CVE-2026-98503: packet: use ubuf_info completion for TX_RING packets

In the Linux kernel, the following vulnerability has been resolved:

packet: use ubufinfo completion for TXRING packets

tpacketsnd sends skbs with frags pointing into its ring slots. Slots are released when skb->destructor is called.

A call to skborphan calls skb->destructor before the skb is freed. This can cause the slot to be reused while still linked into the skb.

Switch to standard zerocopy completion (ubufinfo) so the slot is only released once all references to the payload are freed or copied. Restore skb->destructor to standard sockwfree.

The ubufinfo completion callback can be called with a NULL skb, but only from netzcopyput and related API, used by zerocopy implementations that hold their own reference on the uarg, such as MSGZEROCOPY. This uarg is only ever completed from skbzcopyclear, so skb is always set.

To prevent userspace from aliasing in-flight state on shared ring slots, allocate tpacketuarg per packet, rather than per slot. This adds a small allocation to the transmit path. Use standard kmalloc to allow backporting to stable kernels.

The uarg holds an skwmemalloc reference, rather than an skrefcnt reference. packetfreetxring waits on skwmemalloc before freeing the ring pages. Always allocate vec->deferred for txring so page-backed rings also wait on skwmemalloc when skbcopyubufs drops page refs before calling tpacketubufcomplete.

Drop the txring.pgvec test that tpacketdestructskb performed before accessing the slot. The skwmemalloc reference now guarantees that the slot is valid. The test is also not sufficient by itself, as it reads pgvec without pgveclock, so it can race with packetsetring.

As a result a slot is released when its payload is copied, which can be before transmission (e.g., in skborphanfragsrx). If copied before skbtxtimestamp() is called, no slot timestamp is recorded, similar to when skborphan() was called early in the datapath before this patch.

Revert the now unused previous skbzcopy..nouarg infra.

Depends on commit 992cc9f94ca9 ("net/packet: defer vmalloc TXRING free until skbs finish").