diff --git a/net/mptcp/pm_netlink.c b/net/mptcp/pm_netlink.c
index 14f10f1ba75a4441a352a3272199796d3b74a805..9119afa4dc018e45f65dce652a1a97188d9c0550 100644
--- a/net/mptcp/pm_netlink.c
+++ b/net/mptcp/pm_netlink.c
@@ -426,16 +426,23 @@ void mptcp_pm_nl_rm_addr_received(struct mptcp_sock *msk)
 		struct sock *ssk = mptcp_subflow_tcp_sock(subflow);
 		int how = RCV_SHUTDOWN | SEND_SHUTDOWN;
 		long timeout = 0;
+		bool removed = false;
 
 		if (msk->pm.rm_id != subflow->remote_id)
 			continue;
 
 		spin_unlock_bh(&msk->pm.lock);
 		mptcp_subflow_shutdown(sk, ssk, how);
+		removed |= subflow->request_join;
 		__mptcp_close_ssk(sk, ssk, subflow, timeout);
 		spin_lock_bh(&msk->pm.lock);
 
-		msk->pm.add_addr_accepted--;
+		if (removed && msk->pm.rm_id &&
+		   !WARN_ON_ONCE(msk->pm.add_addr_accepted == 0))
+			/* Note: if the subflow has been closed before, this
+			 * add_addr_accepted counter will not be decremented.
+			 */
+			msk->pm.add_addr_accepted--;
 		msk->pm.subflows--;
 		WRITE_ONCE(msk->pm.accept_addr, true);