smc_release() calls a sock_put() for smc fallback sockets to cover
the passive closing sock_hold() in __smc_connect() and
smc_tcp_listen_work(). This does not make sense for sockets in state
SMC_LISTEN and SMC_INIT.
An SMC socket stays in state SMC_INIT if connect fails. The sock_put
in smc_connect_abort() does not cover all failures. Move it into
smc_connect_decline_fallback().

Fixes: ee9dfbef

 ("net/smc: handle sockopts forcing fallback")
Reported-by:  <syzbot+3a0748c8f2f210c0ef9b@syzkaller.appspotmail.com>
Reported-by:  <syzbot+9e60d2428a42049a592a@syzkaller.appspotmail.com>
Signed-off-by: Ursula Braun <ubraun@linux.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>