Patch "netfilter: flowtable_offload: fix using __this_cpu_add in preemptible" has been added to the 6.0-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    netfilter: flowtable_offload: fix using __this_cpu_add in preemptible

to the 6.0-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     netfilter-flowtable_offload-fix-using-__this_cpu_add.patch
and it can be found in the queue-6.0 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 69ab0f92f21a9426391fc42e16eaf42b17714521
Author: Xin Long <lucien.xin@xxxxxxxxx>
Date:   Thu Nov 24 12:54:10 2022 -0500

    netfilter: flowtable_offload: fix using __this_cpu_add in preemptible
    
    [ Upstream commit a81047154e7ce4eb8769d5d21adcbc9693542a79 ]
    
    flow_offload_queue_work() can be called in workqueue without
    bh disabled, like the call trace showed in my act_ct testing,
    calling NF_FLOW_TABLE_STAT_INC() there would cause a call
    trace:
    
      BUG: using __this_cpu_add() in preemptible [00000000] code: kworker/u4:0/138560
      caller is flow_offload_queue_work+0xec/0x1b0 [nf_flow_table]
      Workqueue: act_ct_workqueue tcf_ct_flow_table_cleanup_work [act_ct]
      Call Trace:
       <TASK>
       dump_stack_lvl+0x33/0x46
       check_preemption_disabled+0xc3/0xf0
       flow_offload_queue_work+0xec/0x1b0 [nf_flow_table]
       nf_flow_table_iterate+0x138/0x170 [nf_flow_table]
       nf_flow_table_free+0x140/0x1a0 [nf_flow_table]
       tcf_ct_flow_table_cleanup_work+0x2f/0x2b0 [act_ct]
       process_one_work+0x6a3/0x1030
       worker_thread+0x8a/0xdf0
    
    This patch fixes it by using NF_FLOW_TABLE_STAT_INC_ATOMIC()
    instead in flow_offload_queue_work().
    
    Note that for FLOW_CLS_REPLACE branch in flow_offload_queue_work(),
    it may not be called in preemptible path, but it's good to use
    NF_FLOW_TABLE_STAT_INC_ATOMIC() for all cases in
    flow_offload_queue_work().
    
    Fixes: b038177636f8 ("netfilter: nf_flow_table: count pending offload workqueue tasks")
    Signed-off-by: Xin Long <lucien.xin@xxxxxxxxx>
    Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/netfilter/nf_flow_table_offload.c b/net/netfilter/nf_flow_table_offload.c
index 00b522890d77..0fdcdb2c9ae4 100644
--- a/net/netfilter/nf_flow_table_offload.c
+++ b/net/netfilter/nf_flow_table_offload.c
@@ -997,13 +997,13 @@ static void flow_offload_queue_work(struct flow_offload_work *offload)
 	struct net *net = read_pnet(&offload->flowtable->net);
 
 	if (offload->cmd == FLOW_CLS_REPLACE) {
-		NF_FLOW_TABLE_STAT_INC(net, count_wq_add);
+		NF_FLOW_TABLE_STAT_INC_ATOMIC(net, count_wq_add);
 		queue_work(nf_flow_offload_add_wq, &offload->work);
 	} else if (offload->cmd == FLOW_CLS_DESTROY) {
-		NF_FLOW_TABLE_STAT_INC(net, count_wq_del);
+		NF_FLOW_TABLE_STAT_INC_ATOMIC(net, count_wq_del);
 		queue_work(nf_flow_offload_del_wq, &offload->work);
 	} else {
-		NF_FLOW_TABLE_STAT_INC(net, count_wq_stats);
+		NF_FLOW_TABLE_STAT_INC_ATOMIC(net, count_wq_stats);
 		queue_work(nf_flow_offload_stats_wq, &offload->work);
 	}
 }