18 files changed, 67 insertions, 90 deletions

diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index bdbdb1a7920a..45527e6b52db 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -134,7 +134,8 @@ static int tc_ctl_tfilter(struct sk_buff *skb, struct nlmsghdr *n)
         int err;
         int tp_created = 0;
 
-        if ((n->nlmsg_type != RTM_GETTFILTER) && !netlink_capable(skb, CAP_NET_ADMIN))
+        if ((n->nlmsg_type != RTM_GETTFILTER) &&
+            !netlink_ns_capable(skb, net->user_ns, CAP_NET_ADMIN))
                 return -EPERM;
 
 replay:
@@ -317,7 +318,8 @@ replay:
                 }
         }
 
-        err = tp->ops->change(net, skb, tp, cl, t->tcm_handle, tca, &fh);
+        err = tp->ops->change(net, skb, tp, cl, t->tcm_handle, tca, &fh,
+                              n->nlmsg_flags & NLM_F_CREATE ? TCA_ACT_NOREPLACE : TCA_ACT_REPLACE);
         if (err == 0) {
                 if (tp_created) {
                         spin_lock_bh(root_lock);
@@ -504,7 +506,7 @@ void tcf_exts_destroy(struct tcf_proto *tp, struct tcf_exts *exts)
 EXPORT_SYMBOL(tcf_exts_destroy);
 
 int tcf_exts_validate(struct net *net, struct tcf_proto *tp, struct nlattr **tb,
-                  struct nlattr *rate_tlv, struct tcf_exts *exts)
+                  struct nlattr *rate_tlv, struct tcf_exts *exts, bool ovr)
 {
 #ifdef CONFIG_NET_CLS_ACT
         {
@@ -513,7 +515,7 @@ int tcf_exts_validate(struct net *net, struct tcf_proto *tp, struct nlattr **tb,
                 INIT_LIST_HEAD(&exts->actions);
                 if (exts->police && tb[exts->police]) {
                         act = tcf_action_init_1(net, tb[exts->police], rate_tlv,
-                                                "police", TCA_ACT_NOREPLACE,
+                                                "police", ovr,
                                                 TCA_ACT_BIND);
                         if (IS_ERR(act))
                                 return PTR_ERR(act);
@@ -523,7 +525,7 @@ int tcf_exts_validate(struct net *net, struct tcf_proto *tp, struct nlattr **tb,
                 } else if (exts->action && tb[exts->action]) {
                         int err;
                         err = tcf_action_init(net, tb[exts->action], rate_tlv,
-                                              NULL, TCA_ACT_NOREPLACE,
+                                              NULL, ovr,
                                               TCA_ACT_BIND, &exts->actions);
                         if (err)
                                 return err;
@@ -543,14 +545,12 @@ void tcf_exts_change(struct tcf_proto *tp, struct tcf_exts *dst,
                      struct tcf_exts *src)
 {
 #ifdef CONFIG_NET_CLS_ACT
-        if (!list_empty(&src->actions)) {
-                LIST_HEAD(tmp);
-                tcf_tree_lock(tp);
-                list_splice_init(&dst->actions, &tmp);
-                list_splice(&src->actions, &dst->actions);
-                tcf_tree_unlock(tp);
-                tcf_action_destroy(&tmp, TCA_ACT_UNBIND);
-        }
+        LIST_HEAD(tmp);
+        tcf_tree_lock(tp);
+        list_splice_init(&dst->actions, &tmp);
+        list_splice(&src->actions, &dst->actions);
+        tcf_tree_unlock(tp);
+        tcf_action_destroy(&tmp, TCA_ACT_UNBIND);
 #endif
 }
 EXPORT_SYMBOL(tcf_exts_change);
diff --git a/net/sched/cls_basic.c b/net/sched/cls_basic.c
index e98ca99c202b..0ae1813e3e90 100644
--- a/net/sched/cls_basic.c
+++ b/net/sched/cls_basic.c
@@ -130,14 +130,14 @@ static const struct nla_policy basic_policy[TCA_BASIC_MAX + 1] = {
 static int basic_set_parms(struct net *net, struct tcf_proto *tp,
                            struct basic_filter *f, unsigned long base,
                            struct nlattr **tb,
-                           struct nlattr *est)
+                           struct nlattr *est, bool ovr)
 {
         int err;
         struct tcf_exts e;
         struct tcf_ematch_tree t;
 
