diff --git a/sys/dev/xen/netfront/netfront.c b/sys/dev/xen/netfront/netfront.c index dafb838cf32..da0f1680a87 100644 --- a/sys/dev/xen/netfront/netfront.c +++ b/sys/dev/xen/netfront/netfront.c @@ -335,8 +335,16 @@ static void mbuf_release(struct mbuf *m) KASSERT(ref != NULL, ("Cannot find refcount")); KASSERT(ref->count > 0, ("Invalid reference count")); - if (--ref->count == 0) + if (--ref->count == 0) { + /* + * Explicitly free the tag while we hold the tx queue lock. + * This ensures that the tag is deleted promptly in case + * something else is holding extra references to the mbuf chain, + * such as netmap. + */ + m_tag_delete(m, &ref->tag); m_freem(m); + } } static void tag_free(struct m_tag *t)