[BUG] net/sched: failed RTM_DELTCLASS clears binding and makes retry succeed

[BUG] net/sched: failed RTM_DELTCLASS clears binding and makes retry succeed

[shaos]

Hello,

A class referenced by an HTB filter rejects RTM_DELTCLASS with -EBUSY, but __tc_ctl_tclass() unconditionally runs the reverse binding walk. The filter binding is cleared despite the failure, so an identical delete retry succeeds while the filter remains configured.

HEAD commit:    c03c1a14507dfaf8b856c2608f9ac216021fc222
git tree:       30fd2ef82912c26cf3a58ad0ba6afc375fa851ac
source version: Linux 7.3.0, local master
compiler:       gcc 11.4.0, GNU ld 2.38

console output:
https://gist.githubusercontent.com/shaos26/6621bf128af29e1959e1040ab721e8e4/raw/7b5cbc2be7590c9773c8c1245c3e03649b10a21d/console-output.txt
kernel config:
https://gist.githubusercontent.com/shaos26/6621bf128af29e1959e1040ab721e8e4/raw/28677abefb68039a69abe240b0770567dac89348/kernel-config.txt
reproducer:
https://gist.githubusercontent.com/shaos26/6621bf128af29e1959e1040ab721e8e4/raw/c69106d421daff43d46c200ae3e1d341cac56769/poc.sh

Build the tested kernel with the attached configuration. Run poc.sh with iproute2 tc and CAP_NET_ADMIN in a disposable network namespace (for example unshare -Urn). It configures HTB, a bound basic filter and two identical class deletion requests.

Impact and prerequisites:
A privileged network-namespace administrator receives inconsistent control-plane results and can remove a class through a request that first reported failure. Independent HFSC and HTB reproductions exercise the same generic sch_api.c path; no privilege escalation or memory-safety issue is shown.

Validation: Repeated fresh boots showed first delete -EBUSY and second delete success. A source-patched control kept both requests at -EBUSY; no-filter and explicit-unbind controls passed.

Thanks,

shaos