18 files changed, 49 insertions, 80 deletions

diff --git a/net/sched/act_api.c b/net/sched/act_api.c
index 5b9397b33238..a2587b52e531 100644
--- a/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -250,15 +250,17 @@ tcf_action_dump(struct sk_buff *skb, struct tc_action *act, int bind, int ref)
                 RTA_PUT(skb, a->order, 0, NULL);
                 err = tcf_action_dump_1(skb, a, bind, ref);
                 if (err < 0)
-                        goto rtattr_failure;
+                        goto errout;
                 r->rta_len = skb->tail - (u8*)r;
         }
 
         return 0;
 
 rtattr_failure:
+        err = -EINVAL;
+errout:
         skb_trim(skb, b - skb->data);
-        return -err;
+        return err;
 }
 
 struct tc_action *tcf_action_init_1(struct rtattr *rta, struct rtattr *est,
@@ -305,14 +307,14 @@ struct tc_action *tcf_action_init_1(struct rtattr *rta, struct rtattr *est,
                         goto err_mod;
                 }
 #endif
+                *err = -ENOENT;
                 goto err_out;
         }
 
         *err = -ENOMEM;
-        a = kmalloc(sizeof(*a), GFP_KERNEL);
+        a = kzalloc(sizeof(*a), GFP_KERNEL);
         if (a == NULL)
                 goto err_mod;
-        memset(a, 0, sizeof(*a));
 
         /* backward compatibility for policer */
         if (name == NULL)
@@ -489,10 +491,9 @@ tcf_action_get_1(struct rtattr *rta, struct nlmsghdr *n, u32 pid, int *err)
         index = *(int *)RTA_DATA(tb[TCA_ACT_INDEX - 1]);
 
         *err = -ENOMEM;
-        a = kmalloc(sizeof(struct tc_action), GFP_KERNEL);
+        a = kzalloc(sizeof(struct tc_action), GFP_KERNEL);
         if (a == NULL)
                 return NULL;
-        memset(a, 0, sizeof(struct tc_action));
 
         *err = -EINVAL;
         a->ops = tc_lookup_action(tb[TCA_ACT_KIND - 1]);
@@ -528,12 +529,11 @@ static struct tc_action *create_a(int i)
 {
         struct tc_action *act;
 
-        act = kmalloc(sizeof(*act), GFP_KERNEL);
+        act = kzalloc(sizeof(*act), GFP_KERNEL);
         if (act == NULL) {
                 printk("create_a: failed to alloc!\n");
                 return NULL;
         }
-        memset(act, 0, sizeof(*act));
         act->order = i;
         return act;
 }
@@ -599,8 +599,8 @@ static int tca_action_flush(struct rtattr *rta, struct nlmsghdr *n, u32 pid)
         return err;
 
 rtattr_failure:
-        module_put(a->ops->owner);
 nlmsg_failure:
+        module_put(a->ops->owner);
 err_out:
         kfree_skb(skb);
         kfree(a);
@@ -776,7 +776,7 @@ replay:
         return ret;
 }
 
-static char *
+static struct rtattr *
 find_dump_kind(struct nlmsghdr *n)
 {
         struct rtattr *tb1, *tb2[TCA_ACT_MAX+1];
@@ -804,7 +804,7 @@ find_dump_kind(struct nlmsghdr *n)
                 return NULL;
         kind = tb2[TCA_ACT_KIND-1];
 
-        return (char *) RTA_DATA(kind);
+        return kind;
 }
 
 static int
@@ -817,16 +817,15 @@ tc_dump_action(struct sk_buff *skb, struct netlink_callback *cb)
         struct tc_action a;
         int ret = 0;
         struct tcamsg *t = (struct tcamsg *) NLMSG_DATA(cb->nlh);
-        char *kind = find_dump_kind(cb->nlh);
+        struct rtattr *kind = find_dump_kind(cb->nlh);
 
         if (kind == NULL) {
                 printk("tc_dump_action: action bad kind\n");
                 return 0;
         }
 
-        a_o = tc_lookup_action_n(kind);
+        a_o = tc_lookup_action(kind);
         if (a_o == NULL) {
-                printk("failed to find %s\n", kind);
                 return 0;
         }
 
