On Wed, Dec 20, 2017 at 10:17 AM, Cong Wang [off-list ref] wrote:
I guess it is q->miniqp which is freed in qdisc_graft() without properly
waiting for rcu readers?
It is probably so, the call_rcu_bh(&miniq_old->rcu, mini_qdisc_rcu_func)
in the end of mini_qdisc_pair_swap() is invoked on miniq_old->rcu,
but miniq is being freed, no rcu barrier waits for it...
You can try to add a rcu_barrier_bh() at the end to see if this crash
is gone, but I don't think people like adding yet another rcu barrier...