[NETFILTER]: Prevent orphan expectations.

This patch fixes orphaned expectations, which can occur when helpers create
expectations for unconfirmed conntracks and the packet is dropped before
the conntrack is confirmed.

Signed-off-by: Phil Oester <kernel@linuxace.com>
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@redhat.com>

diff --git a/net/ipv4/netfilter/ip_conntrack_core.c b/net/ipv4/netfilter/ip_conntrack_core.c
index b79afaf452a9736a99b38ddc23a4c40347e0383f..67c2fd2a5335fcefceb0c582f37389400164b204 100644 (file)
--- a/net/ipv4/netfilter/ip_conntrack_core.c
+++ b/net/ipv4/netfilter/ip_conntrack_core.c
@@ -324,8 +324,9 @@ destroy_conntrack(struct nf_conntrack *nfct)
                ip_conntrack_destroyed(ct);
 
        WRITE_LOCK(&ip_conntrack_lock);
-       /* Delete us from our own list to prevent corruption later */
-       list_del(&ct->sibling_list);
+       /* Make sure don't leave any orphaned expectations lying around */
+       if (ct->expecting)
+               remove_expectations(ct, 1);
 
        /* Delete our master expectation */
        if (ct->master) {