1 files changed, 5 insertions, 4 deletions

diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c
index cb9711ea8c6c..d8e03c74ca76 100644
--- a/net/sched/sch_tbf.c
+++ b/net/sched/sch_tbf.c
@@ -177,9 +177,9 @@ static int tbf_requeue(struct sk_buff *skb, struct Qdisc* sch)
 static unsigned int tbf_drop(struct Qdisc* sch)
 {
         struct tbf_sched_data *q = qdisc_priv(sch);
-        unsigned int len;
+        unsigned int len = 0;
 
-        if ((len = q->qdisc->ops->drop(q->qdisc)) != 0) {
+        if (q->qdisc->ops->drop && (len = q->qdisc->ops->drop(q->qdisc)) != 0) {
                 sch->q.qlen--;
                 sch->qstats.drops++;
         }
@@ -341,13 +341,14 @@ static int tbf_change(struct Qdisc* sch, struct rtattr *opt)
         if (max_size < 0)
                 goto done;
 
-        if (q->qdisc == &noop_qdisc) {
+        if (qopt->limit > 0) {
                 if ((child = tbf_create_dflt_qdisc(sch->dev, qopt->limit)) == NULL)
                         goto done;
         }
 
         sch_tree_lock(sch);
-        if (child) q->qdisc = child;
+        if (child)
+                qdisc_destroy(xchg(&q->qdisc, child));
         q->limit = qopt->limit;
         q->mtu = qopt->mtu;
         q->max_size = max_size;