[NET_SCHED]: sch_htb: perform qlen adjustment immediately in ->delete

qlen adjustment should happen immediately in ->delete and not in the
class destroy function because the reference count will not hit zero in
->delete (sch_api holds a reference) but in ->put. Since the qdisc
lock is released between deletion of the class and final destruction
this creates an externally visible error in the qlen counter.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 4b52fa78935a025dfd338c374e939bd630c06111..08fa4d083615d8a8c7d671a8104d84897b37f652 100644 (file)
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -1269,9 +1269,9 @@ static void htb_destroy_filters(struct tcf_proto **fl)
 static void htb_destroy_class(struct Qdisc *sch, struct htb_class *cl)
 {
        struct htb_sched *q = qdisc_priv(sch);
+
        if (!cl->level) {
                BUG_TRAP(cl->un.leaf.q);
-               sch->q.qlen -= cl->un.leaf.q->q.qlen;
                qdisc_destroy(cl->un.leaf.q);
        }
        qdisc_put_rtab(cl->rate);
@@ -1334,6 +1334,11 @@ static int htb_delete(struct Qdisc *sch, unsigned long arg)
        /* delete from hash and active; remainder in destroy_class */
        hlist_del_init(&cl->hlist);
 
+       if (!cl->level) {
+               sch->q.qlen -= cl->un.leaf.q->q.qlen;
+               qdisc_reset(cl->un.leaf.q);
+       }
+
        if (cl->prio_activity)
                htb_deactivate(q, cl);