mptcp: Don't unset inet_num

We introduced mptcp_icsk_forced_close to unlock the socket after the
call to tcp_done to avoid racing tcp_done with packet-reception while we
are in the ehash table.

That fix missed one critical part: These sockets also are already in the
bhash table. Meaning, icsk_bind_hash is set as is inet_num.
mptcp_icsk_forced_close forces inet_num to zero to avoid triggering the
WARN in inet_csk_destroy_sock. HOWEVER, this socket is properly in the
bhash table and we need to remove it.

If inet_num is 0, it means we end up taking the wrong head->lock in
inet_put_port() and we end up racing with other list-processing. This
ends up corrupting the bhash-list.

Fixes: 1d5fc78 ("mptcp: Do not race forced-closure with packet reception")
Signed-off-by: Christoph Paasch <cpaasch@apple.com>
Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net>
(cherry picked from commit 359aef5)
Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net>
(cherry picked from commit 5aff397)
Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net>
(cherry picked from commit 5387f81)
Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net>

net/mptcp/mptcp_ctrl.c

@@ -1056,7 +1056,6 @@ static void mptcp_icsk_forced_close(struct sock *sk)
 	/* The below has to be done to allow calling inet_csk_destroy_sock */
 	sock_set_flag(sk, SOCK_DEAD);
 	percpu_counter_inc(sk->sk_prot->orphan_count);
-	inet_sk(sk)->inet_num = 0;
 
 	tcp_done(sk);