         tcf_exts_init(&e, TCA_BASIC_ACT, TCA_BASIC_POLICE);
-        err = tcf_exts_validate(net, tp, tb, est, &e);
+        err = tcf_exts_validate(net, tp, tb, est, &e, ovr);
         if (err < 0)
                 return err;
 
@@ -161,7 +161,7 @@ errout:
 
 static int basic_change(struct net *net, struct sk_buff *in_skb,
                         struct tcf_proto *tp, unsigned long base, u32 handle,
-                        struct nlattr **tca, unsigned long *arg)
+                        struct nlattr **tca, unsigned long *arg, bool ovr)
 {
         int err;
         struct basic_head *head = tp->root;
@@ -179,7 +179,7 @@ static int basic_change(struct net *net, struct sk_buff *in_skb,
         if (f != NULL) {
                 if (handle && f->handle != handle)
                         return -EINVAL;
-                return basic_set_parms(net, tp, f, base, tb, tca[TCA_RATE]);
+                return basic_set_parms(net, tp, f, base, tb, tca[TCA_RATE], ovr);
         }
 
         err = -ENOBUFS;
@@ -206,7 +206,7 @@ static int basic_change(struct net *net, struct sk_buff *in_skb,
                 f->handle = head->hgenerator;
         }
 
-        err = basic_set_parms(net, tp, f, base, tb, tca[TCA_RATE]);
+        err = basic_set_parms(net, tp, f, base, tb, tca[TCA_RATE], ovr);
         if (err < 0)
                 goto errout;
 
diff --git a/net/sched/cls_bpf.c b/net/sched/cls_bpf.c
index 8e3cf49118e3..13f64df2c710 100644
--- a/net/sched/cls_bpf.c
+++ b/net/sched/cls_bpf.c
@@ -156,11 +156,11 @@ static void cls_bpf_put(struct tcf_proto *tp, unsigned long f)
 static int cls_bpf_modify_existing(struct net *net, struct tcf_proto *tp,
                                    struct cls_bpf_prog *prog,
                                    unsigned long base, struct nlattr **tb,
-                                   struct nlattr *est)
+                                   struct nlattr *est, bool ovr)
 {
         struct sock_filter *bpf_ops, *bpf_old;
         struct tcf_exts exts;
-        struct sock_fprog tmp;
+        struct sock_fprog_kern tmp;
         struct sk_filter *fp, *fp_old;
         u16 bpf_size, bpf_len;
         u32 classid;
@@ -170,7 +170,7 @@ static int cls_bpf_modify_existing(struct net *net, struct tcf_proto *tp,
                 return -EINVAL;
 
         tcf_exts_init(&exts, TCA_BPF_ACT, TCA_BPF_POLICE);
-        ret = tcf_exts_validate(net, tp, tb, est, &exts);
+        ret = tcf_exts_validate(net, tp, tb, est, &exts, ovr);
         if (ret < 0)
                 return ret;
 
@@ -191,7 +191,7 @@ static int cls_bpf_modify_existing(struct net *net, struct tcf_proto *tp,
         memcpy(bpf_ops, nla_data(tb[TCA_BPF_OPS]), bpf_size);
 
         tmp.len = bpf_len;
-        tmp.filter = (struct sock_filter __user *) bpf_ops;
+        tmp.filter = bpf_ops;
 
