Grab Giant after MAC processing on outgoing packets being sent via

BPF.  Grab the BPF descriptor lock before entering MAC since the MAC
Framework references BPF descriptor fields, including the BPF
descriptor label.

Submitted by:	sam

sys/net/bpf.c

@@ -578,10 +578,12 @@ bpfwrite(dev, uio, ioflag)
 	if (d->bd_hdrcmplt)
 		dst.sa_family = pseudo_AF_HDRCMPLT;
 
-	mtx_lock(&Giant);
 #ifdef MAC
+	BPFD_LOCK(d);
 	mac_create_mbuf_from_bpfdesc(d, m);
+	BPFD_UNLOCK(d);
 #endif
+	mtx_lock(&Giant);
 	error = (*ifp->if_output)(ifp, m, &dst, (struct rtentry *)0);
 	mtx_unlock(&Giant);
 	/*