[NET_SCHED]: Fix endless loops (part 5): netem/tbf/hfsc ->requeue failures

When peeking at the next packet in a child qdisc by calling dequeue/requeue,
the upper qdisc qlen counter may get out of sync in case the requeue fails.
The qdisc and the child qdisc both have their counter decremented, but since
no packet is given to the upper qdisc it won't decrement its counter itself.

requeue should not fail, so this is mostly for "correctness".

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

3 files changed, 3 insertions, 5 deletions

diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index 2d437447e085..6eefa6995777 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -946,6 +946,7 @@ qdisc_peek_len(struct Qdisc *sch)
         if (unlikely(sch->ops->requeue(skb, sch) != NET_XMIT_SUCCESS)) {
                 if (net_ratelimit())
                         printk("qdisc_peek_len: failed to requeue\n");
+                qdisc_tree_decrease_qlen(sch, 1);
                 return 0;
         }
         return len;
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index 672c35445793..79542af9dab1 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -287,13 +287,10 @@ static struct sk_buff *netem_dequeue(struct Qdisc *sch)
                         psched_tdiff_t delay = PSCHED_TDIFF(cb->time_to_send, now);
 
                         if (q->qdisc->ops->requeue(skb, q->qdisc) != NET_XMIT_SUCCESS) {
+                                qdisc_tree_decrease_qlen(q->qdisc, 1);
                                 sch->qstats.drops++;
-
-                                /* After this qlen is confused */
                                 printk(KERN_ERR "netem: queue discpline %s could not requeue\n",
                                        q->qdisc->ops->id);
-
-                                sch->q.qlen--;
                         }
 
                         mod_timer(&q->timer, jiffies + PSCHED_US2JIFFIE(delay));
diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c
index 23b7624354f5..ed9b6d938540 100644
--- a/net/sched/sch_tbf.c
+++ b/net/sched/sch_tbf.c
@@ -250,7 +250,7 @@ static struct sk_buff *tbf_dequeue(struct Qdisc* sch)
 
                 if (q->qdisc->ops->requeue(skb, q->qdisc) != NET_XMIT_SUCCESS) {
                         /* When requeue fails skb is dropped */
-                        sch->q.qlen--;
+                        qdisc_tree_decrease_qlen(q->qdisc, 1);
                         sch->qstats.drops++;
                 }