net: clear sk->sk_ino in sk_set_socket(sk, NULL)

JIRA: https://issues.redhat.com/browse/RHEL-115597

Upstream commit:
commit 87ebb62
Author: Eric Dumazet <edumazet@google.com>
Date:   Wed Sep 17 13:53:37 2025 +0000

    net: clear sk->sk_ino in sk_set_socket(sk, NULL)

    Andrei Vagin reported that blamed commit broke CRIU.

    Indeed, while we want to keep sk_uid unchanged when a socket
    is cloned, we want to clear sk->sk_ino.

    Otherwise, sock_diag might report multiple sockets sharing
    the same inode number.

    Move the clearing part from sock_orphan() to sk_set_socket(sk, NULL),
    called both from sock_orphan() and sk_clone_lock().

    Fixes: 5d6b58c ("net: lockless sock_i_ino()")
    Closes: https://lore.kernel.org/netdev/aMhX-VnXkYDpKd9V@google.com/
    Closes: checkpoint-restore/criu#2744
    Reported-by: Andrei Vagin <avagin@google.com>
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Acked-by: Andrei Vagin <avagin@google.com>
    Link: https://patch.msgid.link/20250917135337.1736101-1-edumazet@google.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Signed-off-by: Paolo Abeni <pabeni@redhat.com>

Author: Paolo Abeni

include/net/sock.h

@@ -2032,6 +2032,9 @@ static inline void sk_set_socket(struct sock *sk, struct socket *sock)
 	if (sock) {
 		WRITE_ONCE(sk->sk_uid, SOCK_INODE(sock)->i_uid);
 		WRITE_ONCE(sk->sk_ino, SOCK_INODE(sock)->i_ino);
+	} else {
+		/* Note: sk_uid is unchanged. */
+		WRITE_ONCE(sk->sk_ino, 0);
 	}
 }
 
@@ -2053,7 +2056,6 @@ static inline void sock_orphan(struct sock *sk)
 	sock_set_flag(sk, SOCK_DEAD);
 	sk_set_socket(sk, NULL);
 	sk->sk_wq  = NULL;
-+	WRITE_ONCE(sk->sk_ino, 0);
 	write_unlock_bh(&sk->sk_callback_lock);
 }