@@ -834,7 +833,7 @@ tc_dump_action(struct sk_buff *skb, struct netlink_callback *cb)
         a.ops = a_o;
 
         if (a_o->walk == NULL) {
-                printk("tc_dump_action: %s !capable of dumping table\n", kind);
+                printk("tc_dump_action: %s !capable of dumping table\n", a_o->kind);
                 goto rtattr_failure;
         }
 
@@ -882,8 +881,6 @@ static int __init tc_action_init(void)
                 link_p[RTM_GETACTION-RTM_BASE].dumpit = tc_dump_action;
         }
 
-        printk("TC classifier action (bugs to netdev@vger.kernel.org cc "
-               "hadi@cyberus.ca)\n");
         return 0;
 }
 
diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
index 58b3a8652042..f257475e0e0c 100644
--- a/net/sched/act_pedit.c
+++ b/net/sched/act_pedit.c
@@ -209,10 +209,9 @@ tcf_pedit_dump(struct sk_buff *skb, struct tc_action *a,int bind, int ref)
         s = sizeof(*opt) + p->nkeys * sizeof(struct tc_pedit_key);
 
         /* netlink spinlocks held above us - must use ATOMIC */
-        opt = kmalloc(s, GFP_ATOMIC);
+        opt = kzalloc(s, GFP_ATOMIC);
         if (opt == NULL)
                 return -ENOBUFS;
-        memset(opt, 0, s);
 
         memcpy(opt->keys, p->keys, p->nkeys * sizeof(struct tc_pedit_key));
         opt->index = p->index;
diff --git a/net/sched/act_police.c b/net/sched/act_police.c
index 47e00bd9625e..da905d7b4b40 100644
--- a/net/sched/act_police.c
+++ b/net/sched/act_police.c
@@ -196,10 +196,9 @@ static int tcf_act_police_locate(struct rtattr *rta, struct rtattr *est,
                 return ret;
         }
 
-        p = kmalloc(sizeof(*p), GFP_KERNEL);
+        p = kzalloc(sizeof(*p), GFP_KERNEL);
         if (p == NULL)
                 return -ENOMEM;
-        memset(p, 0, sizeof(*p));
 
         ret = ACT_P_CREATED;
         p->refcnt = 1;
@@ -429,11 +428,10 @@ struct tcf_police * tcf_police_locate(struct rtattr *rta, struct rtattr *est)
                 return p;
         }
 
-        p = kmalloc(sizeof(*p), GFP_KERNEL);
+        p = kzalloc(sizeof(*p), GFP_KERNEL);
         if (p == NULL)
                 return NULL;
 
-        memset(p, 0, sizeof(*p));
         p->refcnt = 1;
         spin_lock_init(&p->lock);
         p->stats_lock = &p->lock;
diff --git a/net/sched/cls_basic.c b/net/sched/cls_basic.c
index 61507f006b11..86cac49a0531 100644
--- a/net/sched/cls_basic.c
+++ b/net/sched/cls_basic.c
@@ -178,19 +178,17 @@ static int basic_change(struct tcf_proto *tp, unsigned long base, u32 handle,
 
         err = -ENOBUFS;
         if (head == NULL) {
-                head = kmalloc(sizeof(*head), GFP_KERNEL);
+                head = kzalloc(sizeof(*head), GFP_KERNEL);
                 if (head == NULL)
                         goto errout;
 
-                memset(head, 0, sizeof(*head));
                 INIT_LIST_HEAD(&head->flist);
                 tp->root = head;
         }
 
-        f = kmalloc(sizeof(*f), GFP_KERNEL);
+        f = kzalloc(sizeof(*f), GFP_KERNEL);
         if (f == NULL)
                 goto errout;
-        memset(f, 0, sizeof(*f));
 
         err = -EINVAL;
         if (handle)
diff --git a/net/sched/cls_fw.c b/net/sched/cls_fw.c
index d41de91fc4f6..e6973d9b686d 100644
--- a/net/sched/cls_fw.c
+++ b/net/sched/cls_fw.c
@@ -267,20 +267,18 @@ static int fw_change(struct tcf_proto *tp, unsigned long base,
                 return -EINVAL;
 
         if (head == NULL) {
-                head = kmalloc(sizeof(struct fw_head), GFP_KERNEL);
+                head = kzalloc(sizeof(struct fw_head), GFP_KERNEL);
                 if (head == NULL)
                         return -ENOBUFS;
-                memset(head, 0, sizeof(*head));
 
                 tcf_tree_lock(tp);
                 tp->root = head;
                 tcf_tree_unlock(tp);
         }
 
