net/handshake: Unpin sock->file if a handshake is cancelled

If user space never calls DONE, sock->file's reference count remains
elevated. Enable sock->file to be freed eventually in this case.

Reported-by: Jakub Kacinski <[e-mail]>
Fixes: 3b3009ea8abb ("net/handshake: Create a NETLINK service for handling handshake requests")
Signed-off-by: Chuck Lever <[e-mail]>
Signed-off-by: Jakub Kicinski <[e-mail]>

net/handshake/handshake.h

···
 	struct list_head		hr_list;
 	struct rhash_head		hr_rhash;
 	unsigned long			hr_flags;
+	struct file			*hr_file;
 	const struct handshake_proto	*hr_proto;
 	struct sock			*hr_sk;
 	void				(*hr_odestruct)(struct sock *sk);

net/handshake/request.c

···
 	}
 	req->hr_odestruct = req->hr_sk->sk_destruct;
 	req->hr_sk->sk_destruct = handshake_sk_destruct;
+	req->hr_file = sock->file;
 
 	ret = -EOPNOTSUPP;
 	net = sock_net(req->hr_sk);
···
 		trace_handshake_cancel_busy(net, req, sk);
 		return false;
 	}
+
+	/* Request accepted and waiting for DONE */
+	fput(req->hr_file);
 
 out_true:
 	trace_handshake_cancel(net, req, sk);