Re: [PATCH] net/sched: revalidate the sleeping-root lock in timers

[Jakub Kicinski]

On Thu, 29 Oct 2026 21:23:12 -0700 Kyle Zeng wrote:
> Autonomous qdisc timers select their lock through qdisc_sleeping.
> dev_graft_qdisc() changes that pointer while holding the previous root's
> lock, but a timer may have read the old pointer before the graft and only
> acquire its lock afterwards. RCU keeps the old qdisc alive; it does not
> make that lock protect the replacement hierarchy.
> 
> For example, a backlogged MQ child retained by an outstanding filter
> request can be detached and regrafted at the same parent. An SFQ timer
> that selected the interim root can then rehash its queues under that
> obsolete lock while tbf_graft() resets the SFQ under the current root's
> lock. This corrupts skb lists and SFQ slot state.
> 
> Add an RCU-side helper which acquires the sleeping-root lock, checks
> that the root is still current, and retries if it changed. Once the
> check succeeds, dev_graft_qdisc() cannot replace the root until the
> callback releases its lock. Use it in the SFQ, RED, PIE, FQ-PIE and
> DualPI2 timers.
> 
> Route default-qdisc attachment and scheduler shutdown through
> dev_graft_qdisc() as well, so live sleeping-root publications follow
> the same locking protocol.

Clashiko suggests the fix is incomplete:
https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20261030042312.74363-1-kylebot@xxxxxxxxxx
-- 
pw-bot: cr