[BUG] net/sched: rejected non-root taprio creation clears live mqprio map
From: shaos <hidden>
Date: 2026-10-22 14:49:05
Also in:
lkml
Hello, With a live root mqprio qdisc, request a taprio qdisc below a classful parent. taprio_init() adds the new object to its list and returns -EOPNOTSUPP for the non-root parent; failed-init cleanup calls taprio_destroy(), which unconditionally runs netdev_reset_tc() and clears the existing mqprio mapping. HEAD commit: c03c1a14507dfaf8b856c2608f9ac216021fc222 git tree: 30fd2ef82912c26cf3a58ad0ba6afc375fa851ac source version: Linux 7.3.0, local master compiler: gcc 11.4.0, GNU ld 2.38 console output: https://gist.githubusercontent.com/shaos26/d6cb2b6c066a10408dfa57513e998893/raw/40ff06d00c93a18c5f6e9cd5cceabfe8ac1ad5fb/console-output.txt kernel config: https://gist.githubusercontent.com/shaos26/d6cb2b6c066a10408dfa57513e998893/raw/6ea0e3da68f1e239d565c64f7906d0f9c73bf784/kernel-config.txt reproducer: https://gist.githubusercontent.com/shaos26/d6cb2b6c066a10408dfa57513e998893/raw/20c2e2bcbd51b34914e3a6571beb81777802e3cd/poc.c Build the tested kernel with the attached configuration, compile poc.c statically and run it in a disposable QEMU guest/network namespace with CAP_NET_ADMIN. It creates root mqprio, attempts the rejected non-root taprio qdisc, and reads the surviving mapping. Impact and prerequisites: A rejected qdisc request removes the live device traffic-class mapping and its subordinate bindings. The request is available to CAP_NET_ADMIN in the namespace; no privilege escalation is demonstrated. Validation: Two fresh final boots and a persistent-package rerun reproduced num_tc 2->0. A failed cake_mq control returned the same error while preserving num_tc=2. Thanks, shaos