On Wed, Dec 20, 2017 at 10:17 AM, Cong Wang <xiyou.wangc...@gmail.com> wrote: > > I guess it is q->miniqp which is freed in qdisc_graft() without properly > waiting for rcu readers?
It is probably so, the call_rcu_bh(&miniq_old->rcu, mini_qdisc_rcu_func) in the end of mini_qdisc_pair_swap() is invoked on miniq_old->rcu, but miniq is being freed, no rcu barrier waits for it... You can try to add a rcu_barrier_bh() at the end to see if this crash is gone, but I don't think people like adding yet another rcu barrier...
