net: fix potential refcount leak in ndisc_router_discovery()

In the Linux kernel, the following vulnerability has been resolved:

net: fix potential refcount leak in ndisc_router_discovery()

The issue happens on specific paths in the function. After both the

object `rt` and `neigh` are grabbed successfully, when `lifetime` is

nonzero but the metric needs change, the function just deletes the

route and set `rt` to NULL. Then, it may try grabbing `rt` and `neigh`

again if above conditions hold. The function simply overwrite `neigh`

if succeeds or returns if fails, without decreasing the reference

count of previous `neigh`. This may result in memory leaks.

Fix it by decrementing the reference count of `neigh` in place.