         ret = sk_unattached_filter_create(&fp, &tmp);
         if (ret)
@@ -242,7 +242,7 @@ static u32 cls_bpf_grab_new_handle(struct tcf_proto *tp,
 static int cls_bpf_change(struct net *net, struct sk_buff *in_skb,
                           struct tcf_proto *tp, unsigned long base,
                           u32 handle, struct nlattr **tca,
-                          unsigned long *arg)
+                          unsigned long *arg, bool ovr)
 {
         struct cls_bpf_head *head = tp->root;
         struct cls_bpf_prog *prog = (struct cls_bpf_prog *) *arg;
@@ -260,7 +260,7 @@ static int cls_bpf_change(struct net *net, struct sk_buff *in_skb,
                 if (handle && prog->handle != handle)
                         return -EINVAL;
                 return cls_bpf_modify_existing(net, tp, prog, base, tb,
-                                               tca[TCA_RATE]);
+                                               tca[TCA_RATE], ovr);
         }
 
         prog = kzalloc(sizeof(*prog), GFP_KERNEL);
@@ -277,7 +277,7 @@ static int cls_bpf_change(struct net *net, struct sk_buff *in_skb,
                 goto errout;
         }
 
-        ret = cls_bpf_modify_existing(net, tp, prog, base, tb, tca[TCA_RATE]);
+        ret = cls_bpf_modify_existing(net, tp, prog, base, tb, tca[TCA_RATE], ovr);
         if (ret < 0)
                 goto errout;
 
diff --git a/net/sched/cls_cgroup.c b/net/sched/cls_cgroup.c
index 8e2158ab551c..cacf01bd04f0 100644
--- a/net/sched/cls_cgroup.c
+++ b/net/sched/cls_cgroup.c
@@ -83,7 +83,7 @@ static const struct nla_policy cgroup_policy[TCA_CGROUP_MAX + 1] = {
 static int cls_cgroup_change(struct net *net, struct sk_buff *in_skb,
                              struct tcf_proto *tp, unsigned long base,
                              u32 handle, struct nlattr **tca,
-                             unsigned long *arg)
+                             unsigned long *arg, bool ovr)
 {
         struct nlattr *tb[TCA_CGROUP_MAX + 1];
         struct cls_cgroup_head *head = tp->root;
@@ -119,7 +119,7 @@ static int cls_cgroup_change(struct net *net, struct sk_buff *in_skb,
                 return err;
 
         tcf_exts_init(&e, TCA_CGROUP_ACT, TCA_CGROUP_POLICE);
-        err = tcf_exts_validate(net, tp, tb, tca[TCA_RATE], &e);
+        err = tcf_exts_validate(net, tp, tb, tca[TCA_RATE], &e, ovr);
         if (err < 0)
                 return err;
 
diff --git a/net/sched/cls_flow.c b/net/sched/cls_flow.c
index 257029c54332..35be16f7c192 100644
--- a/net/sched/cls_flow.c
+++ b/net/sched/cls_flow.c
@@ -349,7 +349,7 @@ static const struct nla_policy flow_policy[TCA_FLOW_MAX + 1] = {
 static int flow_change(struct net *net, struct sk_buff *in_skb,
                        struct tcf_proto *tp, unsigned long base,
                        u32 handle, struct nlattr **tca,
-                       unsigned long *arg)
+                       unsigned long *arg, bool ovr)
 {
         struct flow_head *head = tp->root;
         struct flow_filter *f;
@@ -393,7 +393,7 @@ static int flow_change(struct net *net, struct sk_buff *in_skb,
         }
 
         tcf_exts_init(&e, TCA_FLOW_ACT, TCA_FLOW_POLICE);
-        err = tcf_exts_validate(net, tp, tb, tca[TCA_RATE], &e);
+        err = tcf_exts_validate(net, tp, tb, tca[TCA_RATE], &e, ovr);
         if (err < 0)
                 return err;
 
diff --git a/net/sched/cls_fw.c b/net/sched/cls_fw.c
index 63a3ce75c02e..861b03ccfed0 100644
--- a/net/sched/cls_fw.c
+++ b/net/sched/cls_fw.c
@@ -169,7 +169,7 @@ static const struct nla_policy fw_policy[TCA_FW_MAX + 1] = {
 
 static int
 fw_change_attrs(struct net *net, struct tcf_proto *tp, struct fw_filter *f,
-        struct nlattr **tb, struct nlattr **tca, unsigned long base)
+        struct nlattr **tb, struct nlattr **tca, unsigned long base, bool ovr)
 {
         struct fw_head *head = tp->root;
         struct tcf_exts e;
@@ -177,7 +177,7 @@ fw_change_attrs(struct net *net, struct tcf_proto *tp, struct fw_filter *f,
         int err;
 
         tcf_exts_init(&e, TCA_FW_ACT, TCA_FW_POLICE);
-        err = tcf_exts_validate(net, tp, tb, tca[TCA_RATE], &e);
+        err = tcf_exts_validate(net, tp, tb, tca[TCA_RATE], &e, ovr);
         if (err < 0)
                 return err;
 
