dummynet: use atomics to maintain pie_desc.ref_count

[mjg]

Summary

The counter is a global, but previously used DN_BH_WLOCK/DN_BH_WUNLOCK is per vnet so it failed to provide the protection and in case of pie_callout_cleanup panicked on top of it as no vnet was set.

Note this this only restores bug-to-bug compatibility with pre-vnetification of the code.

[kp]

There's discussion of what looks to be the same issue in D33432
fqpie_callout_cleanup() seems to be affected as well.

It looks like ref_count is only ever evaluated (as opposed to updated) in unload_dn_sched(), where it's protected by the global sched_mtx lock. I think we can fix the problem by replacing the DN_BH_WLOCK() by the sched_mtx (possibly through a 'dummynet_lock_sched()' function, because sched_mtx is local to ip_dummynet.c).

[franco_opnsense.org]

fqpie_callout_cleanup() should exhibit the same issue

[kp]

I propose something like D34059 instead.

[mjg]

3f3e4f3c7472640aab998612a2253da95102345a