[BUG] net/sched: GRED VQ shrink can orphan queued packets and wrap backlog

[BUG] net/sched: GRED VQ shrink can orphan queued packets and wrap backlog

[shaos]

Hello,

Queue packets on GRED virtual queue 5, shrink the table from eight VQs to one, re-expand it and recreate VQ 5. The queued skbs retain the DP number but the old per-VQ accounting object has been freed; dequeue subtracts from the new zeroed u32 backlog.

HEAD commit:    c03c1a14507dfaf8b856c2608f9ac216021fc222
git tree:       30fd2ef82912c26cf3a58ad0ba6afc375fa851ac
source version: Linux 7.3.0, local master
compiler:       gcc 11.4.0, GNU ld 2.38

console output:
https://gist.githubusercontent.com/shaos26/160abad19ad184cfbb6ef6c9be204b80/raw/82b323a9f5e2dce8b71893aeb0bf841eb019e691/console-output.txt
kernel config:
https://gist.githubusercontent.com/shaos26/160abad19ad184cfbb6ef6c9be204b80/raw/ac2ef52ac9d01812eef68d5a10de2fb3e5e8be4c/kernel-config.txt
reproducer:
https://gist.githubusercontent.com/shaos26/160abad19ad184cfbb6ef6c9be204b80/raw/e3f8a8dbb72be235d802784cb4265435f82de27d/poc-init
auxiliary reproducer (sender.c):
https://gist.githubusercontent.com/shaos26/160abad19ad184cfbb6ef6c9be204b80/raw/7028d32b386af449ac9097ae336dfa2d520b3e51/sender.c
auxiliary reproducer (run-qemu.sh):
https://gist.githubusercontent.com/shaos26/160abad19ad184cfbb6ef6c9be204b80/raw/abe3ba54cf34d873da1378b66ed0a1e3524e70b0/run-qemu.sh

Build the tested kernel with the attached test configuration and boot a disposable QEMU guest with a minimal BusyBox initramfs. poc-init configures TBF/GRED and the VQ resize sequence; sender.c generates the AF_PACKET traffic. The run-qemu.sh wrapper in this bundle records a complete run.

Impact and prerequisites:
The new VQ reports backlog 2^32-3000 and rejects subsequent packets assigned to it. This requires CAP_NET_ADMIN and CAP_NET_RAW in the network namespace and affects the configured qdisc; it is not a privilege escalation.

Validation: Two fresh-boot positives produced VQ 5 backlog 4294964296b and additional drops; a no-resize control drained to zero and transmitted the probe.

Thanks,

shaos