@@ -218,7 +218,7 @@ static int fw_change(struct net *net, struct sk_buff *in_skb,
                      struct tcf_proto *tp, unsigned long base,
                      u32 handle,
                      struct nlattr **tca,
-                     unsigned long *arg)
+                     unsigned long *arg, bool ovr)
 {
         struct fw_head *head = tp->root;
         struct fw_filter *f = (struct fw_filter *) *arg;
@@ -236,7 +236,7 @@ static int fw_change(struct net *net, struct sk_buff *in_skb,
         if (f != NULL) {
                 if (f->id != handle && handle)
                         return -EINVAL;
-                return fw_change_attrs(net, tp, f, tb, tca, base);
+                return fw_change_attrs(net, tp, f, tb, tca, base, ovr);
         }
 
         if (!handle)
@@ -264,7 +264,7 @@ static int fw_change(struct net *net, struct sk_buff *in_skb,
         tcf_exts_init(&f->exts, TCA_FW_ACT, TCA_FW_POLICE);
         f->id = handle;
 
-        err = fw_change_attrs(net, tp, f, tb, tca, base);
+        err = fw_change_attrs(net, tp, f, tb, tca, base, ovr);
         if (err < 0)
                 goto errout;
 
diff --git a/net/sched/cls_route.c b/net/sched/cls_route.c
index 1ad3068f2ce1..dd9fc2523c76 100644
--- a/net/sched/cls_route.c
+++ b/net/sched/cls_route.c
@@ -333,7 +333,8 @@ static const struct nla_policy route4_policy[TCA_ROUTE4_MAX + 1] = {
 static int route4_set_parms(struct net *net, struct tcf_proto *tp,
                             unsigned long base, struct route4_filter *f,
                             u32 handle, struct route4_head *head,
-                            struct nlattr **tb, struct nlattr *est, int new)
+                            struct nlattr **tb, struct nlattr *est, int new,
+                            bool ovr)
 {
         int err;
         u32 id = 0, to = 0, nhandle = 0x8000;
@@ -343,7 +344,7 @@ static int route4_set_parms(struct net *net, struct tcf_proto *tp,
         struct tcf_exts e;
 
         tcf_exts_init(&e, TCA_ROUTE4_ACT, TCA_ROUTE4_POLICE);
-        err = tcf_exts_validate(net, tp, tb, est, &e);
+        err = tcf_exts_validate(net, tp, tb, est, &e, ovr);
         if (err < 0)
                 return err;
 
@@ -428,7 +429,7 @@ static int route4_change(struct net *net, struct sk_buff *in_skb,
                        struct tcf_proto *tp, unsigned long base,
                        u32 handle,
                        struct nlattr **tca,
-                       unsigned long *arg)
+                       unsigned long *arg, bool ovr)
 {
         struct route4_head *head = tp->root;
         struct route4_filter *f, *f1, **fp;
@@ -455,7 +456,7 @@ static int route4_change(struct net *net, struct sk_buff *in_skb,
                         old_handle = f->handle;
 
                 err = route4_set_parms(net, tp, base, f, handle, head, tb,
-                        tca[TCA_RATE], 0);
+                        tca[TCA_RATE], 0, ovr);
                 if (err < 0)
                         return err;
 
