This patch adds refcounting for qdisc->dev to avoid accessing freed memory from the __qdisc_destroy rcu-callback when the device is unregistered. Without refcounting netdev_wait_allrefs could free the device before __qdisc_destroy is done.