Suppose the sink socket in a splice has KTLS enabled. When data is
transmitted from the source socket, sosend_generic_locked() receives an
mbuf rather than a UIO as it would if userspace were transferring data.
In this case, ktls_frame() expects the mbuf to be unmapped, but in
general this won't be the case.
Simply disallow the combination for now. Modify so_unsplice() to handle
dismantling a partially initialized splice, in order to simplify error
handling in so_splice(). Make sure that one can't enable KTLS on a
spliced socket, or more specifically, that one can't enable RXTLS on the
source side of a splice, or TXTLS on the sink side of a splice.
Reported by: syzbot+9cc248c4b0ca9b931ab4@syzkaller.appspotmail.com