git: a0308e48ec12 - main - Fix panic when destroying interface with ECMP routes.

[Alexander V. Chernikov]

The branch main has been updated by melifaro:

URL: https://cgit.FreeBSD.org/src/commit/?id=a0308e48ec12ae37f525aa3c6d3c1a236fb55dcd

commit a0308e48ec12ae37f525aa3c6d3c1a236fb55dcd
Author:     Alexander V. Chernikov <melifaro at FreeBSD.org>
AuthorDate: 2021-03-23 22:00:04 +0000
Commit:     Alexander V. Chernikov <melifaro at FreeBSD.org>
CommitDate: 2021-03-23 22:03:20 +0000

    Fix panic when destroying interface with ECMP routes.
    
    Reported by:    Zhenlei Huang <zlei.huang at gmail.com>
    PR:             254496
    MFC after:      immediately
---
 sys/net/route/route_ctl.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/sys/net/route/route_ctl.c b/sys/net/route/route_ctl.c
index d9fd1aa18c92..d3a35018ae66 100644
--- a/sys/net/route/route_ctl.c
+++ b/sys/net/route/route_ctl.c
@@ -130,13 +130,22 @@ vnet_rtzone_destroy()
 static void
 destroy_rtentry(struct rtentry *rt)
 {
+	struct nhop_object *nh = rt->rt_nhop;
 
 	/*
 	 * At this moment rnh, nh_control may be already freed.
 	 * nhop interface may have been migrated to a different vnet.
 	 * Use vnet stored in the nexthop to delete the entry.
 	 */
-	CURVNET_SET(nhop_get_vnet(rt->rt_nhop));
+#ifdef ROUTE_MPATH
+	if (NH_IS_NHGRP(nh)) {
+		struct weightened_nhop *wn;
+		uint32_t num_nhops;
+		wn = nhgrp_get_nhops((struct nhgrp_object *)nh, &num_nhops);
+		nh = wn[0].nh;
+	}
+#endif
+	CURVNET_SET(nhop_get_vnet(nh));
 
 	/* Unreference nexthop */
 	nhop_free_any(rt->rt_nhop);