Kernel fixes UAF in OVS and act_ct conntrack helpers

Ilya Maximets has posted fixes for a use-after-free in Linux conntrack helpers used by Open vSwitch and the TC act_ct action. The bug was reported by Axel Mierczuk.

Helpers for unconfirmed connections store a raw pointer into the conntrack extension area on the expectations list. Later extension additions (marks, labels, act_ct state, and similar) can reallocate that area, leaving a dangling pointer that is touched when the expectation is torn down.

A related path appears when an skb carrying an unconfirmed entry is cloned. Both clones can then commit with different extension sets, again invalidating pointers the helper already wired up. Maximets notes there is no practical pipeline that needs both clones to commit unmodified in the same zone, so the code now resets a shared unconfirmed entry on commit (and on NAT in act_ct, which allows NAT without commit).

The series also moves helper invocation to after all other extensions are installed, and drops dead helper-attachment logic that could never fire on the confirmed path. Aaron Conole reviewed the changes. Stable kernels are marked for backport.

Operators running OVS or TC conntrack with helpers on unconfirmed flows are the ones exposed; the practical trigger is clone-plus-commit or extension growth after the helper runs.