[stable/14] routing: fix rtentry use-after-free in multipath route append

[ojanerif_amd.com]

Summary

add_route_flags() drops the RIB lock and passes the existing entry,
rt_orig, to add_route_flags_mpath(). If a concurrent delete removes
the prefix in that window, the retry re-inserts rt_orig, which is
then freed while still linked, crashing later in rn_match().

Pass the new rt instead, return ENOENT when the prefix is gone and
RTM_F_CREATE is not set, and fix the rnd_orig NULL check.

stable/14 predates nhgrp_get_merge_group(), so this is a manual port
of the three logic changes onto the simpler add_route_flags_mpath().

MFC of 139fa2c12ddc (D60353, "routing: fix rib_add_route_px()",
Fixes: c24a8f19c5d5).

Sponsored by: Advanced Micro Devices, Inc.
Signed-off-by: Osvaldo Janeri Filho <[e-mail]>