-        f = kmalloc(sizeof(struct fw_filter), GFP_KERNEL);
+        f = kzalloc(sizeof(struct fw_filter), GFP_KERNEL);
         if (f == NULL)
                 return -ENOBUFS;
-        memset(f, 0, sizeof(*f));
 
         f->id = handle;
 
diff --git a/net/sched/cls_route.c b/net/sched/cls_route.c
index c2e71900f7bd..d3aea730d4c8 100644
--- a/net/sched/cls_route.c
+++ b/net/sched/cls_route.c
@@ -396,10 +396,9 @@ static int route4_set_parms(struct tcf_proto *tp, unsigned long base,
         h1 = to_hash(nhandle);
         if ((b = head->table[h1]) == NULL) {
                 err = -ENOBUFS;
-                b = kmalloc(sizeof(struct route4_bucket), GFP_KERNEL);
+                b = kzalloc(sizeof(struct route4_bucket), GFP_KERNEL);
                 if (b == NULL)
                         goto errout;
-                memset(b, 0, sizeof(*b));
 
                 tcf_tree_lock(tp);
                 head->table[h1] = b;
@@ -475,20 +474,18 @@ static int route4_change(struct tcf_proto *tp, unsigned long base,
 
         err = -ENOBUFS;
         if (head == NULL) {
-                head = kmalloc(sizeof(struct route4_head), GFP_KERNEL);
+                head = kzalloc(sizeof(struct route4_head), GFP_KERNEL);
                 if (head == NULL)
                         goto errout;
-                memset(head, 0, sizeof(struct route4_head));
 
                 tcf_tree_lock(tp);
                 tp->root = head;
                 tcf_tree_unlock(tp);
         }
 
-        f = kmalloc(sizeof(struct route4_filter), GFP_KERNEL);
+        f = kzalloc(sizeof(struct route4_filter), GFP_KERNEL);
         if (f == NULL)
                 goto errout;
-        memset(f, 0, sizeof(*f));
 
         err = route4_set_parms(tp, base, f, handle, head, tb,
                 tca[TCA_RATE-1], 1);
diff --git a/net/sched/cls_rsvp.h b/net/sched/cls_rsvp.h
index ba8741971629..6e230ecfba05 100644
--- a/net/sched/cls_rsvp.h
+++ b/net/sched/cls_rsvp.h
@@ -240,9 +240,8 @@ static int rsvp_init(struct tcf_proto *tp)
 {
         struct rsvp_head *data;
 
-        data = kmalloc(sizeof(struct rsvp_head), GFP_KERNEL);
+        data = kzalloc(sizeof(struct rsvp_head), GFP_KERNEL);
         if (data) {
-                memset(data, 0, sizeof(struct rsvp_head));
                 tp->root = data;
                 return 0;
         }
@@ -446,11 +445,10 @@ static int rsvp_change(struct tcf_proto *tp, unsigned long base,
                 goto errout2;
 
         err = -ENOBUFS;
-        f = kmalloc(sizeof(struct rsvp_filter), GFP_KERNEL);
+        f = kzalloc(sizeof(struct rsvp_filter), GFP_KERNEL);
         if (f == NULL)
                 goto errout2;
 
-        memset(f, 0, sizeof(*f));
         h2 = 16;
         if (tb[TCA_RSVP_SRC-1]) {
                 err = -EINVAL;
@@ -532,10 +530,9 @@ insert:
         /* No session found. Create new one. */
 
         err = -ENOBUFS;
-        s = kmalloc(sizeof(struct rsvp_session), GFP_KERNEL);
+        s = kzalloc(sizeof(struct rsvp_session), GFP_KERNEL);
         if (s == NULL)
                 goto errout;
-        memset(s, 0, sizeof(*s));
         memcpy(s->dst, dst, sizeof(s->dst));
 
         if (pinfo) {
diff --git a/net/sched/cls_tcindex.c b/net/sched/cls_tcindex.c
index 7870e7bb0bac..5af8a59e1503 100644
--- a/net/sched/cls_tcindex.c
+++ b/net/sched/cls_tcindex.c
@@ -148,11 +148,10 @@ static int tcindex_init(struct tcf_proto *tp)
         struct tcindex_data *p;
 
