ipv6: mcast: Delay put pmc->idev in mld_del_delrec()

jira VULN-131123
cve CVE-2025-38550
commit-author Yue Haibing <[email protected]>
commit ae3264a

pmc->idev is still used in ip6_mc_clear_src(), so as mld_clear_delrec()
does, the reference should be put after ip6_mc_clear_src() return.

Fixes: 63ed8de ("mld: add mc_lock for protecting per-interface mld data")
	Signed-off-by: Yue Haibing <[email protected]>
Link: https://patch.msgid.link/[email protected]
	Signed-off-by: Jakub Kicinski <[email protected]>
(cherry picked from commit ae3264a)
	Signed-off-by: Brett Mastbergen <[email protected]>

Author: bmastbergen

net/ipv6/mcast.c

@@ -803,8 +803,8 @@ static void mld_del_delrec(struct inet6_dev *idev, struct ifmcaddr6 *im)
 		} else {
 			im->mca_crcount = idev->mc_qrv;
 		}
-		in6_dev_put(pmc->idev);
 		ip6_mc_clear_src(pmc);
+		in6_dev_put(pmc->idev);
 		kfree_rcu(pmc, rcu);
 	}
 }