realtek: l3: take out a route a nexthop object replaces

The previous commit leaves a route through a nexthop object out of the
offload. "ip route replace <dst> nhid N" reaches the notifier as a
FIB_EVENT_ENTRY_REPLACE for the new route alone, with no delete for the
route it replaces (fib_table_insert() in net/ipv4/fib_trie.c). If <dst>
was offloaded, its hardware entry stayed programmed with the old
gateway, and nothing took it out afterwards.

Let add, replace and append events for such a route through to
otto_l3_fib_add_v4(). There, before the first nexthop read, which moves
out of the variable initialisers, take out an entry offloaded for the
same table and destination with the otto_l3_route_find() and
otto_l3_route_teardown() pair its replace path already uses, then
return. The teardown cannot sit in the notifier itself: the FIB
notifier chain is atomic, and the teardown takes the table mutex.

A delete for such a route still stops in the notifier: the route was
never offloaded, and otto_l3_fib_del_v4() reads the nexthop array.

Tested on an RTL9303 (Hasivo S1100W-8XGT-SE) with the L3 offload on,
this series on main at 248601f492. A /24 and a /32 through a gateway
each get a hardware entry; replacing either with "nhid 17" takes the
entry out while the kernel keeps the route, replacing it back through
the other gateway programs an entry again, and deleting it afterwards
leaves none. A replace between two gateways without a nexthop object
still leaves exactly one entry. No warning or oops in the log. The
stale entry this commit removes was read from the code, not reproduced.

Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Gennaro Cimmino <gcimmino@rayonra.net>
Link: https://github.com/openwrt/openwrt/pull/25310
Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>

target/linux/realtek/files-6.18/drivers/net/dsa/rtl83xx/l3.c

@@ -1405,12 +1405,27 @@ static int otto_l3_fib_check_v4(struct otto_l3_ctrl *ctrl,
 
 static int otto_l3_fib_add_v4(struct otto_l3_ctrl *ctrl, struct fib_entry_notifier_info *info)
 {
-	struct net_device *ndev = fib_info_nh(info->fi, 0)->fib_nh_dev;
-	int vlan = is_vlan_dev(ndev) ? vlan_dev_vlan_id(ndev) : 0;
 	struct rtl838x_switch_priv *priv = ctrl->priv;
-	struct fib_nh *nh = fib_info_nh(info->fi, 0);
 	struct otto_l3_route *route;
-	int port;
+	struct net_device *ndev;
+	struct fib_nh *nh;
+	int port, vlan;
+
+	/* A route through a nexthop object is not offloaded and has no
+	 * nexthop array to read, but it can replace a route that is.
+	 */
+	if (info->fi->nh) {
+		dev_dbg(ctrl->dev, "route through a nexthop object, not offloaded\n");
+		route = otto_l3_route_find(ctrl, info->tb_id, ROUTE_TYPE_IP4UC, info->dst,
+					   NULL, info->dst_len);
+		if (route)
+			otto_l3_route_teardown(ctrl, route);
+		return 0;
+	}
+
+	nh = fib_info_nh(info->fi, 0);
+	ndev = nh->fib_nh_dev;
+	vlan = is_vlan_dev(ndev) ? vlan_dev_vlan_id(ndev) : 0;
 
 	if (otto_l3_fib_check_v4(ctrl, info, FIB_EVENT_ENTRY_ADD))
 		return 0;
@@ -1626,11 +1641,10 @@ static int otto_l3_fib_notifier(struct notifier_block *this, unsigned long event
 		if (info->family == AF_INET) {
 			struct fib_entry_notifier_info *fen_info = ptr;
 
-			/* A route through a nexthop object keeps no nexthop
-			 * array of its own, and everything below reads one.
+			/* A route through a nexthop object is never offloaded,
+			 * and the delete path reads a nexthop array it lacks.
 			 */
-			if (fen_info->fi->nh) {
-				dev_dbg(ctrl->dev, "route through a nexthop object, not offloaded\n");
+			if (fen_info->fi->nh && event == FIB_EVENT_ENTRY_DEL) {
 				kfree(fib_work);
 				return NOTIFY_DONE;
 			}