[BUG] net/sched: failed mqprio create resets the live device TC map

[BUG] net/sched: failed mqprio create resets the live device TC map

[shaos]

Hello,

Install a live root mqprio qdisc with two traffic classes, then issue a create/replace request with an invalid priority-to-TC map. The new qdisc init fails, but qdisc_create() calls mqprio_destroy(), which resets the device TC configuration even though the failed object never installed it.

HEAD commit:    c03c1a14507dfaf8b856c2608f9ac216021fc222
git tree:       30fd2ef82912c26cf3a58ad0ba6afc375fa851ac
source version: Linux 7.3.0, local master
compiler:       gcc 11.4.0, GNU ld 2.38

console output:
https://gist.githubusercontent.com/shaos26/07ecebed4bcd911e280189e1c8ba7300/raw/3bb0bde411b29192b5bb1f2a1929b91b1b05b393/console-output.txt
kernel config:
https://gist.githubusercontent.com/shaos26/07ecebed4bcd911e280189e1c8ba7300/raw/6ea0e3da68f1e239d565c64f7906d0f9c73bf784/kernel-config.txt
reproducer:
https://gist.githubusercontent.com/shaos26/07ecebed4bcd911e280189e1c8ba7300/raw/170fc7a14bce50315912a64f0f2fa1e82a47b002/poc.c

Build the tested kernel with the attached configuration, compile poc.c statically and run it in a disposable QEMU guest/network namespace with CAP_NET_ADMIN. It creates a live mqprio qdisc, sends the failing replacement and dumps the surviving root qdisc.

Impact and prerequisites:
The existing root qdisc remains attached but its num_tc and queue mappings are cleared. This is a deterministic configuration-loss bug reachable by CAP_NET_ADMIN in the target namespace; no privilege escalation is demonstrated.

Validation: Two fresh QEMU positives changed num_tc from 2 to 0 after -EINVAL. Invalid fq_codel-create and patched/ordinary controls retained the live configuration.

Thanks,

shaos