@@ -479,7 +480,7 @@ static int route4_change(struct net *net, struct sk_buff *in_skb,
 
         tcf_exts_init(&f->exts, TCA_ROUTE4_ACT, TCA_ROUTE4_POLICE);
         err = route4_set_parms(net, tp, base, f, handle, head, tb,
-                tca[TCA_RATE], 1);
+                tca[TCA_RATE], 1, ovr);
         if (err < 0)
                 goto errout;
 
diff --git a/net/sched/cls_rsvp.h b/net/sched/cls_rsvp.h
index 19f8e5dfa8bd..1020e233a5d6 100644
--- a/net/sched/cls_rsvp.h
+++ b/net/sched/cls_rsvp.h
@@ -415,7 +415,7 @@ static int rsvp_change(struct net *net, struct sk_buff *in_skb,
                        struct tcf_proto *tp, unsigned long base,
                        u32 handle,
                        struct nlattr **tca,
-                       unsigned long *arg)
+                       unsigned long *arg, bool ovr)
 {
         struct rsvp_head *data = tp->root;
         struct rsvp_filter *f, **fp;
@@ -436,7 +436,7 @@ static int rsvp_change(struct net *net, struct sk_buff *in_skb,
                 return err;
 
         tcf_exts_init(&e, TCA_RSVP_ACT, TCA_RSVP_POLICE);
-        err = tcf_exts_validate(net, tp, tb, tca[TCA_RATE], &e);
+        err = tcf_exts_validate(net, tp, tb, tca[TCA_RATE], &e, ovr);
         if (err < 0)
                 return err;
 
diff --git a/net/sched/cls_tcindex.c b/net/sched/cls_tcindex.c
index f435a88d899a..c721cd4a469f 100644
--- a/net/sched/cls_tcindex.c
+++ b/net/sched/cls_tcindex.c
@@ -198,7 +198,7 @@ static int
 tcindex_set_parms(struct net *net, struct tcf_proto *tp, unsigned long base,
                   u32 handle, struct tcindex_data *p,
                   struct tcindex_filter_result *r, struct nlattr **tb,
-                 struct nlattr *est)
+                  struct nlattr *est, bool ovr)
 {
         int err, balloc = 0;
         struct tcindex_filter_result new_filter_result, *old_r = r;
@@ -208,7 +208,7 @@ tcindex_set_parms(struct net *net, struct tcf_proto *tp, unsigned long base,
         struct tcf_exts e;
 
         tcf_exts_init(&e, TCA_TCINDEX_ACT, TCA_TCINDEX_POLICE);
-        err = tcf_exts_validate(net, tp, tb, est, &e);
+        err = tcf_exts_validate(net, tp, tb, est, &e, ovr);
         if (err < 0)
                 return err;
 
@@ -341,7 +341,7 @@ errout:
 static int
 tcindex_change(struct net *net, struct sk_buff *in_skb,
                struct tcf_proto *tp, unsigned long base, u32 handle,
-               struct nlattr **tca, unsigned long *arg)
+               struct nlattr **tca, unsigned long *arg, bool ovr)
 {
         struct nlattr *opt = tca[TCA_OPTIONS];
         struct nlattr *tb[TCA_TCINDEX_MAX + 1];
@@ -361,7 +361,7 @@ tcindex_change(struct net *net, struct sk_buff *in_skb,
                 return err;
 
         return tcindex_set_parms(net, tp, base, handle, p, r, tb,
-                                 tca[TCA_RATE]);
+                                 tca[TCA_RATE], ovr);
 }
 
 
diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
index 84c28daff848..c39b583ace32 100644
--- a/net/sched/cls_u32.c
+++ b/net/sched/cls_u32.c
@@ -486,13 +486,13 @@ static const struct nla_policy u32_policy[TCA_U32_MAX + 1] = {
 static int u32_set_parms(struct net *net, struct tcf_proto *tp,
                          unsigned long base, struct tc_u_hnode *ht,
                          struct tc_u_knode *n, struct nlattr **tb,
-                         struct nlattr *est)
+                         struct nlattr *est, bool ovr)
 {
         int err;
         struct tcf_exts e;
 
         tcf_exts_init(&e, TCA_U32_ACT, TCA_U32_POLICE);
-        err = tcf_exts_validate(net, tp, tb, est, &e);
+        err = tcf_exts_validate(net, tp, tb, est, &e, ovr);
         if (err < 0)
                 return err;
 
