AZL-96117

In the Linux kernel, the following vulnerability has been resolved:

ipv4: igmp: Fix potential memory leaks in igmpmodtimer() and igmpstoptimer()

When a timer is deleted and not re-armed in igmpmodtimer(), or stopped in igmpstoptimer(), the code currently decrements the reference counter of the multicast list entry @im using refcount_dec(&im->refcnt).

However, both functions can be called from the RCU reader path: - igmpmodtimer() via igmpheardquery() -> foreachpmcrcu() - igmpstoptimer() via igmprcv() -> igmpheardreport()

If the group im was concurrently removed from the list by ipmcdec_group(), its reference count might have already been decremented to 1.

In this case, timerdelete() succeeds, and refcountdec() decrements the refcount from 1 to 0. Since refcountdec() does not free the object when it hits 0 (unlike ipma_put()), the im structure is leaked.

Fix this by using ipmaput(im) instead of refcount_dec(&im->refcnt), and deferring the put until after the spinlock is released.