network: fix SIGABRT related to unreachable route with DHCP6

After #17834, unreachable routes generated through DHCP6 are managed by
Manager. But they are referrenced by the DHCP6 uplink. So, the routes
managed by Manager must be freed after all Link objects are freed.

Follow-up for 575f14eef010101c60e9d4d970e542c815be1994.

Fixes SIGABRT reproted in #17831.

(cherry picked from commit 450fa34bd0315f2ca4728050b37c3a3d9e0f1b78)

1 files changed, 7 insertions, 3 deletions

diff --git a/src/network/networkd-manager.c b/src/network/networkd-manager.c
index e8b6615afa..19c3cc6f7e 100644
--- a/src/network/networkd-manager.c
+++ b/src/network/networkd-manager.c
@@ -887,13 +887,17 @@ void manager_free(Manager *m) {
         m->rules_foreign = set_free(m->rules_foreign);
         set_free(m->rules_saved);
 
-        m->routes = set_free(m->routes);
-        m->routes_foreign = set_free(m->routes_foreign);
-
         sd_netlink_unref(m->rtnl);
         sd_netlink_unref(m->genl);
         sd_resolve_unref(m->resolve);
 
+        /* reject (e.g. unreachable) type routes are managed by Manager, but may be referenced by a
+         * link. E.g., DHCP6 with prefix delegation creates unreachable routes, and they are referenced
+         * by the upstream link. And the links may be referenced by netlink slots. Hence, two
+         * set_free() must be called after the above sd_netlink_unref(). */
+        m->routes = set_free(m->routes);
+        m->routes_foreign = set_free(m->routes_foreign);
+
         sd_event_source_unref(m->speed_meter_event_source);
         sd_event_unref(m->event);