Done in a not-very-elegant way:
Iterate over tcp listen hash, then pick out the tcp sockets
with mptcp-ctx structure attached, then take the conn->sk for dumping.

First patch is preparation/cleanup.
Second patch gets rid of locking to avoid a lockdep splat.
If the socket lock is really needed (I don't see where) I can workaround
this by dropping locks temporarily when iterating the listen hash table,
but its a bit more awkward.

Last patch is needed so that 'Send-Q' has expected content instead of 0.

Sample output:
ss -Mil
State        Recv-Q Send-Q Local Address:Port  Peer Address:Port
LISTEN       0      20     127.0.0.1:12000     0.0.0.0:*
         subflows_max:2

Florian Westphal (4):
  mptcp: diag: switch to context structure
  mptcp: remove locking in mptcp_diag_fill_info
  mptcp: listen diag dump support
  mptcp: let mptcp listen dump show listen backlog size

 net/mptcp/mptcp_diag.c | 91 +++++++++++++++++++++++++++++++++++++++---
 net/mptcp/protocol.c   |  5 ++-
 net/mptcp/sockopt.c    |  6 ---
 3 files changed, 90 insertions(+), 12 deletions(-)

-- 
2.34.1