3 files changed, 23 insertions, 14 deletions

diff --git a/net/sched/sch_gred.c b/net/sched/sch_gred.c
index b9493a09a870..6cd8ddfb512d 100644
--- a/net/sched/sch_gred.c
+++ b/net/sched/sch_gred.c
@@ -385,7 +385,7 @@ static inline int gred_change_vq(struct Qdisc *sch, int dp,
         struct gred_sched_data *q;
 
         if (table->tab[dp] == NULL) {
-                table->tab[dp] = kzalloc(sizeof(*q), GFP_KERNEL);
+                table->tab[dp] = kzalloc(sizeof(*q), GFP_ATOMIC);
                 if (table->tab[dp] == NULL)
                         return -ENOMEM;
         }
diff --git a/net/sched/sch_red.c b/net/sched/sch_red.c
index 6649463da1b6..d617161f8dd3 100644
--- a/net/sched/sch_red.c
+++ b/net/sched/sch_red.c
@@ -209,8 +209,8 @@ static int red_change(struct Qdisc *sch, struct nlattr *opt)
                                  ctl->Plog, ctl->Scell_log,
                                  nla_data(tb[TCA_RED_STAB]));
 
-        if (skb_queue_empty(&sch->q))
-                red_end_of_idle_period(&q->parms);
+        if (!q->qdisc->q.qlen)
+                red_start_of_idle_period(&q->parms);
 
         sch_tree_unlock(sch);
         return 0;
diff --git a/net/sched/sch_teql.c b/net/sched/sch_teql.c
index a3b7120fcc74..4f4c52c0eeb3 100644
--- a/net/sched/sch_teql.c
+++ b/net/sched/sch_teql.c
@@ -225,11 +225,11 @@ static int teql_qdisc_init(struct Qdisc *sch, struct nlattr *opt)
 
 
 static int
-__teql_resolve(struct sk_buff *skb, struct sk_buff *skb_res, struct net_device *dev)
+__teql_resolve(struct sk_buff *skb, struct sk_buff *skb_res,
+               struct net_device *dev, struct netdev_queue *txq,
+               struct neighbour *mn)
 {
-        struct netdev_queue *dev_queue = netdev_get_tx_queue(dev, 0);
-        struct teql_sched_data *q = qdisc_priv(dev_queue->qdisc);
-        struct neighbour *mn = dst_get_neighbour(skb_dst(skb));
+        struct teql_sched_data *q = qdisc_priv(txq->qdisc);
         struct neighbour *n = q->ncache;
 
         if (mn->tbl == NULL)
@@ -262,17 +262,26 @@ __teql_resolve(struct sk_buff *skb, struct sk_buff *skb_res, struct net_device *
 }
 
 static inline int teql_resolve(struct sk_buff *skb,
-                               struct sk_buff *skb_res, struct net_device *dev)
+                               struct sk_buff *skb_res,
+                               struct net_device *dev,
+                               struct netdev_queue *txq)
 {
-        struct netdev_queue *txq = netdev_get_tx_queue(dev, 0);
+        struct dst_entry *dst = skb_dst(skb);
+        struct neighbour *mn;
+        int res;
+
         if (txq->qdisc == &noop_qdisc)
                 return -ENODEV;
 
-        if (dev->header_ops == NULL ||
-            skb_dst(skb) == NULL ||
-            dst_get_neighbour(skb_dst(skb)) == NULL)
+        if (!dev->header_ops || !dst)
                 return 0;
-        return __teql_resolve(skb, skb_res, dev);
+
+        rcu_read_lock();
+        mn = dst_get_neighbour(dst);
+        res = mn ? __teql_resolve(skb, skb_res, dev, txq, mn) : 0;
+        rcu_read_unlock();
+
+        return res;
 }
 
 static netdev_tx_t teql_master_xmit(struct sk_buff *skb, struct net_device *dev)
@@ -307,7 +316,7 @@ restart:
                         continue;
                 }
 
-                switch (teql_resolve(skb, skb_res, slave)) {
+                switch (teql_resolve(skb, skb_res, slave, slave_txq)) {
                 case 0:
                         if (__netif_tx_trylock(slave_txq)) {
                                 unsigned int length = qdisc_pkt_len(skb);