1 files changed, 24 insertions, 9 deletions

diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
index 3a9569a3396c..9e43ed949167 100644
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -1765,11 +1765,23 @@ cbq_change_class(struct Qdisc *sch, u32 classid, u32 parentid, struct nlattr **t
                 }
 
                 if (tb[TCA_CBQ_RATE]) {
-                        rtab = qdisc_get_rtab(nla_data(tb[TCA_CBQ_RATE]), tb[TCA_CBQ_RTAB]);
+                        rtab = qdisc_get_rtab(nla_data(tb[TCA_CBQ_RATE]),
+                                              tb[TCA_CBQ_RTAB]);
                         if (rtab == NULL)
                                 return -EINVAL;
                 }
 
+                if (tca[TCA_RATE]) {
+                        err = gen_replace_estimator(&cl->bstats, &cl->rate_est,
+                                                    qdisc_root_sleeping_lock(sch),
+                                                    tca[TCA_RATE]);
+                        if (err) {
+                                if (rtab)
+                                        qdisc_put_rtab(rtab);
+                                return err;
+                        }
+                }
+
                 /* Change class parameters */
                 sch_tree_lock(sch);
 
@@ -1805,10 +1817,6 @@ cbq_change_class(struct Qdisc *sch, u32 classid, u32 parentid, struct nlattr **t
 
                 sch_tree_unlock(sch);
 
-                if (tca[TCA_RATE])
-                        gen_replace_estimator(&cl->bstats, &cl->rate_est,
-                                              qdisc_root_sleeping_lock(sch),
-                                              tca[TCA_RATE]);
                 return 0;
         }
 
@@ -1855,6 +1863,17 @@ cbq_change_class(struct Qdisc *sch, u32 classid, u32 parentid, struct nlattr **t
         cl = kzalloc(sizeof(*cl), GFP_KERNEL);
         if (cl == NULL)
                 goto failure;
+
+        if (tca[TCA_RATE]) {
+                err = gen_new_estimator(&cl->bstats, &cl->rate_est,
+                                        qdisc_root_sleeping_lock(sch),
+                                        tca[TCA_RATE]);
+                if (err) {
+                        kfree(cl);
+                        goto failure;
+                }
+        }
+
         cl->R_tab = rtab;
         rtab = NULL;
         cl->refcnt = 1;
@@ -1896,10 +1915,6 @@ cbq_change_class(struct Qdisc *sch, u32 classid, u32 parentid, struct nlattr **t
 
         qdisc_class_hash_grow(sch, &q->clhash);
 
-        if (tca[TCA_RATE])
-                gen_new_estimator(&cl->bstats, &cl->rate_est,
-                                  qdisc_root_sleeping_lock(sch), tca[TCA_RATE]);
-
         *arg = (unsigned long)cl;
         return 0;