git: 3765afa4dacf - releng/13.0 - Fix panic when destroying interface with ECMP routes.

[Alexander V. Chernikov]

The branch releng/13.0 has been updated by melifaro:

URL: https://cgit.FreeBSD.org/src/commit/?id=3765afa4dacf5850de984fede7f9b26760efac73

commit 3765afa4dacf5850de984fede7f9b26760efac73
Author:     Alexander V. Chernikov <melifaro at FreeBSD.org>
AuthorDate: 2021-03-23 22:00:04 +0000
Commit:     Alexander V. Chernikov <melifaro at FreeBSD.org>
CommitDate: 2021-03-28 20:40:48 +0000

    Fix panic when destroying interface with ECMP routes.
    
    Reported by:    Zhenlei Huang <zlei.huang at gmail.com>
    PR:             254496
    Approved by:    re (gjb)
    
    (cherry picked from commit af85312e8a6f34ea7c8af77b9841fab6b5559e25)
---
 sys/net/route/route_ctl.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/sys/net/route/route_ctl.c b/sys/net/route/route_ctl.c
index 46e0bcfee6b7..58b89c28f945 100644
--- a/sys/net/route/route_ctl.c
+++ b/sys/net/route/route_ctl.c
@@ -130,16 +130,25 @@ vnet_rtzone_destroy()
 static void
 destroy_rtentry(struct rtentry *rt)
 {
+	struct nhop_object *nh = rt->rt_nhop;
 
 	/*
 	 * At this moment rnh, nh_control may be already freed.
 	 * nhop interface may have been migrated to a different vnet.
 	 * Use vnet stored in the nexthop to delete the entry.
 	 */
-	CURVNET_SET(nhop_get_vnet(rt->rt_nhop));
+#ifdef ROUTE_MPATH
+	if (NH_IS_NHGRP(nh)) {
+		struct weightened_nhop *wn;
+		uint32_t num_nhops;
+		wn = nhgrp_get_nhops((struct nhgrp_object *)nh, &num_nhops);
+		nh = wn[0].nh;
+	}
+#endif
+	CURVNET_SET(nhop_get_vnet(nh));
 
 	/* Unreference nexthop */
-	nhop_free_any(rt->rt_nhop);
+	nhop_free_any(nh);
 
 	uma_zfree(V_rtzone, rt);