svn commit: r296292 - head/sys/kern

[Gleb Smirnoff]

Author: glebius
Date: Wed Mar  2 02:12:01 2016
New Revision: 296292
URL: https://svnweb.freebsd.org/changeset/base/296292

Log:
  Fix regression in r296242 affecting several drivers. For EXT_NET_DRV,
  EXT_MOD_TYPE, EXT_DISPOSABLE types we should first execute the free
  callback, then free the mbuf, otherwise we will derefernce memory that
  was just freed.
  
  Reported and tested:	jhibbits

Modified:
  head/sys/kern/kern_mbuf.c

Modified: head/sys/kern/kern_mbuf.c
==============================================================================
--- head/sys/kern/kern_mbuf.c	Wed Mar  2 01:40:47 2016	(r296291)
+++ head/sys/kern/kern_mbuf.c	Wed Mar  2 02:12:01 2016	(r296292)
@@ -677,8 +677,12 @@ mb_free_ext(struct mbuf *m)
 		case EXT_NET_DRV:
 		case EXT_MOD_TYPE:
 		case EXT_DISPOSABLE:
+			KASSERT(m->m_ext.ext_free != NULL,
+				("%s: ext_free not set", __func__));
+			(*(m->m_ext.ext_free))(m, m->m_ext.ext_arg1,
+			    m->m_ext.ext_arg2);
 			uma_zfree(zone_mbuf, mref);
-			/* FALLTHROUGH */
+			break;
 		case EXT_EXTREF:
 			KASSERT(m->m_ext.ext_free != NULL,
 				("%s: ext_free not set", __func__));