CVE-2026-63872: esp: fix page frag reference leak on skb_to_sgvec failure

In the Linux kernel, the following vulnerability has been resolved:

esp: fix page frag reference leak on skbtosgvec failure

In espoutputtail(), when esp->inplace is false, the old skb page frags are replaced with a new page from the xfrm pagefrag cache. The source scatterlist (sg) is built from the old frags before the replacement, and espssgunref() is responsible for releasing the old page references after the crypto operation completes.

However, if the second skbtosgvec() call (which builds the destination scatterlist from the new page) fails, the code jumps to errorfree which only calls kfree(tmp). The old page frag references captured in the source scatterlist are never released:

1. sg[] is built from old frags via skbtosgvec() (no extra getpage) 2. nrfrags is set to 1 and frag[0] is replaced with the new page 3. Second skbtosgvec() fails -> goto errorfree 4. kfree(tmp) frees the sg[] memory but old frags are not unref'd 5. kfreeskb() only releases frag[0] (the new page), not the old ones

Fix this by adding a bool parameter to espssgunref() that, when true, unconditionally unrefs the source scatterlist frags without checking req->src and req->dst, since those fields are not yet initialized by aeadrequestsetcrypt() at the point of the error. Existing callers pass false to preserve the original behavior.

The same issue exists in both esp4 and esp6 as the code is identical.