fix stats in __ip_conntrack_confirm

Hi,

I've been discussing this with Eric. __ip_conntrack_confirm is entered from both process context and net_rx_softirq context and "++" operations aren't atomic.

So net_rx_softirq can preempt the calling process while incrementing the stats. I think that we can fix this moving both CONNTRACK_STAT_INC to the locked section.

regards,
Pablo

===== net/ipv4/netfilter/ip_conntrack_core.c 1.62 vs edited =====

@@ -490,13 +490,14 @@
 		add_timer(&ct->timeout);
 		atomic_inc(&ct->ct_general.use);
 		set_bit(IPS_CONFIRMED_BIT, &ct->status);
-		WRITE_UNLOCK(&ip_conntrack_lock);
 		CONNTRACK_STAT_INC(insert);
+		WRITE_UNLOCK(&ip_conntrack_lock);
 		return NF_ACCEPT;
 	}
 
-	WRITE_UNLOCK(&ip_conntrack_lock);
 	CONNTRACK_STAT_INC(insert_failed);
+	WRITE_UNLOCK(&ip_conntrack_lock);
+
 	return NF_DROP;
 }
 

Applied, thanks Pablo.

Regards
Patrick