1 files changed, 6 insertions, 5 deletions

diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
index 246f9065ce34..05d178008cbc 100644
--- a/net/sched/cls_u32.c
+++ b/net/sched/cls_u32.c
@@ -387,7 +387,7 @@ static int u32_destroy_hnode(struct tcf_proto *tp, struct tc_u_hnode *ht)
 static void u32_destroy(struct tcf_proto *tp)
 {
         struct tc_u_common *tp_c = tp->data;
-        struct tc_u_hnode *root_ht = xchg(&tp->root, NULL);
+        struct tc_u_hnode *root_ht = tp->root;
 
         WARN_ON(root_ht == NULL);
 
@@ -479,7 +479,7 @@ static int u32_set_parms(struct tcf_proto *tp, unsigned long base,
         err = -EINVAL;
         if (tb[TCA_U32_LINK]) {
                 u32 handle = nla_get_u32(tb[TCA_U32_LINK]);
-                struct tc_u_hnode *ht_down = NULL;
+                struct tc_u_hnode *ht_down = NULL, *ht_old;
 
                 if (TC_U32_KEY(handle))
                         goto errout;
@@ -493,11 +493,12 @@ static int u32_set_parms(struct tcf_proto *tp, unsigned long base,
                 }
 
                 tcf_tree_lock(tp);
-                ht_down = xchg(&n->ht_down, ht_down);
+                ht_old = n->ht_down;
+                n->ht_down = ht_down;
                 tcf_tree_unlock(tp);
 
-                if (ht_down)
-                        ht_down->refcnt--;
+                if (ht_old)
+                        ht_old->refcnt--;
         }
         if (tb[TCA_U32_CLASSID]) {
                 n->res.classid = nla_get_u32(tb[TCA_U32_CLASSID]);