[NETFILTER]: fix stats in __ip_conntrack_confirm

net_rx_softirq can preempt the calling process while incrementing the stats.
I think that we can fix this moving both CONNTRACK_STAT_INC to the locked
section. 
Signed-off-by: Pablo Neira Ayuso <pablo@eurodev.net>
Signed-off-by: Patrick McHardy <kaber@trash.net>

net/ipv4/netfilter/ip_conntrack_core.c

@@ -434,13 +434,14 @@ __ip_conntrack_confirm(struct sk_buff *skb)
 		add_timer(&ct->timeout);
 		atomic_inc(&ct->ct_general.use);
 		set_bit(IPS_CONFIRMED_BIT, &ct->status);
-		WRITE_UNLOCK(&ip_conntrack_lock);
 		CONNTRACK_STAT_INC(insert);
+		WRITE_UNLOCK(&ip_conntrack_lock);
 		return NF_ACCEPT;
 	}
 
-	WRITE_UNLOCK(&ip_conntrack_lock);
 	CONNTRACK_STAT_INC(insert_failed);
+	WRITE_UNLOCK(&ip_conntrack_lock);
+
 	return NF_DROP;
 }