lib: fix use-after-free of src_table in srcdest_srcnode_destroy

[nsoma-cisco]

Summary

Fix a use-after-free of src_table in
lib/srcdest_table.c:srcdest_srcnode_destroy().

Root cause

srcdest_srcnode_destroy() freed srn->src_table via route_table_finish()
before nulling the pointer. After route_table_finish() returned,
srn->src_table still held the address of the freed route_table struct.

A subsequent dplane FIB notification for the same destination prefix calls
srcdest_rnode_get() → srcdest_srcnode_get(), which guards new-table creation
with if (!srn->src_table). Because the pointer was non-NULL (dangling), the
guard evaluated false and the freed struct was passed to route_node_get(),
causing a SIGSEGV.

route_table_finish() can also re-enter srcdest_srcnode_destroy() for the
remaining nodes during the finish sweep
(route_table_free → route_node_free → destroy_node); any such re-entrant read
of srn->src_table observed the same dangling pointer.

Fix

Null srn->src_table before calling route_table_finish(), mirroring the
identical null-before-finish pattern already present and commented in
srcdest_rnode_destroy():

struct route_table *src_table = srn->src_table;

srn->src_table = NULL;
route_table_finish(src_table);

With the pointer nulled first, any re-entrant call to
srcdest_srcnode_destroy() during the finish sweep sees NULL and exits
cleanly, and any subsequent call to srcdest_srcnode_get() allocates a fresh,
valid route_table instead of dereferencing freed memory.

Test plan

• Rebuild and load on an affected setup
• Exercise EVPN/VXLAN multi-homing route teardown that previously crashed
• Confirm no zebra core is generated and route state stays consistent

[greptile-apps]

Greptile Summary

This PR prevents a dangling source-table pointer during route teardown. The main changes are:

• Saves the source table pointer before cleanup.
• Clears srn->src_table before synchronous table destruction.
• Preserves the existing reference release after cleanup.

Confidence Score: 5/5

This looks safe to merge.

• No blocking issues found in the changed code.
• Re-entrant destruction skips duplicate cleanup after the pointer is cleared.
• The destination node remains referenced until table cleanup completes.

Important Files Changed

Filename	Overview
lib/srcdest_table.c	Reorders source-table cleanup so re-entrant destruction observes a null pointer instead of freed storage.

_{Reviews (1): Last reviewed commit: "lib: Fix use-after-free of src_table in ..." | Re-trigger Greptile}