[BUG] net/sched: rejected non-root taprio creation clears live mqprio map

[BUG] net/sched: rejected non-root taprio creation clears live mqprio map

[shaos]

Hello,

With a live root mqprio qdisc, request a taprio qdisc below a classful parent. taprio_init() adds the new object to its list and returns -EOPNOTSUPP for the non-root parent; failed-init cleanup calls taprio_destroy(), which unconditionally runs netdev_reset_tc() and clears the existing mqprio mapping.

HEAD commit:    c03c1a14507dfaf8b856c2608f9ac216021fc222
git tree:       30fd2ef82912c26cf3a58ad0ba6afc375fa851ac
source version: Linux 7.3.0, local master
compiler:       gcc 11.4.0, GNU ld 2.38

console output:
https://gist.githubusercontent.com/shaos26/d6cb2b6c066a10408dfa57513e998893/raw/40ff06d00c93a18c5f6e9cd5cceabfe8ac1ad5fb/console-output.txt
kernel config:
https://gist.githubusercontent.com/shaos26/d6cb2b6c066a10408dfa57513e998893/raw/6ea0e3da68f1e239d565c64f7906d0f9c73bf784/kernel-config.txt
reproducer:
https://gist.githubusercontent.com/shaos26/d6cb2b6c066a10408dfa57513e998893/raw/20c2e2bcbd51b34914e3a6571beb81777802e3cd/poc.c

Build the tested kernel with the attached configuration, compile poc.c statically and run it in a disposable QEMU guest/network namespace with CAP_NET_ADMIN. It creates root mqprio, attempts the rejected non-root taprio qdisc, and reads the surviving mapping.

Impact and prerequisites:
A rejected qdisc request removes the live device traffic-class mapping and its subordinate bindings. The request is available to CAP_NET_ADMIN in the namespace; no privilege escalation is demonstrated.

Validation: Two fresh final boots and a persistent-package rerun reproduced num_tc 2->0. A failed cake_mq control returned the same error while preserving num_tc=2.

Thanks,

shaos