1 files changed, 9 insertions, 1 deletions

diff --git a/sys/dev/xen/netfront/netfront.c b/sys/dev/xen/netfront/netfront.c
index dafb838cf328..da0f1680a87e 100644
--- a/sys/dev/xen/netfront/netfront.c
+++ b/sys/dev/xen/netfront/netfront.c
@@ -335,8 +335,16 @@ static void mbuf_release(struct mbuf *m)
 	KASSERT(ref != NULL, ("Cannot find refcount"));
 	KASSERT(ref->count > 0, ("Invalid reference count"));
 
-	if (--ref->count == 0)
+	if (--ref->count == 0) {
+		/*
+		 * Explicitly free the tag while we hold the tx queue lock.
+		 * This ensures that the tag is deleted promptly in case
+		 * something else is holding extra references to the mbuf chain,
+		 * such as netmap.
+		 */
+		m_tag_delete(m, &ref->tag);
 		m_freem(m);
+	}
 }
 
 static void tag_free(struct m_tag *t)