[NET_SCHED]: sch_htb: perform qlen adjustment immediately in ->delete

qlen adjustment should happen immediately in ->delete and not in the
class destroy function because the reference count will not hit zero in
->delete (sch_api holds a reference) but in ->put. Since the qdisc
lock is released between deletion of the class and final destruction
this creates an externally visible error in the qlen counter.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 6 insertions, 1 deletions

diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 4b52fa78935a..08fa4d083615 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -1269,9 +1269,9 @@ static void htb_destroy_filters(struct tcf_proto **fl)
 static void htb_destroy_class(struct Qdisc *sch, struct htb_class *cl)
 {
         struct htb_sched *q = qdisc_priv(sch);
+
         if (!cl->level) {
                 BUG_TRAP(cl->un.leaf.q);
-                sch->q.qlen -= cl->un.leaf.q->q.qlen;
                 qdisc_destroy(cl->un.leaf.q);
         }
         qdisc_put_rtab(cl->rate);
@@ -1334,6 +1334,11 @@ static int htb_delete(struct Qdisc *sch, unsigned long arg)
         /* delete from hash and active; remainder in destroy_class */
         hlist_del_init(&cl->hlist);
 
+        if (!cl->level) {
+                sch->q.qlen -= cl->un.leaf.q->q.qlen;
+                qdisc_reset(cl->un.leaf.q);
+        }
+
         if (cl->prio_activity)
                 htb_deactivate(q, cl);