@@ -545,7 +545,7 @@ errout:
 static int u32_change(struct net *net, struct sk_buff *in_skb,
                       struct tcf_proto *tp, unsigned long base, u32 handle,
                       struct nlattr **tca,
-                      unsigned long *arg)
+                      unsigned long *arg, bool ovr)
 {
         struct tc_u_common *tp_c = tp->data;
         struct tc_u_hnode *ht;
@@ -569,7 +569,7 @@ static int u32_change(struct net *net, struct sk_buff *in_skb,
                         return -EINVAL;
 
                 return u32_set_parms(net, tp, base, n->ht_up, n, tb,
-                                     tca[TCA_RATE]);
+                                     tca[TCA_RATE], ovr);
         }
 
         if (tb[TCA_U32_DIVISOR]) {
@@ -656,7 +656,7 @@ static int u32_change(struct net *net, struct sk_buff *in_skb,
         }
 #endif
 
-        err = u32_set_parms(net, tp, base, ht, n, tb, tca[TCA_RATE]);
+        err = u32_set_parms(net, tp, base, ht, n, tb, tca[TCA_RATE], ovr);
         if (err == 0) {
                 struct tc_u_knode **ins;
                 for (ins = &ht->ht[TC_U32_HASH(handle)]; *ins; ins = &(*ins)->next)
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index 400769014bbd..58bed7599db7 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -563,7 +563,7 @@ out:
 }
 EXPORT_SYMBOL(__qdisc_calculate_pkt_len);
 
-void qdisc_warn_nonwc(char *txt, struct Qdisc *qdisc)
+void qdisc_warn_nonwc(const char *txt, struct Qdisc *qdisc)
 {
         if (!(qdisc->flags & TCQ_F_WARN_NONWC)) {
                 pr_warn("%s: %s qdisc %X: is non-work-conserving?\n",
@@ -1084,7 +1084,8 @@ static int tc_get_qdisc(struct sk_buff *skb, struct nlmsghdr *n)
         struct Qdisc *p = NULL;
         int err;
 
-        if ((n->nlmsg_type != RTM_GETQDISC) && !netlink_capable(skb, CAP_NET_ADMIN))
+        if ((n->nlmsg_type != RTM_GETQDISC) &&
+            !netlink_ns_capable(skb, net->user_ns, CAP_NET_ADMIN))
                 return -EPERM;
 
         err = nlmsg_parse(n, sizeof(*tcm), tca, TCA_MAX, NULL);
@@ -1151,7 +1152,7 @@ static int tc_modify_qdisc(struct sk_buff *skb, struct nlmsghdr *n)
         struct Qdisc *q, *p;
         int err;
 
-        if (!netlink_capable(skb, CAP_NET_ADMIN))
+        if (!netlink_ns_capable(skb, net->user_ns, CAP_NET_ADMIN))
                 return -EPERM;
 
 replay:
@@ -1490,7 +1491,8 @@ static int tc_ctl_tclass(struct sk_buff *skb, struct nlmsghdr *n)
         u32 qid;
         int err;
 
-        if ((n->nlmsg_type != RTM_GETTCLASS) && !netlink_capable(skb, CAP_NET_ADMIN))
+        if ((n->nlmsg_type != RTM_GETTCLASS) &&
+            !netlink_ns_capable(skb, net->user_ns, CAP_NET_ADMIN))
                 return -EPERM;
 
         err = nlmsg_parse(n, sizeof(*tcm), tca, TCA_MAX, NULL);
diff --git a/net/sched/sch_choke.c b/net/sched/sch_choke.c
index 2aee02802c27..ed30e436128b 100644
--- a/net/sched/sch_choke.c
+++ b/net/sched/sch_choke.c
@@ -391,12 +391,7 @@ static const struct nla_policy choke_policy[TCA_CHOKE_MAX + 1] = {
 
