mptcp: Fix error-cases in TCP_SYNCOOKIES path (finally)

Commit 79d7578 ("mptcp: Fix error-cases in TCP_SYNCOOKIES path")
took care of the lock-imbalance. But, we still have a memory-leak here.

First, we need to drop the request-socket's refcount. Otherwise it won't
get free'd. Second, no need to drop the meta's refcount. Instead, we
need to rather drop the subflow's one. Because, that one is still being
held and in "normal" execution would get dropped in tcp_child_process.
But here we do the error-path, thus we need to drop the child's refcount
here.

Fixes: b568f57 ("Merge tag 'v4.4' into mptcp_trunk")
Signed-off-by: Christoph Paasch <cpaasch@apple.com>
Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net>
(cherry picked from commit 1d5f9c3)
Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net>

net/mptcp/mptcp_ctrl.c

@@ -2223,7 +2223,11 @@ int mptcp_check_req_master(struct sock *sk, struct sock *child,
 		tcp_sk(meta_sk)->tsoffset = tsoff;
 		if (!inet_csk_reqsk_queue_add(sk, req, meta_sk)) {
 			bh_unlock_sock(meta_sk);
-			sock_put(meta_sk);
+			/* No sock_put() of the meta needed. The reference has
+			 * already been dropped in __mptcp_check_req_master().
+			 */
+			sock_put(child);
+			reqsk_put(req);
 			return -1;
 		}
 	}