CVE-2026-98580: nfc: llcp: Fix race condition in accept_queue lifecycle

In the Linux kernel, the following vulnerability has been resolved:

nfc: llcp: Fix race condition in acceptqueue lifecycle

In nfcllcpsocketrelease(), sockets and listener accept queues are walked under the local sockets rwlock and bhlocksock(). However, bhlocksock() does not synchronise against process-context locksock() held by nfcllcpacceptdequeue() during accept(). Because socketrelease() does not check sockownedbyuser(), both paths can concurrently unlink and release the same child socket, resulting in use-after-free or a NULL pointer dereference of child->parent in nfcllcpacceptunlink().

Fix this synchronisation race by having nfcllcpsocketrelease() use process-context locksock() instead of bhlocksock():

1. Pop sockets from the local sockets list under the write lock using nfcllcpsocklistpop() so locksock() can be acquired without holding the rwlock.

2. Because locksock() can sleep, defer the final release of the nfcllcplocal structure to a workqueue (releasework). This avoids a sleeping-in-atomic bug when the last local reference is dropped from softirq context. Additionally, hold a single device reference on local from registration until final destruction.

3. In nfcllcplocalget(), use krefgetunlesszero() to prevent resurrecting a local object whose teardown has been scheduled.

4. In llcpsockaccept(), verify that the listener socket state is still LLCPLISTEN after waking from scheduletimeout() to prevent hangs if the listener is closed concurrently.

5. When unlinking unaccepted child sockets during listener release, unlink them from local->sockets, call sockorphan(), and drop their initial skalloc creation reference via sockput().

6. Make nfcllcpacceptunlink() idempotent by guarding parent access with a NULL check.