Merge: ipv6: mcast: Delay put pmc->idev in mld_del_delrec()

MR: https://gitlab.com/redhat/rhel/src/kernel/rhel-10/-/merge_requests/296

JIRA: https://issues.redhat.com/browse/RHEL-111156
Upstream Status: net.git commit ae3264a
CVE: CVE-2025-38550

commit ae3264a
Author: Yue Haibing <yuehaibing@huawei.com>
Date:   Mon Jul 14 22:19:57 2025 +0800

    ipv6: mcast: Delay put pmc->idev in mld_del_delrec()

    pmc->idev is still used in ip6_mc_clear_src(), so as mld_clear_delrec()
    does, the reference should be put after ip6_mc_clear_src() return.

    Fixes: 63ed8de ("mld: add mc_lock for protecting per-interface mld data")
    Signed-off-by: Yue Haibing <yuehaibing@huawei.com>
    Link: https://patch.msgid.link/20250714141957.3301871-1-yuehaibing@huawei.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Signed-off-by: Hangbin Liu <haliu@redhat.com>

Closes RHEL-111156

Approved-by: Antoine Tenart <atenart@redhat.com>
Approved-by: Davide Caratti <dcaratti@redhat.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>

Merged-by: Jan Stancek <jstancek@redhat.com>

Author: jstancek

net/ipv6/mcast.c

@@ -807,8 +807,8 @@ static void mld_del_delrec(struct inet6_dev *idev, struct ifmcaddr6 *im)
 		} else {
 			im->mca_crcount = idev->mc_qrv;
 		}
-		in6_dev_put(pmc->idev);
 		ip6_mc_clear_src(pmc);
+		in6_dev_put(pmc->idev);
 		kfree_rcu(pmc, rcu);
 	}
 }