mptcp: correctly handle the tsq-callback-list

In mptcp_tsq_flags, we check for next_cb, if we want to add the sk to
the callback-list. Well, next_cb can well be NULL if the sk is the last
one in the list.

Then, we will create a loop in the callback-list, as mptcp_tsq_flags
will set the next_cb-pointer to the socket itself (if he is the only one
in the callback-list).

This patch fixes it, by making the callback-list a struct list_head.
That way we can check with list_empty() if the socket is inside the
callback-list. Further, we replace the mptcp_sock_destruct-stuff with a
BUG_ON(), because a socket should never ever be within the callback-list
when the refcnt becomes zero.

Reported-by: Vasiliy Tolstov <v.tolstov@selfip.ru>
Signed-off-by: Christoph Paasch <christoph.paasch@uclouvain.be>
New maintenance release

Signed-off-by: Christoph Paasch <christoph.paasch@uclouvain.be>