glb-redirect: fix two socket freeing bugs

[lmb]

I think I've found two bugs in the way glb-redirect releases socket references. One of them is leading to kernel crashes, while the other one I spotted because I fixed a different SOCK_RCU_FREE bug recently (so you can consider it a preemptive fix). Please see the commit descriptions for details.

We're in the process of migrating away from glb-redirect, so I haven't run this through the test suite. I'd appreciate it if you could do that for me.

[lmb]

I've removed the patch to not sock_put listeners. You bump the refcount just before, which I missed. However, I think that the code handling listening sockets still has problems:

• Taking the refcount should happen on Linux >= 4.6 (see https://github.com/torvalds/linux/commit/3b24d854cb35383c30642116e5992fd619bdc9bc) but only happens on >= 4.8
• Taking the refcount is misleading, since it doesn't protect the socket from being freed. Instead, the rcu_read_lock held by netfilter protects against using freed sockets.

My suggestion is to drop the listening socket refcount logic on >= 4.6 kernels.