mptcp: Don't leak request-sockets when socket-creation fails

We may end up not creating the socket (E.g., if mptcp_create_master_sk()
fails). In that case we need to make sure that the request-socket is
properly cleaned up. Thus, call __reqsk_free() at the appropriate place
in tcp_get_cookies_sock()

Fixes: Zero-day bug
Signed-off-by: Christoph Paasch <cpaasch@apple.com>
Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net>
(cherry picked from commit 5d7d27c)
Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net>
(cherry picked from commit 5433d7f)
Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net>

net/ipv4/syncookies.c

@@ -224,8 +224,10 @@ struct sock *tcp_get_cookie_sock(struct sock *sk, struct sk_buff *skb,
 		goto listen_overflow;
 
 	ret = mptcp_check_req_master(sk, child, req, skb, 0, tsoff);
-	if (ret < 0)
+	if (ret < 0) {
+		__reqsk_free(req);
 		return NULL;
+	}
 
 	if (!ret)
 		return tcp_sk(child)->mpcb->master_sk;

net/mptcp/mptcp_ctrl.c

@@ -2265,7 +2265,6 @@ int mptcp_check_req_master(struct sock *sk, struct sock *child,
 			 * already been dropped in __mptcp_check_req_master().
 			 */
 			sock_put(child);
-			reqsk_put(req);
 			return -1;
 		}
 	}