divert: Fix mbuf ownership confusion in div_output()

divert: Fix mbuf ownership confusion in div_output()

div_output_outbound() and div_output_inbound() relied on the caller to
free the mbuf if an error occurred.  However, this is contrary to the
semantics of their callees, ip_output(), ip6_output() and
netisr_queue_src(), which always consume the mbuf.  So, if one of these
functions returned an error, that would get propagated up to
div_output(), resulting in a double free.

Fix the problem by making div_output_outbound() and div_output_inbound()
responsible for freeing the mbuf in all cases.

Approved by:	so
Security:	EN-21:12.divert
Reported by:	Michael Schmiedgen <schmiedgen@gmx.net>
Tested by:	Michael Schmiedgen
Reviewed by:	donner
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D30129

(cherry picked from commit a1fadf7de25b973a308b86d04c4ada4fa8be193f)
(cherry picked from commit eafeee082c50850c2577f4fce0eaa7acb034f565)