mbuf(9): Assert receive mbufs don't carry a send tag.

Else we would start leaking reference counts.

Discussed with:	jhb@
MFC after:	1 week
Sponsored by:	NVIDIA Networking

sys/kern/uipc_mbuf.c

@@ -263,6 +263,7 @@ m_demote_pkthdr(struct mbuf *m)
 {
 
 	M_ASSERTPKTHDR(m);
+	M_ASSERT_NO_SND_TAG(m);
 
 	m_tag_delete_chain(m, NULL);
 	m->m_flags &= ~M_PKTHDR;

sys/kern/uipc_sockbuf.c

@@ -1144,6 +1144,7 @@ sbappendaddr_locked_internal(struct sockbuf *sb, const struct sockaddr *asa,
 	m->m_len = asa->sa_len;
 	bcopy(asa, mtod(m, caddr_t), asa->sa_len);
 	if (m0) {
+		M_ASSERT_NO_SND_TAG(m0);
 		m_clrprotoflags(m0);
 		m_tag_delete_chain(m0, NULL);
 		/*

sys/sys/mbuf.h

@@ -1139,6 +1139,12 @@ m_extrefcnt(struct mbuf *m)
 	KASSERT((m) != NULL && (m)->m_flags & M_PKTHDR,			\
 	    ("%s: no mbuf packet header!", __func__))
 
+/* Check if the supplied mbuf has no send tag, or else panic. */
+#define	M_ASSERT_NO_SND_TAG(m)						\
+	KASSERT((m) == NULL || ((m)->m_flags & M_PKTHDR) == 0 ||	\
+	       ((m)->m_pkthdr.csum_flags & CSUM_SND_TAG) == 0,		\
+	    ("%s: receive mbuf has send tag!", __func__))
+
 /* Check if mbuf is multipage. */
 #define M_ASSERTEXTPG(m)						\
 	KASSERT(((m)->m_flags & (M_EXTPG|M_PKTHDR)) == M_EXTPG,		\