    
    (cherry picked from commit d91ae61f8fc2dd4ab3c208f25570b91a0725e2e4)
---
 sys/net/iflib.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sys/net/iflib.c b/sys/net/iflib.c
index 7bd10487afe1..910694ebf336 100644
--- a/sys/net/iflib.c
+++ b/sys/net/iflib.c
@@ -2084,6 +2084,7 @@ iflib_txsd_free(if_ctx_t ctx, iflib_txq_t txq, int i)
 		bus_dmamap_unload(txq->ift_tso_buf_tag,
 		    txq->ift_sds.ifsd_tso_map[i]);
 	}
+	txq->ift_sds.ifsd_m[i] = NULL;
 	m_freem(m);
 	DBG_COUNTER_INC(tx_frees);
 }