MFC r268450 (by glebius).  The leak affects stable/10 too.

In several cases in ip_output() we obtain reference on ifa. Do not
leak it.