mptcp: Always release meta if it gets closed half-way through

After the check for is_meta_sk() in tcp_check_req and before acquiring
the lock, the meta might have been closed through mptcp_disconnect. At
that point, the is_meta_sk()-check will return false. However, we still
did acquire the lock and thus need to release it. So, store this info in
a local variable in tcp_check_req.

Also, there is another path through which we might enter calling
tcp_check_req, namely mptcp_v4/6_do_rcv. In that case, we don't end up
calling tcp_child_process and thus need to manually drop the meta-lock
ourselves.

Fixes: b4563ba ("mptcp: Take meta-lock when creating secondary subflow")
Signed-off-by: Christoph Paasch <cpaasch@apple.com>
Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net>
(cherry picked from commit f182a8e)
Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net>

net/ipv4/tcp_minisocks.c

@@ -634,6 +634,7 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
 	__be32 flg = tcp_flag_word(th) & (TCP_FLAG_RST|TCP_FLAG_SYN|TCP_FLAG_ACK);
 	bool paws_reject = false;
 	bool own_req;
+	bool meta_locked = false;
 
 	tmp_opt.saw_tstamp = 0;
 
@@ -836,8 +837,10 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
 	 * ESTABLISHED STATE. If it will be dropped after
 	 * socket is created, wait for troubles.
 	 */
-	if (is_meta_sk(sk))
+	if (is_meta_sk(sk)) {
 		bh_lock_sock_nested(sk);
+		meta_locked = true;
+	}
 	child = inet_csk(sk)->icsk_af_ops->syn_recv_sock(sk, skb, req, NULL,
 							 req, &own_req);
 	if (!child)
@@ -855,16 +858,17 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
 		return mptcp_check_req_child(sk, child, req, skb, &mopt);
 	}
 
-	if (is_meta_sk(sk))
+	if (meta_locked)
 		bh_unlock_sock(sk);
 
 	sock_rps_save_rxhash(child, skb);
 	tcp_synack_rtt_meas(child, req);
 	*req_stolen = !own_req;
+
 	return inet_csk_complete_hashdance(sk, child, req, own_req);
 
 listen_overflow:
-	if (is_meta_sk(sk))
+	if (meta_locked)
 		bh_unlock_sock(sk);
 
 	if (!sock_net(sk)->ipv4.sysctl_tcp_abort_on_overflow) {

net/mptcp/mptcp_ipv4.c

@@ -203,6 +203,7 @@ int mptcp_v4_do_rcv(struct sock *meta_sk, struct sk_buff *skb)
 				goto reset_and_discard;
 			}
 
+			bh_unlock_sock(meta_sk);
 			local_bh_enable();
 			return 0;
 		}

net/mptcp/mptcp_ipv6.c

@@ -231,6 +231,7 @@ int mptcp_v6_do_rcv(struct sock *meta_sk, struct sk_buff *skb)
 				goto reset_and_discard;
 			}
 
+			bh_unlock_sock(meta_sk);
 			local_bh_enable();
 			return 0;
 		}