[PATCH mptcp-net v2] mptcp: fix extra_subflows leak on failed passive join

[Chenguang Zhao <chenguang.zhao@linux.dev>]

From: Chenguang Zhao <zhaochenguang@kylinos.cn>

mptcp_pm_allow_new_subflow() increments extra_subflows
before __mptcp_finish_join() on the passive MP_JOIN path.
On synchronous join failure the subflow is dropped without
calling mptcp_close_ssk(), so the counter is not rolled back.

Call mptcp_pm_close_subflow() when the join completion fails.

Fixes: 3e5014909b56 ("mptcp: cleanup MPJ subflow list handling")
Signed-off-by: Chenguang Zhao <zhaochenguang@kylinos.cn>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
---
v2:
 Hi Matthieu,
 Thanks for the review.
 - I spotted this by reading the code. I don't have a reproducer
   yet. I also see we already have a Packetdrill test for
   synchronous connect failure (simult_connect.pkt), but not for
   synchronous join failure. I'll add a similar Packetdrill test
   for that case and send it in a follow-up patch.
 - Add Fixes and Reviewd-by tag.
 - I looked again at the history, and I think the Fixes tag
   should point to 3e5014909b56 ("mptcp: cleanup MPJ subflow list
   handling"), not 10f6d46c943d ("mptcp: fix race between MP_JOIN and close"). 
v1:
 - https://lore.kernel.org/all/20260630095432.1340629-1-chenguang.zhao@linux.dev/

 net/mptcp/protocol.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
index cb9515f505aa..b32f0cd262a7 100644
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -3907,6 +3907,7 @@ bool mptcp_finish_join(struct sock *ssk)
 	mptcp_data_unlock(parent);
 
 	if (!ret) {
+		mptcp_pm_close_subflow(msk);
 err_prohibited:
 		subflow->reset_reason = MPTCP_RST_EPROHIBIT;
 		return false;
-- 
2.25.1