diff --git a/net/mptcp/pm_netlink.c b/net/mptcp/pm_netlink.c
index 824420c4e8f9d585d9ddd4c2d0c0fe44f71f0128..44353d4ba95b6017c5a4924ff77ff05d8ec8c27f 100644
--- a/net/mptcp/pm_netlink.c
+++ b/net/mptcp/pm_netlink.c
@@ -420,16 +420,23 @@ void mptcp_pm_nl_rm_addr_received(struct mptcp_sock *msk)
 		struct sock *ssk = mptcp_subflow_tcp_sock(subflow);
 		int how = RCV_SHUTDOWN | SEND_SHUTDOWN;
 		long timeout = 0;
+		bool removed = false;
 
 		if (msk->pm.rm_id != subflow->remote_id)
 			continue;
 
 		spin_unlock_bh(&msk->pm.lock);
 		mptcp_subflow_shutdown(sk, ssk, how);
+		removed |= subflow->request_join;
 		__mptcp_close_ssk(sk, ssk, subflow, timeout);
 		spin_lock_bh(&msk->pm.lock);
 
-		msk->pm.add_addr_accepted--;
+		if(removed && msk->pm.rm_id &&
+		   !WARN_ON_ONCE(msk->pm.add_addr_accepted == 0))
+			/* Note: if the subflow has been closed before, this
+			* add_addr_accepted counter will not be decremented.
+			*/
+			msk->pm.add_addr_accepted--;
 		msk->pm.subflows--;
 		WRITE_ONCE(msk->pm.accept_addr, true);