isisd: fix crash in isis_area_destroy destruction order

Move lsp_db_fini() before circuit list cleanup in isis_area_destroy().
The lsp_destroy() function iterates over circuit_list to remove LSPs
from tx queues. With typesafe lists, a finalized list is invalid
(not NULL), so accessing it causes a crash.

Signed-off-by: Vincent Jardin <vjardin@free.fr>

Author: vjardin

isisd/isisd.c

@@ -541,6 +541,11 @@ void isis_area_destroy(struct isis_area *area)
 	if (fabricd)
 		fabricd_finish(area->fabricd);
 
+	/* Must destroy LSP database before circuit list, because lsp_destroy
+	 * iterates over circuit_list to remove LSPs from tx queues */
+	lsp_db_fini(&area->lspdb[0]);
+	lsp_db_fini(&area->lspdb[1]);
+
 	frr_each_safe (isis_circuit_list, &area->circuit_list, circuit)
 		isis_area_del_circuit(area, circuit);
 
@@ -551,9 +556,6 @@ void isis_area_destroy(struct isis_area *area)
 
 	isis_area_adj_list_fini(&area->adjacency_list);
 
-	lsp_db_fini(&area->lspdb[0]);
-	lsp_db_fini(&area->lspdb[1]);
-
 	/* invalidate and verify to delete all routes from zebra */
 	isis_area_invalidate_routes(area, area->is_type);
 	isis_area_verify_routes(area);