Fix a soft lockup in __mptcp_retrans in my test:

[  458.339707] watchdog: BUG: soft lockup - CPU#5 stuck for 26s! [kworker/5:2:23428]
[  458.339717] Modules linked in: bpf_testmod(OE) mptcp_diag tcp_diag inet_diag sch_netem act_csum act_pedit cls_fw sch_ingress xt_mark xt_statistic xt_length btusb btrtl btbcm nf_tables btintel bluetooth ecdh_generic ecc iptable_nat      bpfilter iwlmvm i2c_designware_platform i2c_designware_core iwlwifi x86_pkg_temp_thermal intel_lpss_pci thinkpad_acpi intel_lpss mfd_core ledtrig_audio battery platform_profile intel_pmc_core intel_hid usbkbd usbmouse nvme hid_multi     touch nvme_core i2c_hid_acpi i2c_hid pinctrl_cannonlake hid_generic usbhid sg dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua efivarfs [last unloaded: bpf_testmod]
[  458.339748] CPU: 5 PID: 23428 Comm: kworker/5:2 Tainted: G        W  OE     5.18.0-mptcp+ #76
[  458.339750] Hardware name: LENOVO 20UASA0901/20UASA0901, BIOS N2WET27W (1.17 ) 03/29/2021
[  458.339751] Workqueue: events mptcp_worker
[  458.339757] RIP: 0010:__mptcp_retrans+0x126/0x3a0
[  458.339759] Code: 44 24 30 4c 8d ab 50 06 00 00 48 c7 44 24 08 00 00 00 00 48 89 04 24 4c 8b bb 50 06 00 00 4d 39 ef 0f 84 5d 02 00 00 45 31 e4 <41> 0f b6 47 61 84 c0 0f 84 b4 00 00 00 49 8b af b0 00 00 00 48 85
[  458.339761] RSP: 0000:ffffae5c41e33de8 EFLAGS: 00000283
[  458.339762] RAX: 0000000000000000 RBX: ffffa006e4294b00 RCX: 0000000000000001
[  458.339764] RDX: 00002e53124044c8 RSI: 0000000000000000 RDI: ffffa006262a2400
[  458.339765] RBP: ffffa005c38f71c0 R08: ffffa005c38f7320 R09: 0000000000000001
[  458.339766] R10: ffffae5c41e33be0 R11: ffffa006e4294b00 R12: 0000000000000000
[  458.339767] R13: ffffa006e4295150 R14: ffffa006560a0000 R15: ffffa006e41a5100
[  458.339768] FS:  0000000000000000(0000) GS:ffffa0092d740000(0000) knlGS:0000000000000000
[  458.339769] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  458.339770] CR2: 00007f9a909ea000 CR3: 000000014d210003 CR4: 00000000003706e0
[  458.339771] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  458.339772] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  458.339773] Call Trace:
[  458.339776]  <TASK>
[  458.339779]  mptcp_worker+0x233/0x390
[  458.339782]  process_one_work+0x21f/0x430
[  458.339785]  ? process_one_work+0x430/0x430
[  458.339786]  worker_thread+0x2a/0x3b0
[  458.339788]  ? process_one_work+0x430/0x430
[  458.339789]  kthread+0xe6/0x110
[  458.339792]  ? kthread_complete_and_exit+0x20/0x20
[  458.339794]  ret_from_fork+0x1f/0x30
[  458.339798]  </TASK>

Signed-off-by: Geliang Tang <geliang.tang@suse.com>
---
 net/mptcp/protocol.c | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
index f39318f5a21e..d0621730692f 100644
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -2450,12 +2450,9 @@ static void __mptcp_retrans(struct sock *sk)
 	struct mptcp_data_frag *dfrag;
 	size_t copied = 0;
 	struct sock *ssk;
-	int err;
 
 	mptcp_clean_una_wakeup(sk);
 
-	/* first check ssk: need to kick "stale" logic */
-	err = mptcp_sched_get_retrans(msk);
 	dfrag = mptcp_rtx_head(sk);
 	if (!dfrag) {
 		if (mptcp_data_fin_enabled(msk)) {
@@ -2474,14 +2471,15 @@ static void __mptcp_retrans(struct sock *sk)
 		goto reset_timer;
 	}
 
-	if (err)
-		goto reset_timer;
-
 	/* limit retransmission to the bytes already sent on some subflows */
 	info.sent = 0;
 	info.limit = READ_ONCE(msk->csum_enabled) ? dfrag->data_len : dfrag->already_sent;
 	while (info.sent < info.limit) {
-		int ret = 0, max = 0;
+		int ret = 0, max = 0, err;
+
+		err = mptcp_sched_get_retrans(msk);
+		if (err)
+			goto reset_timer;
 
 		mptcp_for_each_subflow(msk, subflow) {
 			if (READ_ONCE(subflow->scheduled)) {
-- 
2.34.1