network: fix SIGABRT related to unreachable route with DHCP6

After #17834, unreachable routes generated through DHCP6 are managed by
Manager. But they are referrenced by the DHCP6 uplink. So, the routes
managed by Manager must be freed after all Link objects are freed.

Follow-up for 575f14eef010101c60e9d4d970e542c815be1994.

Fixes SIGABRT reproted in #17831.

diff --git a/src/network/networkd-manager.c b/src/network/networkd-manager.c
index a10860b63bc0f040dc763044f02235efa1f54d99..8af17b1194612ba2a64f008899a376995f3f776c 100644 (file)
--- a/src/network/networkd-manager.c
+++ b/src/network/networkd-manager.c
@@ -888,13 +888,17 @@ void manager_free(Manager *m) {
         m->rules_foreign = set_free(m->rules_foreign);
         set_free(m->rules_saved);
 
-        m->routes = set_free(m->routes);
-        m->routes_foreign = set_free(m->routes_foreign);
-
         sd_netlink_unref(m->rtnl);
         sd_netlink_unref(m->genl);
         sd_resolve_unref(m->resolve);
 
+        /* reject (e.g. unreachable) type routes are managed by Manager, but may be referenced by a
+         * link. E.g., DHCP6 with prefix delegation creates unreachable routes, and they are referenced
+         * by the upstream link. And the links may be referenced by netlink slots. Hence, two
+         * set_free() must be called after the above sd_netlink_unref(). */
+        m->routes = set_free(m->routes);
+        m->routes_foreign = set_free(m->routes_foreign);
+
         sd_event_source_unref(m->speed_meter_event_source);
         sd_event_unref(m->event);