mptcp: Don't set rmem_alloc in mptcp_add_sock

If there is already data sitting in the receive-queue of the subflow we
would incorrectly increase rmem_alloc.

This gives us:
------------[ cut here ]------------
WARNING: CPU: 0 PID: 3749 at net/ipv4/af_inet.c:156 inet_sock_destruct+0x745/0x950 net/ipv4/af_inet.c:156
Kernel panic - not syncing: panic_on_warn set ...

CPU: 0 PID: 3749 Comm: syz-executor.0 Not tainted 4.14.121 #11
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 0.5.1 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x10a/0x1d1 lib/dump_stack.c:53
 panic+0x1bc/0x3c6 kernel/panic.c:182
 __warn+0x1c1/0x1e0 kernel/panic.c:546
 report_bug+0x1ee/0x2b0 lib/bug.c:186
 fixup_bug.part.9+0x32/0x80 arch/x86/kernel/traps.c:177
 fixup_bug arch/x86/kernel/traps.c:246 [inline]
 do_error_trap+0x248/0x320 arch/x86/kernel/traps.c:295
 invalid_op+0x1b/0x40 arch/x86/entry/entry_64.S:946
RIP: 0010:inet_sock_destruct+0x745/0x950 net/ipv4/af_inet.c:156
RSP: 0018:ffff88803d56f6c0 EFLAGS: 00010297
RAX: ffff88803e9eae00 RBX: ffff88803dd40b80 RCX: 000000000000000a
RDX: 0000000000000000 RSI: 1ffff11007aadece RDI: ffff88803dd40d58
RBP: 1ffff11007aadedf R08: ffff88803e9eb5b8 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000500
R13: ffffffff833333d0 R14: 0000000000000000 R15: ffff88803dd40cb8
 __sk_destruct+0xd9/0x6f0 net/core/sock.c:1585
 sk_destruct+0x43/0x70 net/core/sock.c:1620
 __sk_free+0x4a/0x220 net/core/sock.c:1628
 sk_free+0x26/0x30 net/core/sock.c:1639
 sock_put include/net/sock.h:1652 [inline]
 mptcp_close+0xa53/0x1790 net/mptcp/mptcp_ctrl.c:1881
 tcp_close+0xf96/0x12c0 net/ipv4/tcp.c:2222
 inet_release+0xea/0x1c0 net/ipv4/af_inet.c:428
 inet6_release+0x4b/0x70 net/ipv6/af_inet6.c:449
 __sock_release+0xce/0x2e0 net/socket.c:602
 sock_close+0x15/0x20 net/socket.c:1139
 __fput+0x30e/0x7b0 fs/file_table.c:210
 task_work_run+0x179/0x240 kernel/task_work.c:113
 tracehook_notify_resume include/linux/tracehook.h:191 [inline]
 exit_to_usermode_loop+0x1db/0x210 arch/x86/entry/common.c:164
 prepare_exit_to_usermode arch/x86/entry/common.c:199 [inline]
 syscall_return_slowpath arch/x86/entry/common.c:270 [inline]
 do_syscall_64+0x50a/0x6f0 arch/x86/entry/common.c:297
 entry_SYSCALL_64_after_hwframe+0x42/0xb7

Fixes: Zero-day bug
Signed-off-by: Christoph Paasch <cpaasch@apple.com>
Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net>

net/mptcp/mptcp_ctrl.c

@@ -1455,9 +1455,6 @@ int mptcp_add_sock(struct sock *meta_sk, struct sock *sk, u8 loc_id, u8 rem_id,
 
 	tp->mptcp->attached = 1;
 
-	atomic_add(atomic_read(&((struct sock *)tp)->sk_rmem_alloc),
-		   &meta_sk->sk_rmem_alloc);
-
 	mptcp_sub_inherit_sockopts(meta_sk, sk);
 	INIT_DELAYED_WORK(&tp->mptcp->work, mptcp_sub_close_wq);