bgpd: fix valgrind memory leaks on daemon shutdown

During daemon termination, the default BGP instance leaks due to
two issues:

First, bgp_cleanup_routes() skips EVPN and ENCAP two-level table
cleanup for hidden instances, leaving route entries. Add a terminating
check so these tables are always cleaned during shutdown.

Second, a circular dependency exists between bgp_free() and VNI lock
release: each L2VNI holds a bgp_lock on the default instance via
bgpevpn_link_to_l3vni(), but the only code that releases these locks
(bgp_evpn_cleanup -> free_vni_entry -> bgpevpn_unlink_from_l3vni) lives
inside bgp_free(), which only runs when the lock count reaches zero.
Break this cycle by calling bgp_evpn_cleanup() from bgp_delete() during
termination, before the final bgp_unlock(). This releases VNI-held
locks so the refcount can reach zero and bgp_free() actually executes.

Signed-off-by: Soumya Roy <souroy@nvidia.com>

Author: soumyar-roy

bgpd/bgp_evpn.c

@@ -5377,7 +5377,8 @@ static void evpn_mpattr_encode_type5(struct stream *s, const struct prefix *p,
  *
  * NOTE: NO need to pop the VPN routes in two cases
  *  1) In free_vni_entry
- *     - Called by bgp_free()->bgp_evpn_cleanup().
+ *     - Called by bgp_free()->bgp_evpn_cleanup() or
+ *       bgp_delete()->bgp_evpn_cleanup() when terminating.
  *     - Since bgp_delete is called before bgp_free and we pop all the dest
  *       pertaining to bgp under delete.
  *  2) evpn_delete_vni() when user configures "no vni" since the withdraw
@@ -7770,6 +7771,10 @@ void bgp_evpn_cleanup_on_disable(struct bgp *bgp)
  */
 void bgp_evpn_cleanup(struct bgp *bgp)
 {
+	/* Guard against double-call during termination */
+	if (!bgp->vnihash)
+		return;
+
 	hash_iterate(bgp->vnihash,
 		     (void (*)(struct hash_bucket *, void *))free_vni_entry,
 		     bgp);

bgpd/bgp_route.c

@@ -8030,7 +8030,7 @@ void bgp_cleanup_routes(struct bgp *bgp)
 		/*
 		 * VPN and ENCAP and EVPN tables are two-level (RD is top level)
 		 */
-		if (safi != SAFI_MPLS_VPN && IS_BGP_INSTANCE_HIDDEN(bgp))
+		if (safi != SAFI_MPLS_VPN && IS_BGP_INSTANCE_HIDDEN(bgp) && !bm->terminating)
 			continue;
 
 		for (dest = bgp_table_top(bgp->rib[afi][safi]); dest; dest = bgp_route_next(dest)) {

bgpd/bgpd.c

@@ -4590,6 +4590,14 @@ int bgp_delete(struct bgp *bgp)
 
 	bgp_cleanup_routes(bgp);
 
+	if (bm->terminating)
+		/*
+		 * Release EVPN VNI bgp_lock references so the
+		 * subsequent bgp_unlock() can drive refcount to
+		 * zero and trigger bgp_free().
+		 */
+		bgp_evpn_cleanup(bgp);
+
 	for (afi = 0; afi < AFI_MAX; ++afi) {
 		if (!bgp->vpn_policy[afi].import_redirect_rtlist)
 			continue;