         DPRINTK("tcindex_init(tp %p)\n",tp);
-        p = kmalloc(sizeof(struct tcindex_data),GFP_KERNEL);
+        p = kzalloc(sizeof(struct tcindex_data),GFP_KERNEL);
         if (!p)
                 return -ENOMEM;
 
-        memset(p, 0, sizeof(*p));
         p->mask = 0xffff;
         p->hash = DEFAULT_HASH_SIZE;
         p->fall_through = 1;
@@ -296,16 +295,14 @@ tcindex_set_parms(struct tcf_proto *tp, unsigned long base, u32 handle,
         err = -ENOMEM;
         if (!cp.perfect && !cp.h) {
                 if (valid_perfect_hash(&cp)) {
-                        cp.perfect = kmalloc(cp.hash * sizeof(*r), GFP_KERNEL);
+                        cp.perfect = kcalloc(cp.hash, sizeof(*r), GFP_KERNEL);
                         if (!cp.perfect)
                                 goto errout;
-                        memset(cp.perfect, 0, cp.hash * sizeof(*r));
                         balloc = 1;
                 } else {
-                        cp.h = kmalloc(cp.hash * sizeof(f), GFP_KERNEL);
+                        cp.h = kcalloc(cp.hash, sizeof(f), GFP_KERNEL);
                         if (!cp.h)
                                 goto errout;
-                        memset(cp.h, 0, cp.hash * sizeof(f));
                         balloc = 2;
                 }
         }
@@ -316,10 +313,9 @@ tcindex_set_parms(struct tcf_proto *tp, unsigned long base, u32 handle,
                 r = tcindex_lookup(&cp, handle) ? : &new_filter_result;
 
         if (r == &new_filter_result) {
-                f = kmalloc(sizeof(*f), GFP_KERNEL);
+                f = kzalloc(sizeof(*f), GFP_KERNEL);
                 if (!f)
                         goto errout_alloc;
-                memset(f, 0, sizeof(*f));
         }
 
         if (tb[TCA_TCINDEX_CLASSID-1]) {
diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
index d712edcd1bcf..eea366966740 100644
--- a/net/sched/cls_u32.c
+++ b/net/sched/cls_u32.c
@@ -307,23 +307,21 @@ static int u32_init(struct tcf_proto *tp)
                 if (tp_c->q == tp->q)
                         break;
 
-        root_ht = kmalloc(sizeof(*root_ht), GFP_KERNEL);
+        root_ht = kzalloc(sizeof(*root_ht), GFP_KERNEL);
         if (root_ht == NULL)
                 return -ENOBUFS;
 
-        memset(root_ht, 0, sizeof(*root_ht));
         root_ht->divisor = 0;
         root_ht->refcnt++;
         root_ht->handle = tp_c ? gen_new_htid(tp_c) : 0x80000000;
         root_ht->prio = tp->prio;
 
         if (tp_c == NULL) {
-                tp_c = kmalloc(sizeof(*tp_c), GFP_KERNEL);
+                tp_c = kzalloc(sizeof(*tp_c), GFP_KERNEL);
                 if (tp_c == NULL) {
                         kfree(root_ht);
                         return -ENOBUFS;
                 }
-                memset(tp_c, 0, sizeof(*tp_c));
                 tp_c->q = tp->q;
                 tp_c->next = u32_list;
                 u32_list = tp_c;
@@ -571,10 +569,9 @@ static int u32_change(struct tcf_proto *tp, unsigned long base, u32 handle,
                         if (handle == 0)
                                 return -ENOMEM;
                 }
-                ht = kmalloc(sizeof(*ht) + divisor*sizeof(void*), GFP_KERNEL);
+                ht = kzalloc(sizeof(*ht) + divisor*sizeof(void*), GFP_KERNEL);
                 if (ht == NULL)
                         return -ENOBUFS;
-                memset(ht, 0, sizeof(*ht) + divisor*sizeof(void*));
                 ht->tp_c = tp_c;
                 ht->refcnt = 0;
                 ht->divisor = divisor;
@@ -617,18 +614,16 @@ static int u32_change(struct tcf_proto *tp, unsigned long base, u32 handle,
 
         s = RTA_DATA(tb[TCA_U32_SEL-1]);
 
-        n = kmalloc(sizeof(*n) + s->nkeys*sizeof(struct tc_u32_key), GFP_KERNEL);
+        n = kzalloc(sizeof(*n) + s->nkeys*sizeof(struct tc_u32_key), GFP_KERNEL);
         if (n == NULL)
                 return -ENOBUFS;
 
