xfrm: iptfs: reset runtime state when cloning SAs

In the Linux kernel, the following vulnerability has been resolved:

xfrm: iptfs: reset runtime state when cloning SAs

iptfs_clone_state() clones the IPTFS mode data with kmemdup(). This

copies runtime objects which must not be shared with the original SA,

including the embedded sk_buff_head, hrtimers, spinlock, and in-flight

reassembly/reorder state.

If xfrm_state_migrate() fails after clone_state() but before the later

init_state() call has reinitialized those fields, the cloned state can be

destroyed by xfrm_state_gc_task() with list and timer state copied from the

original SA. With queued packets this lets the clone splice and free skbs

owned by the original IPTFS queue, leading to use-after-free and

double-free reports in iptfs_destroy_state() and skb release paths.

Reinitialize the clone's runtime state before publishing it through

x->mode_data. Because clone_state() now publishes a destroyable mode_data

object before init_state(), take the mode callback module reference there.

Avoid taking it again from __iptfs_init_state() for the same object.