net_sched: hold netns refcnt for each action

TC actions have been destroyed asynchronously for a long time,
previously in a RCU callback and now in a workqueue. If we
don't hold a refcnt for its netns, we could use the per netns
data structure, struct tcf_idrinfo, after it has been freed by
netns workqueue.

Hold refcnt to ensure netns destroy happens after all actions
are gone.

Fixes: ddf97ccdd7cb ("net_sched: add network namespace support for tc actions")
Reported-by: Lucas Bates <>
Tested-by: Lucas Bates <>
Cc: Jamal Hadi Salim <>
Cc: Jiri Pirko <>
Signed-off-by: Cong Wang <>
Signed-off-by: David S. Miller <>
18 files changed