routing: fix rtentry use-after-free in multipath route appendHEADmain

add_route_flags() drops the RIB lock and passes the existing entry,
rt_orig, to add_route_flags_mpath(). If a concurrent delete removes
the prefix in that window, the retry re-inserts rt_orig, which is
then freed while still linked, crashing later in rn_match().

Pass the new rt instead, return ENOENT when the prefix is gone and
RTM_F_CREATE is not set, and fix the rnd_orig NULL check.

Approved by:	pouria
Fixes:		c24a8f19c5d5 ("routing: fix rib_add_route_px()")
Differential Revision:	https://reviews.freebsd.org/D60353

0 files changed, 0 insertions, 0 deletions