This is a false positive but I have no idea how we can annotate
this to not trigger in lockdep.
These are per-cpu locks for counter management.
The get_counters() code knows that the locks for other cpu's counters
can only be taken in software interrupt context of that other cpu. So
it is legal to turn software interrupts back on when grabbing their
locks in base context.
CC:'ing Eric Dumazet since he put the code the way it is now :-)
Via commit 24b36f0193467fa727b85b4c004016a8dae999b9
("netfilter: {ip,ip6,arp}_tables: dont block bottom half more than necessary")
--