2 files changed, 11 insertions, 4 deletions

diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index b6ef9a04de06..a75864d93142 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -81,6 +81,11 @@ int unregister_tcf_proto_ops(struct tcf_proto_ops *ops)
         struct tcf_proto_ops *t;
         int rc = -ENOENT;
 
+        /* Wait for outstanding call_rcu()s, if any, from a
+         * tcf_proto_ops's destroy() handler.
+         */
+        rcu_barrier();
+
         write_lock(&cls_mod_lock);
         list_for_each_entry(t, &tcf_proto_base, head) {
                 if (t == ops) {
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index ad9eed70bc8f..1e1c89e51a11 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -815,10 +815,8 @@ static int qdisc_graft(struct net_device *dev, struct Qdisc *parent,
                 if (dev->flags & IFF_UP)
                         dev_deactivate(dev);
 
-                if (new && new->ops->attach) {
-                        new->ops->attach(new);
-                        num_q = 0;
-                }
+                if (new && new->ops->attach)
+                        goto skip;
 
                 for (i = 0; i < num_q; i++) {
                         struct netdev_queue *dev_queue = dev_ingress_queue(dev);
@@ -834,12 +832,16 @@ static int qdisc_graft(struct net_device *dev, struct Qdisc *parent,
                                 qdisc_destroy(old);
                 }
 
+skip:
                 if (!ingress) {
                         notify_and_destroy(net, skb, n, classid,
                                            dev->qdisc, new);
                         if (new && !new->ops->attach)
                                 atomic_inc(&new->refcnt);
                         dev->qdisc = new ? : &noop_qdisc;
+
+                        if (new && new->ops->attach)
+                                new->ops->attach(new);
                 } else {
                         notify_and_destroy(net, skb, n, classid, old, new);
                 }