git: 22ba29707664 - stable/13 - mbuf(9): Assert receive mbufs don't carry a send tag.

The branch stable/13 has been updated by hselasky:

URL: https://cgit.FreeBSD.org/src/commit/?id=22ba297076646544a51c888589fa87e373c78bbf

commit 22ba297076646544a51c888589fa87e373c78bbf
Author:     Hans Petter Selasky <hselasky@FreeBSD.org>
AuthorDate: 2022-01-26 11:13:53 +0000
Commit:     Hans Petter Selasky <hselasky@FreeBSD.org>
CommitDate: 2022-02-10 15:11:22 +0000

    mbuf(9): Assert receive mbufs don't carry a send tag.
    
    Else we would start leaking reference counts.
    
    Discussed with: jhb@
    Sponsored by:   NVIDIA Networking
    
    (cherry picked from commit 17cbcf33c3b6d0361d71bdb00b8633ec9bb5ae53)
---
 sys/kern/uipc_mbuf.c    | 1 +
 sys/kern/uipc_sockbuf.c | 1 +
 sys/sys/mbuf.h          | 6 ++++++
 3 files changed, 8 insertions(+)

diff --git a/sys/kern/uipc_mbuf.c b/sys/kern/uipc_mbuf.c
index d78bddb284f4..13c98d0895fa 100644
--- a/sys/kern/uipc_mbuf.c
+++ b/sys/kern/uipc_mbuf.c
@@ -253,6 +253,7 @@ m_demote_pkthdr(struct mbuf *m)
 {
 
 	M_ASSERTPKTHDR(m);
+	M_ASSERT_NO_SND_TAG(m);
 
 	m_tag_delete_chain(m, NULL);
 	m->m_flags &= ~M_PKTHDR;
diff --git a/sys/kern/uipc_sockbuf.c b/sys/kern/uipc_sockbuf.c
index d4db19598392..80505dd4dbd2 100644
--- a/sys/kern/uipc_sockbuf.c
+++ b/sys/kern/uipc_sockbuf.c
@@ -1144,6 +1144,7 @@ sbappendaddr_locked_internal(struct sockbuf *sb, const struct sockaddr *asa,
 	m->m_len = asa->sa_len;
 	bcopy(asa, mtod(m, caddr_t), asa->sa_len);
 	if (m0) {
+		M_ASSERT_NO_SND_TAG(m0);
 		m_clrprotoflags(m0);
 		m_tag_delete_chain(m0, NULL);
 		/*
diff --git a/sys/sys/mbuf.h b/sys/sys/mbuf.h
index dac06069c65a..427c6c9b36e5 100644
--- a/sys/sys/mbuf.h
+++ b/sys/sys/mbuf.h
@@ -1109,6 +1109,12 @@ m_extrefcnt(struct mbuf *m)
 	KASSERT((m) != NULL && (m)->m_flags & M_PKTHDR,			\
 	    ("%s: no mbuf packet header!", __func__))
 
+/* Check if the supplied mbuf has no send tag, or else panic. */
+#define	M_ASSERT_NO_SND_TAG(m)						\
+	KASSERT((m) == NULL || ((m)->m_flags & M_PKTHDR) == 0 ||	\
+	       ((m)->m_pkthdr.csum_flags & CSUM_SND_TAG) == 0,		\
+	    ("%s: receive mbuf has send tag!", __func__))
+
 /* Check if mbuf is multipage. */
 #define M_ASSERTEXTPG(m)						\
 	KASSERT(((m)->m_flags & (M_EXTPG|M_PKTHDR)) == M_EXTPG,		\