route: fix ref counting for l_info_ops and io_clone()
route: fix ref counting for l_info_ops and io_clone()

nl_object_clone() first does a shallow copy, before calling
oo_clone() (link_clone()). That means, the pointer values
of the link object in link_clone() are invalid (as they alias
the pointers from the source object).

We need to get the ref-counting for dst->l_info_ops right.
It was not.

For example, previously when we called io_clone() handler, dst->l_info_ops
would still point to the one from src->l_info_ops, but without owning
the additional reference. Then we call io_clone(), for example
can_clone() for can devices. That one calls first rtnl_link_set_type(),
which first calls release_link_info() -- and unrefs the ops, without
having owned a reference.

Fix that, by getting the reference counting right, before calling
io_clone(). Arguably, we now do duplicate work. First taking a ref, then
calling rtnl_link_set_type() which releases and retakes the ref. But at
least, this way it's correct.

This probably did not cause issues before, because the entire
ref-counting is mostly useless anyway. It's only used for asserting
during rtnl_link_unregister_info() -- and then it checks that the ref
count is not positive (but we release too many references, not too few).

Anyway. *sigh*.

greearb/libnl-ct,thom311/libnl,thom311/libnl,thom311/libnl,greearb/libnl-ct,greearb/libnl-ct