Merge pull request #7330 from donaldsharp/zebra_use_after_free

zebra: Fix use after free in debug path

zebra/zebra_rib.c

@@ -2268,9 +2268,18 @@ static void process_subq_route(struct listnode *lnode, uint8_t qindex)
 	rib_process(rnode);
 
 	if (IS_ZEBRA_DEBUG_RIB_DETAILED) {
-		struct route_entry *re = re_list_first(&dest->routes);
+		struct route_entry *re = NULL;
 		char buf[SRCDEST2STR_BUFFER];
 
+		/*
+		 * rib_process may have freed the dest
+		 * as part of the garbage collection.  Let's
+		 * prevent stupidity from happening.
+		 */
+		dest = rib_dest_from_rnode(rnode);
+		if (dest)
+			re = re_list_first(&dest->routes);
+
 		srcdest_rnode2str(rnode, buf, sizeof(buf));
 		zlog_debug("%s(%u:%u):%s: rn %p dequeued from sub-queue %u",
 			   zvrf_name(zvrf), zvrf_id(zvrf), re ? re->table : 0, buf,