Merge: net: sched: fix race condition in qdisc_graft()

MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/2023

Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2165745
CVE: CVE-2023-0590
Upstream Status: net.git commit ebda44d
Tested: boot-tested only
Conflicts: none

Signed-off-by: Davide Caratti <dcaratti@redhat.com>

Approved-by: Guillaume Nault <gnault@redhat.com>
Approved-by: Paolo Abeni <pabeni@redhat.com>
Approved-by: Hangbin Liu <haliu@redhat.com>
Approved-by: Ivan Vecera <ivecera@redhat.com>

Signed-off-by: Herton R. Krzesinski <herton@redhat.com>

Author: Herton R. Krzesinski

net/sched/sch_api.c

@@ -1081,12 +1081,13 @@ static int qdisc_graft(struct net_device *dev, struct Qdisc *parent,
 
 skip:
 		if (!ingress) {
-			notify_and_destroy(net, skb, n, classid,
-					   rtnl_dereference(dev->qdisc), new);
+			old = rtnl_dereference(dev->qdisc);
 			if (new && !new->ops->attach)
 				qdisc_refcount_inc(new);
 			rcu_assign_pointer(dev->qdisc, new ? : &noop_qdisc);
 
+			notify_and_destroy(net, skb, n, classid, old, new);
+
 			if (new && new->ops->attach)
 				new->ops->attach(new);
 		} else {