[NETFILTER]: Prevent orphan expectations.

This patch fixes orphaned expectations, which can occur when helpers create
expectations for unconfirmed conntracks and the packet is dropped before
the conntrack is confirmed.
Signed-off-by: Phil Oester <kernel@linuxace.com>
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@redhat.com>

net/ipv4/netfilter/ip_conntrack_core.c

@@ -324,8 +324,9 @@ destroy_conntrack(struct nf_conntrack *nfct)
 		ip_conntrack_destroyed(ct);
 
 	WRITE_LOCK(&ip_conntrack_lock);
-	/* Delete us from our own list to prevent corruption later */
-	list_del(&ct->sibling_list);
+	/* Make sure don't leave any orphaned expectations lying around */
+	if (ct->expecting)
+		remove_expectations(ct, 1);
 
 	/* Delete our master expectation */
 	if (ct->master) {