1 files changed, 14 insertions, 12 deletions

diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index 956ff3da81f4..b17f2ed970e2 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -439,8 +439,7 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch,
         struct netem_skb_cb *cb;
         struct sk_buff *skb2;
         struct sk_buff *segs = NULL;
-        unsigned int len = 0, last_len, prev_len = qdisc_pkt_len(skb);
-        int nb = 0;
+        unsigned int prev_len = qdisc_pkt_len(skb);
         int count = 1;
         int rc = NET_XMIT_SUCCESS;
         int rc_drop = NET_XMIT_DROP;
@@ -494,16 +493,14 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch,
          */
         if (q->corrupt && q->corrupt >= get_crandom(&q->corrupt_cor)) {
                 if (skb_is_gso(skb)) {
-                        segs = netem_segment(skb, sch, to_free);
-                        if (!segs)
+                        skb = netem_segment(skb, sch, to_free);
+                        if (!skb)
                                 return rc_drop;
-                } else {
-                        segs = skb;
+                        segs = skb->next;
+                        skb_mark_not_on_list(skb);
+                        qdisc_skb_cb(skb)->pkt_len = skb->len;
                 }
 
-                skb = segs;
-                segs = segs->next;
-
                 skb = skb_unshare(skb, GFP_ATOMIC);
                 if (unlikely(!skb)) {
                         qdisc_qstats_drop(sch);
@@ -520,6 +517,8 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch,
         }
 
         if (unlikely(sch->q.qlen >= sch->limit)) {
+                /* re-link segs, so that qdisc_drop_all() frees them all */
+                skb->next = segs;
                 qdisc_drop_all(skb, sch, to_free);
                 return rc_drop;
         }
@@ -593,6 +592,11 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch,
 
 finish_segs:
         if (segs) {
+                unsigned int len, last_len;
+                int nb = 0;
+
+                len = skb->len;
+
                 while (segs) {
                         skb2 = segs->next;
                         skb_mark_not_on_list(segs);
@@ -608,9 +612,7 @@ finish_segs:
                         }
                         segs = skb2;
                 }
-                sch->q.qlen += nb;
-                if (nb > 1)
-                        qdisc_tree_reduce_backlog(sch, 1 - nb, prev_len - len);
+                qdisc_tree_reduce_backlog(sch, -nb, prev_len - len);
         }
         return NET_XMIT_SUCCESS;
 }