git: af85312e8a6f - stable/13 - Fix panic when destroying interface with ECMP routes.

[Alexander V. Chernikov]

The branch stable/13 has been updated by melifaro:

URL: https://cgit.FreeBSD.org/src/commit/?id=af85312e8a6f34ea7c8af77b9841fab6b5559e25

commit af85312e8a6f34ea7c8af77b9841fab6b5559e25
Author:     Alexander V. Chernikov <melifaro at FreeBSD.org>
AuthorDate: 2021-03-23 22:00:04 +0000
Commit:     Alexander V. Chernikov <melifaro at FreeBSD.org>
CommitDate: 2021-03-25 20:22:21 +0000

    Fix panic when destroying interface with ECMP routes.
    
    Reported by:    Zhenlei Huang <zlei.huang at gmail.com>
    PR:             254496
    
    (cherry picked from commit a0308e48ec12ae37f525aa3c6d3c1a236fb55dcd)
---
 sys/net/route/route_ctl.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/sys/net/route/route_ctl.c b/sys/net/route/route_ctl.c
index 46e0bcfee6b7..58b89c28f945 100644
--- a/sys/net/route/route_ctl.c
+++ b/sys/net/route/route_ctl.c
@@ -130,16 +130,25 @@ vnet_rtzone_destroy()
 static void
 destroy_rtentry(struct rtentry *rt)
 {
+	struct nhop_object *nh = rt->rt_nhop;
 
 	/*
 	 * At this moment rnh, nh_control may be already freed.
 	 * nhop interface may have been migrated to a different vnet.
 	 * Use vnet stored in the nexthop to delete the entry.
 	 */
-	CURVNET_SET(nhop_get_vnet(rt->rt_nhop));
+#ifdef ROUTE_MPATH
+	if (NH_IS_NHGRP(nh)) {
+		struct weightened_nhop *wn;
+		uint32_t num_nhops;
+		wn = nhgrp_get_nhops((struct nhgrp_object *)nh, &num_nhops);
+		nh = wn[0].nh;
+	}
+#endif
+	CURVNET_SET(nhop_get_vnet(nh));
 
 	/* Unreference nexthop */
-	nhop_free_any(rt->rt_nhop);
+	nhop_free_any(nh);
 
 	uma_zfree(V_rtzone, rt);