ksmbd: vfs: fix race on m_flags in vfs_cache

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: vfs: fix race on m_flags in vfs_cache

ksmbd maintains delete-on-close and pending-delete state in

ksmbd_inode->m_flags. In vfs_cache.c this field is accessed under

inconsistent locking: some paths read and modify m_flags under

ci->m_lock while others do so without taking the lock at all.

Examples:

- ksmbd_query_inode_status() and __ksmbd_inode_close() use

ci->m_lock when checking or updating m_flags.

- ksmbd_inode_pending_delete(), ksmbd_set_inode_pending_delete(),

ksmbd_clear_inode_pending_delete() and ksmbd_fd_set_delete_on_close()

used to read and modify m_flags without ci->m_lock.

This creates a potential data race on m_flags when multiple threads

open, close and delete the same file concurrently. In the worst case

delete-on-close and pending-delete bits can be lost or observed in an

inconsistent state, leading to confusing delete semantics (files that

stay on disk after delete-on-close, or files that disappear while still

in use).

Fix it by:

- Making ksmbd_query_inode_status() look at m_flags under ci->m_lock

after dropping inode_hash_lock.

- Adding ci->m_lock protection to all helpers that read or modify

m_flags (ksmbd_inode_pending_delete(), ksmbd_set_inode_pending_delete(),

ksmbd_clear_inode_pending_delete(), ksmbd_fd_set_delete_on_close()).

- Keeping the existing ci->m_lock protection in __ksmbd_inode_close(),

and moving the actual unlink/xattr removal outside the lock.

This unifies the locking around m_flags and removes the data race while

preserving the existing delete-on-close behaviour.