[frr]: Fix zebra NB RIB route lookup_next route_node lock under-run (backport to 202608)

[deepak-singhal0408]

Why I did it

Backport of sonic-net/sonic-buildimage#28094 (fixes sonic-net/sonic-buildimage#27788) to the 202608 release branch. The master PR carries the Cherry Pick Conflict_msft-202608 label because the auto cherry-pick did not apply, so this is the manual backport PR.

The bug: the zebra northbound oper-state RIB route iterator (lib_vrf_zebra_ribs_rib_route_lookup_next) erroneously calls route_unlock_node() on the node it returns. That node seeds the get_next -> route_next() iteration, which unlocks its input; releasing the lock in lookup_next() under-runs the route_node lock to zero and aborts zebra (assertion node->lock > 0) during the post-restart RIB sweep, wedging vtysh and stalling bgpd.

Work item tracking

• Microsoft ADO (number only): N/A

How I did it

Cherry-picked the merged master commit 0361265da273e4a08d03831c1515e041e4ba3de6 (the FRR route_node lock fix).

Conflict resolution: the only conflict was in src/sonic-frr/patch/series. On master the fix is registered as 0116, right after an unrelated patch (0115-zebra-Update-promiscuity-flag-silently..., which touches zebra/if_netlink.c) that is not present on 202608. Since the fix touches zebra/zebra_nb_state.c (a different file) and is independent of that unrelated patch, it was registered at 202608's next free slot 0115 (series ended at 0114) and the unrelated promiscuity patch was not carried. The patch body is byte-identical to master's.

Base parity: the FRR submodule pin is byte-identical (4cb6d9e6bfe4ad503d1fab21e6f665804b0649ac) on the master parent, the master fix commit, and 202608 — so the fix applies onto identical FRR source.

How to verify it

• Applied the full 202608 FRR patch series (all 84 patches, including the backported fix) in order onto the pinned FRR source 4cb6d9e6... — every patch applies cleanly; the fix integrates at its lookup_next region with no overlap from preceding patches.
• Behavior was A/B-validated on master in [frr]: Fix zebra NB RIB route lookup_next route_node lock under-run sonic-net/sonic-buildimage#28094: the zebra abort artifact is present without the fix and absent with it. Because the FRR base is byte-identical on 202608, that validation carries over.
• Full build + integration is covered by this PR's CI on the 202608 base.

Which release branch to backport (provide reason below if selected)

• 202305
• 202311
• 202405
• 202411
• 202505
• 202511

This PR is the release-branch backport (base = 202608), so no further backport checkbox is selected.

Tested branch (Please provide the tested image version)

• 202608 (FRR patch series apply verified against pinned FRR 4cb6d9e6; behavior verified on master per [frr]: Fix zebra NB RIB route lookup_next route_node lock under-run sonic-net/sonic-buildimage#28094)

Description for the changelog

[frr]: Fix zebra NB RIB route lookup_next route_node lock under-run

Link to config_db schema for YANG module changes

N/A

[deepak-singhal0408]

/azp run Azure.sonic-buildimage-msft.PR

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[yxieca]

The build fix is in #2658 but rerun the pipeline doesn't pick up the fix.