divert: Fix mbuf ownership confusion in div_output()

[markj]

Summary

div_output_outbound() and div_output_inbound() relied on the caller to
free the mbuf if an error occurred. However, this is contrary to the
semantics of their callees, ip_output(), ip6_output() and
netisr_queue_src(), which always consume the mbuf. So, if one of these
functions returned an error, that would get propagated up to
div_output(), resulting in a double free.

Fix the problem by making div_output_outbound() and div_output_inbound()
responsible for freeing the mbuf in all cases.

[donner]

sys/netinet/ip_divert.c

424

Should the comment also be changed?

508

Does ip_output always consume the mbuf, even in the case of an error?

514

Does ip6_output always consume the mbuf, even in the case of an error?

[markj]

sys/netinet/ip_divert.c

508

Yes. If it succeeds, it hands the mbuf to lower layers, which must dispose of it in some way. Ditto for ip6_output().

[markj]

Update the comment for div_output_outbound() like I did for
div_output_inbound().

[donner]

Okay, the ip*_output functions will always consume the mbuf. I just read the souce