Patch "netfilter: conntrack: fix using __this_cpu_add in preemptible" has been added to the 6.0-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    netfilter: conntrack: fix using __this_cpu_add in preemptible

to the 6.0-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     netfilter-conntrack-fix-using-__this_cpu_add-in-pree.patch
and it can be found in the queue-6.0 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit c2a1dfecd245d5d5d2e25a65af1a294d70cb3f43
Author: Xin Long <lucien.xin@xxxxxxxxx>
Date:   Thu Nov 24 12:21:46 2022 -0500

    netfilter: conntrack: fix using __this_cpu_add in preemptible
    
    [ Upstream commit 9464d0b68f11a9bc768370c3260ec02b3550447b ]
    
    Currently in nf_conntrack_hash_check_insert(), when it fails in
    nf_ct_ext_valid_pre/post(), NF_CT_STAT_INC() will be called in the
    preemptible context, a call trace can be triggered:
    
       BUG: using __this_cpu_add() in preemptible [00000000] code: conntrack/1636
       caller is nf_conntrack_hash_check_insert+0x45/0x430 [nf_conntrack]
       Call Trace:
        <TASK>
        dump_stack_lvl+0x33/0x46
        check_preemption_disabled+0xc3/0xf0
        nf_conntrack_hash_check_insert+0x45/0x430 [nf_conntrack]
        ctnetlink_create_conntrack+0x3cd/0x4e0 [nf_conntrack_netlink]
        ctnetlink_new_conntrack+0x1c0/0x450 [nf_conntrack_netlink]
        nfnetlink_rcv_msg+0x277/0x2f0 [nfnetlink]
        netlink_rcv_skb+0x50/0x100
        nfnetlink_rcv+0x65/0x144 [nfnetlink]
        netlink_unicast+0x1ae/0x290
        netlink_sendmsg+0x257/0x4f0
        sock_sendmsg+0x5f/0x70
    
    This patch is to fix it by changing to use NF_CT_STAT_INC_ATOMIC() for
    nf_ct_ext_valid_pre/post() check in nf_conntrack_hash_check_insert(),
    as well as nf_ct_ext_valid_post() in __nf_conntrack_confirm().
    
    Note that nf_ct_ext_valid_pre() check in __nf_conntrack_confirm() is
    safe to use NF_CT_STAT_INC(), as it's under local_bh_disable().
    
    Fixes: c56716c69ce1 ("netfilter: extensions: introduce extension genid count")
    Signed-off-by: Xin Long <lucien.xin@xxxxxxxxx>
    Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 60289c074eef..df46e9a35e47 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -891,7 +891,7 @@ nf_conntrack_hash_check_insert(struct nf_conn *ct)
 	zone = nf_ct_zone(ct);
 
 	if (!nf_ct_ext_valid_pre(ct->ext)) {
-		NF_CT_STAT_INC(net, insert_failed);
+		NF_CT_STAT_INC_ATOMIC(net, insert_failed);
 		return -ETIMEDOUT;
 	}
 
@@ -938,7 +938,7 @@ nf_conntrack_hash_check_insert(struct nf_conn *ct)
 
 	if (!nf_ct_ext_valid_post(ct->ext)) {
 		nf_ct_kill(ct);
-		NF_CT_STAT_INC(net, drop);
+		NF_CT_STAT_INC_ATOMIC(net, drop);
 		return -ETIMEDOUT;
 	}
 
@@ -1275,7 +1275,7 @@ __nf_conntrack_confirm(struct sk_buff *skb)
 	 */
 	if (!nf_ct_ext_valid_post(ct->ext)) {
 		nf_ct_kill(ct);
-		NF_CT_STAT_INC(net, drop);
+		NF_CT_STAT_INC_ATOMIC(net, drop);
 		return NF_DROP;
 	}