iflib: null out freed mbuf in iflib_txsd_free

When adding the IFLIB_GET_MBUF/FLAGS, I neglected to NULL out the
mbuf in the descriptor ring.  I didn't think this should matter as
the I thought this code was only used when the ring was about
to be freed. But I was wrong, and leaving a stale mbuf in there can
cause panics.

Reported by:  Marek Zarychta (https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=292547)
Fixes: 14d93f612f26
Sponsored by: Netflix

1 files changed, 1 insertions, 0 deletions

diff --git a/sys/net/iflib.c b/sys/net/iflib.c
index 5c37f199e84c..b0e4bb9470c9 100644
--- a/sys/net/iflib.c
+++ b/sys/net/iflib.c
@@ -1890,6 +1890,7 @@ iflib_txsd_free(if_ctx_t ctx, iflib_txq_t txq, int i)
 		bus_dmamap_unload(txq->ift_tso_buf_tag,
 		    txq->ift_sds.ifsd_tso_map[i]);
 	}
+	txq->ift_sds.ifsd_m[i] = NULL;
 	m_freem(m);
 	DBG_COUNTER_INC(tx_frees);
 }