 static void choke_free(void *addr)
 {
-        if (addr) {
-                if (is_vmalloc_addr(addr))
-                        vfree(addr);
-                else
-                        kfree(addr);
-        }
+        kvfree(addr);
 }
 
 static int choke_change(struct Qdisc *sch, struct nlattr *opt)
diff --git a/net/sched/sch_drr.c b/net/sched/sch_drr.c
index 8302717ea303..7bbbfe112192 100644
--- a/net/sched/sch_drr.c
+++ b/net/sched/sch_drr.c
@@ -391,8 +391,10 @@ static struct sk_buff *drr_dequeue(struct Qdisc *sch)
         while (1) {
                 cl = list_first_entry(&q->active, struct drr_class, alist);
                 skb = cl->qdisc->ops->peek(cl->qdisc);
-                if (skb == NULL)
+                if (skb == NULL) {
+                        qdisc_warn_nonwc(__func__, cl->qdisc);
                         goto out;
+                }
 
                 len = qdisc_pkt_len(skb);
                 if (len <= cl->deficit) {
diff --git a/net/sched/sch_fq.c b/net/sched/sch_fq.c
index 23c682b42f99..ba32c2b005d0 100644
--- a/net/sched/sch_fq.c
+++ b/net/sched/sch_fq.c
@@ -591,10 +591,7 @@ static void *fq_alloc_node(size_t sz, int node)
 
 static void fq_free(void *addr)
 {
-        if (addr && is_vmalloc_addr(addr))
-                vfree(addr);
-        else
-                kfree(addr);
+        kvfree(addr);
 }
 
 static int fq_resize(struct Qdisc *sch, u32 log)
diff --git a/net/sched/sch_fq_codel.c b/net/sched/sch_fq_codel.c
index 0bf432c782c1..063b726bf1f8 100644
--- a/net/sched/sch_fq_codel.c
+++ b/net/sched/sch_fq_codel.c
@@ -365,12 +365,7 @@ static void *fq_codel_zalloc(size_t sz)
 
 static void fq_codel_free(void *addr)
 {
-        if (addr) {
-                if (is_vmalloc_addr(addr))
-                        vfree(addr);
-                else
-                        kfree(addr);
-        }
+        kvfree(addr);
 }
 
 static void fq_codel_destroy(struct Qdisc *sch)
diff --git a/net/sched/sch_hhf.c b/net/sched/sch_hhf.c
index 6e957c3b9854..d85b6812a7d4 100644
--- a/net/sched/sch_hhf.c
+++ b/net/sched/sch_hhf.c
@@ -414,7 +414,7 @@ static int hhf_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                 }
                 bucket->deficit = weight * q->quantum;
         }
-        if (++sch->q.qlen < sch->limit)
+        if (++sch->q.qlen <= sch->limit)
                 return NET_XMIT_SUCCESS;
 
         q->drop_overlimit++;
@@ -494,12 +494,7 @@ static void *hhf_zalloc(size_t sz)
 
 static void hhf_free(void *addr)
 {
-        if (addr) {
-                if (is_vmalloc_addr(addr))
-                        vfree(addr);
-                else
-                        kfree(addr);
-        }
+        kvfree(addr);
 }
 
 static void hhf_destroy(struct Qdisc *sch)
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index f1669a00f571..111d70fddaea 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -648,12 +648,7 @@ static void netem_reset(struct Qdisc *sch)
 
 static void dist_free(struct disttable *d)
 {
-        if (d) {
-                if (is_vmalloc_addr(d))
-                        vfree(d);
-                else
-                        kfree(d);
-        }
+        kvfree(d);
 }
 
 /*
diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
index 87317ff0b4ec..1af2f73906d0 100644
--- a/net/sched/sch_sfq.c
+++ b/net/sched/sch_sfq.c
@@ -716,12 +716,7 @@ static void *sfq_alloc(size_t sz)
 
 static void sfq_free(void *addr)
 {
-        if (addr) {
-                if (is_vmalloc_addr(addr))
-                        vfree(addr);
-                else
-                        kfree(addr);
-        }
+        kvfree(addr);
 }
 
 static void sfq_destroy(struct Qdisc *sch)