return !crypto_memneq(hmac, mp_opt->hmac, MPTCPOPT_HMAC_LEN);
 }
 
-static void mptcp_force_close(struct sock *sk)
-{
-       /* the msk is not yet exposed to user-space, and refcount is 2 */
-       inet_sk_state_store(sk, TCP_CLOSE);
-       sk_common_release(sk);
-       sock_put(sk);
-}
-
 static void subflow_ulp_fallback(struct sock *sk,
                                 struct mptcp_subflow_context *old_ctx)
 {
        struct mptcp_subflow_request_sock *subflow_req;
        struct mptcp_options_received mp_opt;
        bool fallback, fallback_is_fatal;
-       struct sock *new_msk = NULL;
        struct mptcp_sock *owner;
        struct sock *child;
 
                 * options.
                 */
                mptcp_get_options(skb, &mp_opt);
-               if (!(mp_opt.suboptions & OPTIONS_MPTCP_MPC)) {
+               if (!(mp_opt.suboptions & OPTIONS_MPTCP_MPC))
                        fallback = true;
-                       goto create_child;
-               }
 
-               new_msk = mptcp_sk_clone(listener->conn, &mp_opt, req);
-               if (!new_msk)
-                       fallback = true;
        } else if (subflow_req->mp_join) {
                mptcp_get_options(skb, &mp_opt);
                if (!(mp_opt.suboptions & OPTIONS_MPTCP_MPJ) ||
                                subflow_add_reset_reason(skb, MPTCP_RST_EMPTCP);
                                goto dispose_child;
                        }
-
-                       mptcp_subflow_drop_ctx(child);
-                       goto out;
+                       goto fallback;
                }
 
                /* ssk inherits options of listener sk */
                ctx->setsockopt_seq = listener->setsockopt_seq;
 
                if (ctx->mp_capable) {
-                       owner = mptcp_sk(new_msk);
+                       ctx->conn = mptcp_sk_clone(listener->conn, &mp_opt, req);
+                       if (!ctx->conn)
+                               goto fallback;
+
+                       owner = mptcp_sk(ctx->conn);
 
                        /* this can't race with mptcp_close(), as the msk is
                         * not yet exposted to user-space
                         */
-                       inet_sk_state_store((void *)new_msk, TCP_ESTABLISHED);
+                       inet_sk_state_store(ctx->conn, TCP_ESTABLISHED);
 
                        /* record the newly created socket as the first msk
                         * subflow, but don't link it yet into conn_list
                        /* new mpc subflow takes ownership of the newly
                         * created mptcp socket
                         */
-                       mptcp_sk(new_msk)->setsockopt_seq = ctx->setsockopt_seq;
+                       owner->setsockopt_seq = ctx->setsockopt_seq;
                        mptcp_pm_new_connection(owner, child, 1);
                        mptcp_token_accept(subflow_req, owner);
-                       ctx->conn = new_msk;
-                       new_msk = NULL;
 
                        /* set msk addresses early to ensure mptcp_pm_get_local_id()
                         * uses the correct data
                }
        }
 
-out:
-       /* dispose of the left over mptcp master, if any */
-       if (unlikely(new_msk))
-               mptcp_force_close(new_msk);
-
        /* check for expected invariant - should never trigger, just help
         * catching eariler subtle bugs
         */
 
        /* The last child reference will be released by the caller */
        return child;
+
+fallback:
+       mptcp_subflow_drop_ctx(child);
+       return child;
 }
 
 static struct inet_connection_sock_af_ops subflow_specific __ro_after_init;