mptcp: don't leak msk in token container

When the left-over msk is freed by subflow_syn_recv_sock(),
we don't invoke the proto->destroy() method, to the socket
is not removed from the token container, leading to later
UaF.

Address the issue explicitly removing the token even in the
above error path.

Signed-off-by: Paolo Abeni <[email protected]>

net/mptcp/subflow.c

@@ -393,6 +393,7 @@ static void mptcp_sock_destruct(struct sock *sk)
 		sock_orphan(sk);
 	}
 
+	mptcp_token_destroy(mptcp_sk(sk));
 	inet_sock_destruct(sk);
 }