On Wed, May 17, 2023 at 11:48:25AM -0700, Jakub Kicinski wrote:

quoted

            } else {
-                   dev_queue = dev_ingress_queue(dev);
-                   old = dev_graft_qdisc(dev_queue, new);
+                   old = dev_graft_qdisc(dev_queue, NULL);
+
+                   /* {ingress,clsact}_destroy() "old" before grafting "new" to avoid
+                    * unprotected concurrent accesses to net_device::miniq_{in,e}gress
+                    * pointer(s) in mini_qdisc_pair_swap().
+                    */
+                   qdisc_notify(net, skb, n, classid, old, new, extack);
+                   qdisc_destroy(old);
+
+                   dev_graft_qdisc(dev_queue, new);

BTW can't @old be NULL here?

ingress_queue->qdisc_sleeping is initialized to &noop_qdisc (placeholder)
in dev_ingress_queue_create(), and dev_graft_qdisc() also grafts
&noop_qdisc to represent "there's no Qdisc":

	/* ... and graft new one */
	if (qdisc == NULL)
		qdisc = &noop_qdisc;
	dev_queue->qdisc_sleeping = qdisc;

So @old can't be NULL here.

Thanks,
Peilin Ye