git: 401be0a0cdda - stable/15 - pfil: Avoid potential mbuf tag leak

The branch stable/15 has been updated by kbowling:

URL: https://cgit.FreeBSD.org/src/commit/?id=401be0a0cdda89ac815600ffe210be08bdc86c8e

commit 401be0a0cdda89ac815600ffe210be08bdc86c8e
Author:     Andrew Gallatin <gallatin@FreeBSD.org>
AuthorDate: 2026-10-13 13:01:26 +0000
Commit:     Kevin Bowling <kbowling@FreeBSD.org>
CommitDate: 2026-10-30 17:47:23 +0000

    pfil: Avoid potential mbuf tag leak
    
    In '398254f9999e mbuf: simplify m_free' we removed tag processing
    on m_free() of M_NOFREE mbufs. It is possible that a packet filter
    could attach a tag to this stack mbuf and call m_free()
    on it, meaning that 398254f9999e may have introduced a tag leak.
    
    However,if a tag is attached without anyone calling m_free(), then
    this leak was pre-existing.
    
    Reviewed by: glebius
    Differential Revision: https://reviews.freebsd.org/D60686
    Fixes: 398254f9999e
    Sponsored by: Netflix
    
    (cherry picked from commit f4ff995e361fa72cea240c4dbac2d0931965c80f)
---
 sys/net/pfil.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sys/net/pfil.c b/sys/net/pfil.c
index fae150839eb3..400ea4d97fb4 100644
--- a/sys/net/pfil.c
+++ b/sys/net/pfil.c
@@ -139,6 +139,8 @@ pfil_fake_mbuf(pfil_mbuf_chk_t func, void *mem, u_int len, struct ifnet *ifp,
 		 */
 		rv = PFIL_REALLOCED;
 	}
+	if (!SLIST_EMPTY(&m.m_pkthdr.tags))
+		m_tag_delete_chain(&m, NULL);
 
 	return (rv);
 }