---
change in v5:
   - reinitialize @q, @p (suggested by Vlad) and @tcm before replaying,
     just like @flags in tc_new_tfilter()

change in v3, v4:
   - add in-body From: tag

changes in v2:
   - replay the request if the current Qdisc has any ongoing RTNL-unlocked
     filter requests (Vlad)
   - minor changes in code comments and commit log

  include/net/sch_generic.h |  8 ++++++++
  net/sched/sch_api.c       | 40 ++++++++++++++++++++++++++++++---------
  net/sched/sch_generic.c   | 14 +++++++++++---
  3 files changed, 50 insertions(+), 12 deletions(-)

diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
index fab5ba3e61b7..3e9cc43cbc90 100644
--- a/include/net/sch_generic.h
+++ b/include/net/sch_generic.h

@@ -137,6 +137,13 @@ static inline void qdisc_refcount_inc(struct Qdisc *qdisc)
  	refcount_inc(&qdisc->refcnt);
  }
  
+static inline bool qdisc_refcount_dec_if_one(struct Qdisc *qdisc)
+{
+	if (qdisc->flags & TCQ_F_BUILTIN)
+		return true;
+	return refcount_dec_if_one(&qdisc->refcnt);
+}
+
  /* Intended to be used by unlocked users, when concurrent qdisc release is
   * possible.
   */

@@ -652,6 +659,7 @@ void dev_deactivate_many(struct list_head *head);
  struct Qdisc *dev_graft_qdisc(struct netdev_queue *dev_queue,
  			      struct Qdisc *qdisc);
  void qdisc_reset(struct Qdisc *qdisc);
+void qdisc_destroy(struct Qdisc *qdisc);
  void qdisc_put(struct Qdisc *qdisc);
  void qdisc_put_unlocked(struct Qdisc *qdisc);
  void qdisc_tree_reduce_backlog(struct Qdisc *qdisc, int n, int len);

diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index f72a581666a2..286b7c58f5b9 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c

@@ -1080,10 +1080,18 @@ static int qdisc_graft(struct net_device *dev, struct Qdisc *parent,
  		if ((q && q->flags & TCQ_F_INGRESS) ||
  		    (new && new->flags & TCQ_F_INGRESS)) {
  			ingress = 1;
-			if (!dev_ingress_queue(dev)) {
+			dev_queue = dev_ingress_queue(dev);
+			if (!dev_queue) {
  				NL_SET_ERR_MSG(extack, "Device does not have an ingress queue");
  				return -ENOENT;
  			}
+
+			/* Replay if the current ingress (or clsact) Qdisc has ongoing
+			 * RTNL-unlocked filter request(s).  This is the counterpart of that
+			 * qdisc_refcount_inc_nz() call in __tcf_qdisc_find().
+			 */
+			if (!qdisc_refcount_dec_if_one(dev_queue->qdisc_sleeping))
+				return -EAGAIN;
  		}
  
  		if (dev->flags & IFF_UP)

@@ -1104,8 +1112,16 @@ static int qdisc_graft(struct net_device *dev, struct Qdisc *parent,
  				qdisc_put(old);
  			}
  		} else {
-			dev_queue = dev_ingress_queue(dev);
-			old = dev_graft_qdisc(dev_queue, new);
+			old = dev_graft_qdisc(dev_queue, NULL);
+
+			/* {ingress,clsact}_destroy() @old before grafting @new to avoid
+			 * unprotected concurrent accesses to net_device::miniq_{in,e}gress
+			 * pointer(s) in mini_qdisc_pair_swap().
+			 */
+			qdisc_notify(net, skb, n, classid, old, new, extack);
+			qdisc_destroy(old);
+
+			dev_graft_qdisc(dev_queue, new);
  		}
  
  skip:

@@ -1119,8 +1135,6 @@ static int qdisc_graft(struct net_device *dev, struct Qdisc *parent,
  
  			if (new && new->ops->attach)
  				new->ops->attach(new);
-		} else {
-			notify_and_destroy(net, skb, n, classid, old, new, extack);
  		}
  
  		if (dev->flags & IFF_UP)

@@ -1450,19 +1464,22 @@ static int tc_get_qdisc(struct sk_buff *skb, struct nlmsghdr *n,
  			struct netlink_ext_ack *extack)
  {
  	struct net *net = sock_net(skb->sk);
-	struct tcmsg *tcm = nlmsg_data(n);
  	struct nlattr *tca[TCA_MAX + 1];
  	struct net_device *dev;
+	struct Qdisc *q, *p;
+	struct tcmsg *tcm;
  	u32 clid;
-	struct Qdisc *q = NULL;
-	struct Qdisc *p = NULL;
  	int err;
  
+replay:
  	err = nlmsg_parse_deprecated(n, sizeof(*tcm), tca, TCA_MAX,
  				     rtm_tca_policy, extack);
  	if (err < 0)
  		return err;
  
+	tcm = nlmsg_data(n);
+	q = p = NULL;
+
  	dev = __dev_get_by_index(net, tcm->tcm_ifindex);
  	if (!dev)
  		return -ENODEV;

@@ -1515,8 +1532,11 @@ static int tc_get_qdisc(struct sk_buff *skb, struct nlmsghdr *n,
  			return -ENOENT;
  		}
  		err = qdisc_graft(dev, p, skb, n, clid, NULL, q, extack);
-		if (err != 0)
+		if (err != 0) {
+			if (err == -EAGAIN)
+				goto replay;
  			return err;
+		}
  	} else {
  		qdisc_notify(net, skb, n, clid, NULL, q, NULL);
  	}

@@ -1704,6 +1724,8 @@ static int tc_modify_qdisc(struct sk_buff *skb, struct nlmsghdr *n,
  	if (err) {
  		if (q)
  			qdisc_put(q);
+		if (err == -EAGAIN)
+			goto replay;
  		return err;
  	}
  

diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 37e41f972f69..e14ed47f961c 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c

@@ -1046,7 +1046,7 @@ static void qdisc_free_cb(struct rcu_head *head)
  	qdisc_free(q);
  }
  
-static void qdisc_destroy(struct Qdisc *qdisc)
+static void __qdisc_destroy(struct Qdisc *qdisc)
  {
  	const struct Qdisc_ops  *ops = qdisc->ops;
  

@@ -1070,6 +1070,14 @@ static void qdisc_destroy(struct Qdisc *qdisc)
  	call_rcu(&qdisc->rcu, qdisc_free_cb);
  }
  
+void qdisc_destroy(struct Qdisc *qdisc)
+{
+	if (qdisc->flags & TCQ_F_BUILTIN)
+		return;
+
+	__qdisc_destroy(qdisc);
+}
+
  void qdisc_put(struct Qdisc *qdisc)
  {
  	if (!qdisc)

@@ -1079,7 +1087,7 @@ void qdisc_put(struct Qdisc *qdisc)
  	    !refcount_dec_and_test(&qdisc->refcnt))
  		return;
  
-	qdisc_destroy(qdisc);
+	__qdisc_destroy(qdisc);
  }
  EXPORT_SYMBOL(qdisc_put);
  

@@ -1094,7 +1102,7 @@ void qdisc_put_unlocked(struct Qdisc *qdisc)
  	    !refcount_dec_and_rtnl_lock(&qdisc->refcnt))
  		return;
  
-	qdisc_destroy(qdisc);
+	__qdisc_destroy(qdisc);
  	rtnl_unlock();
  }
  EXPORT_SYMBOL(qdisc_put_unlocked);