-        memset(n, 0, sizeof(*n) + s->nkeys*sizeof(struct tc_u32_key));
 #ifdef CONFIG_CLS_U32_PERF
-        n->pf = kmalloc(sizeof(struct tc_u32_pcnt) + s->nkeys*sizeof(u64), GFP_KERNEL);
+        n->pf = kzalloc(sizeof(struct tc_u32_pcnt) + s->nkeys*sizeof(u64), GFP_KERNEL);
         if (n->pf == NULL) {
                 kfree(n);
                 return -ENOBUFS;
         }
-        memset(n->pf, 0, sizeof(struct tc_u32_pcnt) + s->nkeys*sizeof(u64));
 #endif
 
         memcpy(&n->sel, s, sizeof(*s) + s->nkeys*sizeof(struct tc_u32_key));
diff --git a/net/sched/em_meta.c b/net/sched/em_meta.c
index 698372954f4d..61e3b740ab1a 100644
--- a/net/sched/em_meta.c
+++ b/net/sched/em_meta.c
@@ -773,10 +773,9 @@ static int em_meta_change(struct tcf_proto *tp, void *data, int len,
             TCF_META_ID(hdr->right.kind) > TCF_META_ID_MAX)
                 goto errout;
 
-        meta = kmalloc(sizeof(*meta), GFP_KERNEL);
+        meta = kzalloc(sizeof(*meta), GFP_KERNEL);
         if (meta == NULL)
                 goto errout;
-        memset(meta, 0, sizeof(*meta));
 
         memcpy(&meta->lvalue.hdr, &hdr->left, sizeof(hdr->left));
         memcpy(&meta->rvalue.hdr, &hdr->right, sizeof(hdr->right));
diff --git a/net/sched/ematch.c b/net/sched/ematch.c
index 2405a86093a2..0fd0768a17c6 100644
--- a/net/sched/ematch.c
+++ b/net/sched/ematch.c
@@ -321,10 +321,9 @@ int tcf_em_tree_validate(struct tcf_proto *tp, struct rtattr *rta,
         list_len = RTA_PAYLOAD(rt_list);
         matches_len = tree_hdr->nmatches * sizeof(*em);
 
-        tree->matches = kmalloc(matches_len, GFP_KERNEL);
+        tree->matches = kzalloc(matches_len, GFP_KERNEL);
         if (tree->matches == NULL)
                 goto errout;
-        memset(tree->matches, 0, matches_len);
 
         /* We do not use rtattr_parse_nested here because the maximum
          * number of attributes is unknown. This saves us the allocation
diff --git a/net/sched/estimator.c b/net/sched/estimator.c
index 5d3ae03e22a7..0ebc98e9be2d 100644
--- a/net/sched/estimator.c
+++ b/net/sched/estimator.c
@@ -139,11 +139,10 @@ int qdisc_new_estimator(struct tc_stats *stats, spinlock_t *stats_lock, struct r
         if (parm->interval < -2 || parm->interval > 3)
                 return -EINVAL;
 
-        est = kmalloc(sizeof(*est), GFP_KERNEL);
+        est = kzalloc(sizeof(*est), GFP_KERNEL);
         if (est == NULL)
                 return -ENOBUFS;
 
-        memset(est, 0, sizeof(*est));
         est->interval = parm->interval + 2;
         est->stats = stats;
         est->stats_lock = stats_lock;
diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
index 80b7f6a8d008..bac881bfe362 100644
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -1926,10 +1926,9 @@ cbq_change_class(struct Qdisc *sch, u32 classid, u32 parentid, struct rtattr **t
         }
 
         err = -ENOBUFS;
-        cl = kmalloc(sizeof(*cl), GFP_KERNEL);
+        cl = kzalloc(sizeof(*cl), GFP_KERNEL);
         if (cl == NULL)
                 goto failure;
-        memset(cl, 0, sizeof(*cl));
         cl->R_tab = rtab;
         rtab = NULL;
         cl->refcnt = 1;
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index d735f51686a1..0834c2ee9174 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -432,10 +432,9 @@ struct Qdisc *qdisc_alloc(struct net_device *dev, struct Qdisc_ops *ops)
         size = QDISC_ALIGN(sizeof(*sch));
         size += ops->priv_size + (QDISC_ALIGNTO - 1);
 
