mptcp: fix race in subflow_data_ready()