[BUG] net/sched: malformed TCA_STAB can leave failed qdisc change committed

[shaos]

Hello,

Change an existing netem qdisc from 20 ms to 100 ms and include a malformed empty TCA_STAB in the same RTM_NEWQDISC request. qdisc_change() calls the qdisc callback before validating TCA_STAB, returns -EINVAL, but leaves the 100 ms option live.

HEAD commit:    c03c1a14507dfaf8b856c2608f9ac216021fc222
git tree:       30fd2ef82912c26cf3a58ad0ba6afc375fa851ac
source version: Linux 7.3.0, local master
compiler:       gcc 11.4.0, GNU ld 2.38

console output:
https://gist.githubusercontent.com/shaos26/faf3f124983448070e5242af5b3dd68d/raw/498cec333b632cbea7ffa02539d860e44d84c864/console-output.txt
kernel config:
https://gist.githubusercontent.com/shaos26/faf3f124983448070e5242af5b3dd68d/raw/5e0a640b23f7635af2334f3e1ff7cf185a620f1e/kernel-config.txt
reproducer:
https://gist.githubusercontent.com/shaos26/faf3f124983448070e5242af5b3dd68d/raw/ee84d2095025cc488421c5c2d9470604b456e73a/poc.c

Build the tested kernel with the attached configuration, boot it in disposable QEMU, compile poc.c statically and run in a network namespace with CAP_NET_ADMIN. The program creates netem, submits the mixed request and reads state back with RTM_GETQDISC.

Impact and prerequisites:
A caller with CAP_NET_ADMIN in the target namespace can receive an error while the device continues with the changed qdisc configuration. This is a control-plane atomicity/correctness defect; it does not cross a privilege boundary.

Validation: Four fresh exact-revision boots reproduced the state change. Invalid-STAB-only and patched-order controls left the old 20 ms setting unchanged.

Thanks,

shaos