The branch main has been updated by kib: URL: https://cgit.FreeBSD.org/src/commit/?id=c5a96f09df32810319d39cb905662ad7504ecd7b
commit c5a96f09df32810319d39cb905662ad7504ecd7b Author: Konstantin Belousov <k...@freebsd.org> AuthorDate: 2025-03-06 17:36:56 +0000 Commit: Konstantin Belousov <k...@freebsd.org> CommitDate: 2025-03-10 20:16:58 +0000 mb_unmapped_to_ext(): fix m_free()/m_freem() use The top of the chain is supposed to be freed in mb_unmapped_to_ext(), use m_freem(). The _mb_unmapped_to_ext() helper only needs to work on the passed mbuf, use m_free(). Reviewed by: glebius Sponsored by: NVidia networking MFC after: 1 week Differential revision: https://reviews.freebsd.org/D49305 --- sys/kern/kern_mbuf.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sys/kern/kern_mbuf.c b/sys/kern/kern_mbuf.c index 26be33658ab9..2b2b032e644c 100644 --- a/sys/kern/kern_mbuf.c +++ b/sys/kern/kern_mbuf.c @@ -950,7 +950,7 @@ _mb_unmapped_to_ext(struct mbuf *m, struct mbuf **mres) if (m->m_epg_tls != NULL) { /* can't convert TLS mbuf */ - m_freem(m); + m_free(m); *mres = NULL; return (EINVAL); } @@ -1099,7 +1099,7 @@ mb_unmapped_to_ext(struct mbuf *top, struct mbuf **mres) error = _mb_unmapped_to_ext(m, &m1); if (error != 0) { if (top != m) - m_free(top); + m_freem(top); m_freem(next); *mres = NULL; return (error);