net/smc: Fix slab-out-of-bounds issue in fallback

mainline inclusion
from mainline-v5.18-rc5
commit 0558226c
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I76JHC
CVE: NA

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/net/smc?id=0558226cebee256aa3f8ec0cc5a800a10bf120a6



--------------------------------

syzbot reported a slab-out-of-bounds/use-after-free issue,
which was caused by accessing an already freed smc sock in
fallback-specific callback functions of clcsock.

This patch fixes the issue by restoring fallback-specific
callback functions to original ones and resetting clcsock
sk_user_data to NULL before freeing smc sock.

Meanwhile, this patch introduces sk_callback_lock to make
the access and assignment to sk_user_data mutually exclusive.

Reported-by:  <syzbot+b425899ed22c6943e00b@syzkaller.appspotmail.com>
Fixes: 341adeec ("net/smc: Forward wakeup to smc socket waitqueue after fallback")
Link: https://lore.kernel.org/r/00000000000013ca8105d7ae3ada@google.com/


Signed-off-by: Wen Gu <guwen@linux.alibaba.com>
Acked-by: Karsten Graul <kgraul@linux.ibm.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Litao Jiao <jiaolitao@sangfor.com.cn>