Merge: ipv6: mcast: Delay put pmc->idev in mld_del_delrec()

MR: https://gitlab.com/redhat/rhel/src/kernel/rhel-10/-/merge_requests/296

JIRA: https://issues.redhat.com/browse/RHEL-111156
Upstream Status: net.git commit ae3264a
CVE: CVE-2025-38550

commit ae3264a
Author: Yue Haibing <[email protected]>
Date:   Mon Jul 14 22:19:57 2025 +0800

    ipv6: mcast: Delay put pmc->idev in mld_del_delrec()

    pmc->idev is still used in ip6_mc_clear_src(), so as mld_clear_delrec()
    does, the reference should be put after ip6_mc_clear_src() return.

    Fixes: 63ed8de ("mld: add mc_lock for protecting per-interface mld data")
    Signed-off-by: Yue Haibing <[email protected]>
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Jakub Kicinski <[email protected]>

Signed-off-by: Hangbin Liu <[email protected]>

Closes RHEL-111156

Approved-by: Antoine Tenart <[email protected]>
Approved-by: Davide Caratti <[email protected]>
Approved-by: CKI KWF Bot <[email protected]>

Merged-by: Jan Stancek <[email protected]>

Author: jstancek

net/ipv6/mcast.c

@@ -807,8 +807,8 @@ static void mld_del_delrec(struct inet6_dev *idev, struct ifmcaddr6 *im)
 		} else {
 			im->mca_crcount = idev->mc_qrv;
 		}
-		in6_dev_put(pmc->idev);
 		ip6_mc_clear_src(pmc);
+		in6_dev_put(pmc->idev);
 		kfree_rcu(pmc, rcu);
 	}
 }