Patch "ipvs: avoid stat macros calls from preemptible context" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    ipvs: avoid stat macros calls from preemptible context

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     ipvs-avoid-stat-macros-calls-from-preemptible-contex.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 505350d1fc7c5b9497b461e99fcf26d310d14ca2
Author: Fedor Pchelkin <pchelkin@xxxxxxxxx>
Date:   Mon Jan 15 17:39:22 2024 +0300

    ipvs: avoid stat macros calls from preemptible context
    
    [ Upstream commit d6938c1c76c64f42363d0d1f051e1b4641c2ad40 ]
    
    Inside decrement_ttl() upon discovering that the packet ttl has exceeded,
    __IP_INC_STATS and __IP6_INC_STATS macros can be called from preemptible
    context having the following backtrace:
    
    check_preemption_disabled: 48 callbacks suppressed
    BUG: using __this_cpu_add() in preemptible [00000000] code: curl/1177
    caller is decrement_ttl+0x217/0x830
    CPU: 5 PID: 1177 Comm: curl Not tainted 6.7.0+ #34
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 04/01/2014
    Call Trace:
     <TASK>
     dump_stack_lvl+0xbd/0xe0
     check_preemption_disabled+0xd1/0xe0
     decrement_ttl+0x217/0x830
     __ip_vs_get_out_rt+0x4e0/0x1ef0
     ip_vs_nat_xmit+0x205/0xcd0
     ip_vs_in_hook+0x9b1/0x26a0
     nf_hook_slow+0xc2/0x210
     nf_hook+0x1fb/0x770
     __ip_local_out+0x33b/0x640
     ip_local_out+0x2a/0x490
     __ip_queue_xmit+0x990/0x1d10
     __tcp_transmit_skb+0x288b/0x3d10
     tcp_connect+0x3466/0x5180
     tcp_v4_connect+0x1535/0x1bb0
     __inet_stream_connect+0x40d/0x1040
     inet_stream_connect+0x57/0xa0
     __sys_connect_file+0x162/0x1a0
     __sys_connect+0x137/0x160
     __x64_sys_connect+0x72/0xb0
     do_syscall_64+0x6f/0x140
     entry_SYSCALL_64_after_hwframe+0x6e/0x76
    RIP: 0033:0x7fe6dbbc34e0
    
    Use the corresponding preemption-aware variants: IP_INC_STATS and
    IP6_INC_STATS.
    
    Found by Linux Verification Center (linuxtesting.org).
    
    Fixes: 8d8e20e2d7bb ("ipvs: Decrement ttl")
    Signed-off-by: Fedor Pchelkin <pchelkin@xxxxxxxxx>
    Acked-by: Julian Anastasov <ja@xxxxxx>
    Acked-by: Simon Horman <horms@xxxxxxxxxx>
    Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c
index cd2130e98836..c87dbc897002 100644
--- a/net/netfilter/ipvs/ip_vs_xmit.c
+++ b/net/netfilter/ipvs/ip_vs_xmit.c
@@ -271,7 +271,7 @@ static inline bool decrement_ttl(struct netns_ipvs *ipvs,
 			skb->dev = dst->dev;
 			icmpv6_send(skb, ICMPV6_TIME_EXCEED,
 				    ICMPV6_EXC_HOPLIMIT, 0);
-			__IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
+			IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 
 			return false;
 		}
@@ -286,7 +286,7 @@ static inline bool decrement_ttl(struct netns_ipvs *ipvs,
 	{
 		if (ip_hdr(skb)->ttl <= 1) {
 			/* Tell the sender its packet died... */
-			__IP_INC_STATS(net, IPSTATS_MIB_INHDRERRORS);
+			IP_INC_STATS(net, IPSTATS_MIB_INHDRERRORS);
 			icmp_send(skb, ICMP_TIME_EXCEEDED, ICMP_EXC_TTL, 0);
 			return false;
 		}