Merge pull request #22091 from FRRouting/mergify/bp/stable/10.2/pr-22080

bgpd: Fix use-after-free for ORF case (backport #22080)

Author: donaldsharp

bgpd/bgp_packet.c

@@ -2960,12 +2960,9 @@ static int bgp_route_refresh_receive(struct peer_connection *connection,
 
 	paf = peer_af_find(peer, afi, safi);
 	if (paf && paf->subgroup) {
-		if (peer->orf_plist[afi][safi]) {
-			updgrp = PAF_UPDGRP(paf);
-			updgrp_peer = UPDGRP_PEER(updgrp);
-			updgrp_peer->orf_plist[afi][safi] =
-				peer->orf_plist[afi][safi];
-		}
+		updgrp = PAF_UPDGRP(paf);
+		updgrp_peer = UPDGRP_PEER(updgrp);
+		updgrp_peer->orf_plist[afi][safi] = peer->orf_plist[afi][safi];
 
 		/* Avoid supressing duplicate routes later
 		 * when processing in subgroup_announce_table().