CVE-2026-90248: net/sched: cls_api: fix teardown of an adopted proto on insert-race loss

In the Linux kernel, the following vulnerability has been resolved:

net/sched: clsapi: fix teardown of an adopted proto on insert-race loss

In tcnewtfilter() the create branch sets tpcreated = 1 before calling tcfchaintpinsertunique(). When the caller loses the race (another request inserted a proto at the same chain/prio first), insertunique() destroys the caller's own tpnew and returns the winner's proto with an extra reference. tpcreated was never cleared, so the loser's errout path treated the winner's live proto as its own and called tcfchaintpdeleteempty() on it, silently unlinking an active classifier that the winning request already advertised via RTMNEWTFILTER.

Track the outcome of the insert step in a single tri-state variable so each errout path reacts correctly:

- TPNOTCREATED: no proto created; pursue the old path. - TPCREATED: proto inserted successfully; same code path as before. - TPNOTOWNED: New - lost the insert race; tp is another request's proto (chain ref already released by tpnew's destroy)

Both errout reactions are single expressions derived from the state.

This fix is motivated by the Sashiko's automated review of Patch (net/sched: clsapi: Always acquire rtnllock when destroying locked classifiers) [1][2]. The review identified the silent-unlink behaviour of an adopted proto's teardown when a request loses the tcfchaintpinsertunique() race.

[1] https://sashiko.dev/#/patchset/20260801125632.360365-1-jhs%40mojatatu.com [2] https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260801125632.360365-1-jhs%40mojatatu.com