git: dfc1041c08ba - main - netmap: Fix error handling in nm_os_extmem_create()

The branch main has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=dfc1041c08ba32f24b8050b4d635a0bbbfd9b767

commit dfc1041c08ba32f24b8050b4d635a0bbbfd9b767
Author:     Mark Johnston <markj@FreeBSD.org>
AuthorDate: 2025-10-17 12:55:17 +0000
Commit:     Mark Johnston <markj@FreeBSD.org>
CommitDate: 2025-10-17 12:55:17 +0000

    netmap: Fix error handling in nm_os_extmem_create()
    
    We bump the object reference count prior to mapping it into the kernel
    map, at which point the vm_map_entry owns the reference.  Then, if
    vm_map_wire() fails, vm_map_remove() will release the reference, so we
    should avoid decrementing it in the error path.
    
    Reported by:    Ilja van Sprundel <ivansprundel@ioactive.com>
    Reviewed by:    vmaffione
    MFC after:      1 week
    Differential Revision:  https://reviews.freebsd.org/D53066
---
 sys/dev/netmap/netmap_freebsd.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sys/dev/netmap/netmap_freebsd.c b/sys/dev/netmap/netmap_freebsd.c
index 8cc543d54c2e..ac267a66d669 100644
--- a/sys/dev/netmap/netmap_freebsd.c
+++ b/sys/dev/netmap/netmap_freebsd.c
@@ -738,6 +738,7 @@ nm_os_extmem_create(unsigned long p, struct nmreq_pools_info *pi, int *perror)
 
 out_rem:
 	vm_map_remove(kernel_map, e->kva, e->kva + e->size);
+	e->obj = NULL; /* reference consumed by vm_map_remove() */
 out_rel:
 	vm_object_deallocate(e->obj);
 	e->obj = NULL;