[PATCH net-next 4/8] netfilter: nf_conntrack_expect: consolidate check for insertion of dead expectation

[Pablo Neira Ayuso <pablo@netfilter.org>]

Consolidate the check for buggy expectations with DEAD flag on
insertion, which is called both by nf_ct_expect_related() and
nf_ct_expect_related_pair().

Fixes: e765c95faa10 ("netfilter: nf_conntrack_expect: bail out on insert dead expectations")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 net/netfilter/nf_conntrack_expect.c | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
index f1f0c582db5d..06242c86e1dc 100644
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -477,6 +477,11 @@ static inline int __nf_ct_expect_check(struct nf_conntrack_expect *expect,
 
 	lockdep_nfct_expect_lock_held();
 
+	if (expect->flags & NF_CT_EXPECT_DEAD) {
+		DEBUG_NET_WARN_ON_ONCE(1);
+		return -EINVAL;
+	}
+
 	h = nf_ct_expect_dst_hash(net, &expect->tuple);
 	hlist_for_each_entry_safe(i, next, &nf_ct_expect_hash[h], hnode) {
 		if (nf_ct_exp_is_expired(i)) {
@@ -528,12 +533,6 @@ int nf_ct_expect_related_report(struct nf_conntrack_expect *expect,
 	int ret;
 
 	spin_lock_bh(&nf_conntrack_expect_lock);
-	if (expect->flags & NF_CT_EXPECT_DEAD) {
-		DEBUG_NET_WARN_ON_ONCE(1);
-		ret = -EINVAL;
-		goto out;
-	}
-
 	master_help = nfct_help(expect->master);
 	if (!master_help) {
 		ret = -ESHUTDOWN;
-- 
2.47.3