CVE-2026-72040: ipmi: fix refcount leak in i_ipmi_request()

In the Linux kernel, the following vulnerability has been resolved:

ipmi: fix refcount leak in iipmirequest()

When a caller provides a suppliedrecv message to iipmirequest(), the function increments the user's nrmsgs reference count. If an error occurs later, the outerr cleanup path only frees the recvmsg if the function allocated it itself (i.e., !suppliedrecv). In the suppliedrecv case the cleanup is skipped, leaving the reference count elevated. The caller ipmirequestsupplymsgs() does not release the suppliedrecv on error, so the reference is permanently leaked.

Fix this by explicitly reverting the reference count operations when a supplied recvmsg with a valid user pointer is present in the error path: decrement nrmsgs and drop the user's kref.