-        p = kmalloc(size, GFP_KERNEL);
+        p = kzalloc(size, GFP_KERNEL);
         if (!p)
                 goto errout;
-        memset(p, 0, size);
         sch = (struct Qdisc *) QDISC_ALIGN((unsigned long) p);
         sch->padded = (char *) sch - (char *) p;
 
diff --git a/net/sched/sch_gred.c b/net/sched/sch_gred.c
index 0cafdd5feb1b..18e81a8ffb01 100644
--- a/net/sched/sch_gred.c
+++ b/net/sched/sch_gred.c
@@ -406,10 +406,9 @@ static inline int gred_change_vq(struct Qdisc *sch, int dp,
         struct gred_sched_data *q;
 
         if (table->tab[dp] == NULL) {
-                table->tab[dp] = kmalloc(sizeof(*q), GFP_KERNEL);
+                table->tab[dp] = kzalloc(sizeof(*q), GFP_KERNEL);
                 if (table->tab[dp] == NULL)
                         return -ENOMEM;
-                memset(table->tab[dp], 0, sizeof(*q));
         }
 
         q = table->tab[dp];
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index 6b1b4a981e88..6a6735a2ed35 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -1123,10 +1123,9 @@ hfsc_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
         if (rsc == NULL && fsc == NULL)
                 return -EINVAL;
 
-        cl = kmalloc(sizeof(struct hfsc_class), GFP_KERNEL);
+        cl = kzalloc(sizeof(struct hfsc_class), GFP_KERNEL);
         if (cl == NULL)
                 return -ENOBUFS;
-        memset(cl, 0, sizeof(struct hfsc_class));
 
         if (rsc != NULL)
                 hfsc_change_rsc(cl, rsc, 0);
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 34afe41fa2f3..880a3394a51f 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -196,7 +196,7 @@ struct htb_class
     struct qdisc_rate_table *rate;      /* rate table of the class itself */
     struct qdisc_rate_table *ceil;      /* ceiling rate (limits borrows too) */
     long buffer,cbuffer;                /* token bucket depth/rate */
-    long mbuffer;                       /* max wait time */
+    psched_tdiff_t mbuffer;             /* max wait time */
     long tokens,ctokens;                /* current number of tokens */
     psched_time_t t_c;                  /* checkpoint time */
 };
@@ -1559,10 +1559,9 @@ static int htb_change_class(struct Qdisc *sch, u32 classid,
                         goto failure;
                 }
                 err = -ENOBUFS;
-                if ((cl = kmalloc(sizeof(*cl), GFP_KERNEL)) == NULL)
+                if ((cl = kzalloc(sizeof(*cl), GFP_KERNEL)) == NULL)
                         goto failure;
                 
-                memset(cl, 0, sizeof(*cl));
                 cl->refcnt = 1;
                 INIT_LIST_HEAD(&cl->sibling);
                 INIT_LIST_HEAD(&cl->hlist);
@@ -1601,7 +1600,7 @@ static int htb_change_class(struct Qdisc *sch, u32 classid,
                 /* set class to be in HTB_CAN_SEND state */
                 cl->tokens = hopt->buffer;
                 cl->ctokens = hopt->cbuffer;
-                cl->mbuffer = 60000000; /* 1min */
+                cl->mbuffer = PSCHED_JIFFIE2US(HZ*60); /* 1min */
                 PSCHED_GET_TIME(cl->t_c);
                 cl->cmode = HTB_CAN_SEND;
 
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index c5bd8064e6d8..a08ec4c7c55d 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -148,7 +148,8 @@ static long tabledist(unsigned long mu, long sigma,
 static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch)
 {
         struct netem_sched_data *q = qdisc_priv(sch);
-        struct netem_skb_cb *cb = (struct netem_skb_cb *)skb->cb;
+        /* We don't fill cb now as skb_unshare() may invalidate it */
+        struct netem_skb_cb *cb;
         struct sk_buff *skb2;
         int ret;
         int count = 1;
@@ -200,6 +201,7 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                 skb->data[net_random() % skb_headlen(skb)] ^= 1<<(net_random() % 8);
         }
 
+        cb = (struct netem_skb_cb *)skb->cb;
         if (q->gap == 0                 /* not doing reordering */
             || q->counter < q->gap      /* inside last reordering gap */
             || q->reorder < get_crandom(&q->reorder_cor)) {