22 files changed, 179 insertions, 58 deletions

diff --git a/net/batman-adv/gateway_client.c b/net/batman-adv/gateway_client.c
index b421cc49d2cd..fc866f2e4528 100644
--- a/net/batman-adv/gateway_client.c
+++ b/net/batman-adv/gateway_client.c
@@ -200,11 +200,11 @@ void batadv_gw_election(struct batadv_priv *bat_priv)
         if (atomic_read(&bat_priv->gw_mode) != BATADV_GW_MODE_CLIENT)
                 goto out;
 
-        if (!batadv_atomic_dec_not_zero(&bat_priv->gw_reselect))
-                goto out;
-
         curr_gw = batadv_gw_get_selected_gw_node(bat_priv);
 
+        if (!batadv_atomic_dec_not_zero(&bat_priv->gw_reselect) && curr_gw)
+                goto out;
+
         next_gw = batadv_gw_get_best_gw_node(bat_priv);
 
         if (curr_gw == next_gw)
diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
index a438f4b582fc..99dd8f75b3ff 100644
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -197,6 +197,7 @@ static void batadv_tt_local_event(struct batadv_priv *bat_priv,
 del:
                 list_del(&entry->list);
                 kfree(entry);
+                kfree(tt_change_node);
                 event_removed = true;
                 goto unlock;
         }
diff --git a/net/ceph/crypto.c b/net/ceph/crypto.c
index b780cb7947dd..9da7fdd3cd8a 100644
--- a/net/ceph/crypto.c
+++ b/net/ceph/crypto.c
@@ -466,6 +466,7 @@ void ceph_key_destroy(struct key *key) {
         struct ceph_crypto_key *ckey = key->payload.data;
 
         ceph_crypto_key_destroy(ckey);
+        kfree(ckey);
 }
 
 struct key_type key_type_ceph = {
diff --git a/net/ceph/crypto.h b/net/ceph/crypto.h
index 1919d1550d75..3572dc518bc9 100644
--- a/net/ceph/crypto.h
+++ b/net/ceph/crypto.h
@@ -16,7 +16,8 @@ struct ceph_crypto_key {
 
 static inline void ceph_crypto_key_destroy(struct ceph_crypto_key *key)
 {
-        kfree(key->key);
+        if (key)
+                kfree(key->key);
 }
 
 extern int ceph_crypto_key_clone(struct ceph_crypto_key *dst,
diff --git a/net/core/dev.c b/net/core/dev.c
index f91abf800161..a39354ee1432 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1055,6 +1055,8 @@ rollback:
  */
 int dev_set_alias(struct net_device *dev, const char *alias, size_t len)
 {
+        char *new_ifalias;
+
         ASSERT_RTNL();
 
         if (len >= IFALIASZ)
@@ -1068,9 +1070,10 @@ int dev_set_alias(struct net_device *dev, const char *alias, size_t len)
                 return 0;
         }
 
-        dev->ifalias = krealloc(dev->ifalias, len + 1, GFP_KERNEL);
-        if (!dev->ifalias)
+        new_ifalias = krealloc(dev->ifalias, len + 1, GFP_KERNEL);
+        if (!new_ifalias)
                 return -ENOMEM;
+        dev->ifalias = new_ifalias;
 
         strlcpy(dev->ifalias, alias, len+1);
         return len;
diff --git a/net/core/dst.c b/net/core/dst.c
index 069d51d29414..56d63612e1e4 100644
--- a/net/core/dst.c
+++ b/net/core/dst.c
@@ -149,7 +149,15 @@ int dst_discard(struct sk_buff *skb)
 }
 EXPORT_SYMBOL(dst_discard);
 
-const u32 dst_default_metrics[RTAX_MAX];
+const u32 dst_default_metrics[RTAX_MAX + 1] = {
+        /* This initializer is needed to force linker to place this variable
+         * into const section. Otherwise it might end into bss section.
+         * We really want to avoid false sharing on this variable, and catch
+         * any writes on it.
+         */
+        [RTAX_MAX] = 0xdeadbeef,
+};
+
 
 void *dst_alloc(struct dst_ops *ops, struct net_device *dev,
                 int initial_ref, int initial_obsolete, unsigned short flags)
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index f0cdb30921c0..57bd978483e1 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -367,7 +367,7 @@ static void __leaf_free_rcu(struct rcu_head *head)
 
 static inline void free_leaf(struct leaf *l)
 {
-        call_rcu_bh(&l->rcu, __leaf_free_rcu);
+        call_rcu(&l->rcu, __leaf_free_rcu);
 }
 
 static inline void free_leaf_info(struct leaf_info *leaf)
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index ba39a52d18c1..147ccc3e93db 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -197,7 +197,7 @@ static inline int ip_finish_output2(struct sk_buff *skb)
         neigh = __ipv4_neigh_lookup_noref(dev, nexthop);
         if (unlikely(!neigh))
                 neigh = __neigh_create(&arp_tbl, &nexthop, dev, false);
-        if (neigh) {
+        if (!IS_ERR(neigh)) {
                 int res = dst_neigh_output(dst, neigh, skb);
 
                 rcu_read_unlock_bh();
@@ -1366,9 +1366,8 @@ out:
         return skb;
 }
 
-int ip_send_skb(struct sk_buff *skb)
+int ip_send_skb(struct net *net, struct sk_buff *skb)
 {
-        struct net *net = sock_net(skb->sk);
         int err;
 
         err = ip_local_out(skb);
@@ -1391,7 +1390,7 @@ int ip_push_pending_frames(struct sock *sk, struct flowi4 *fl4)
                 return 0;
 
         /* Netfilter gets whole the not fragmented skb. */
-        return ip_send_skb(skb);
+        return ip_send_skb(sock_net(sk), skb);
 }
 
 /*
@@ -1536,6 +1535,7 @@ void ip_send_unicast_reply(struct net *net, struct sk_buff *skb, __be32 daddr,
                           arg->csumoffset) = csum_fold(csum_add(nskb->csum,
                                                                 arg->csum));
                 nskb->ip_summed = CHECKSUM_NONE;
+                skb_orphan(nskb);
                 skb_set_queue_mapping(nskb, skb_get_queue_mapping(skb));
                 ip_push_pending_frames(sk, &fl4);
         }
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 2fd2bc9e3c64..85308b90df80 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -5392,6 +5392,8 @@ int tcp_rcv_established(struct sock *sk, struct sk_buff *skb,
 {
         struct tcp_sock *tp = tcp_sk(sk);
 
+        if (unlikely(sk->sk_rx_dst == NULL))
+                inet_csk(sk)->icsk_af_ops->sk_rx_dst_set(sk, skb);
         /*
          *      Header prediction.
          *      The code loosely follows the one in the famous
@@ -5605,7 +5607,7 @@ void tcp_finish_connect(struct sock *sk, struct sk_buff *skb)
         tcp_set_state(sk, TCP_ESTABLISHED);
 
         if (skb != NULL) {
-                inet_sk_rx_dst_set(sk, skb);
+                icsk->icsk_af_ops->sk_rx_dst_set(sk, skb);
                 security_inet_conn_established(sk, skb);
         }
 
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 42b2a6a73092..767823764016 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1627,9 +1627,6 @@ int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb)
                                 sk->sk_rx_dst = NULL;
                         }
                 }
-                if (unlikely(sk->sk_rx_dst == NULL))
-                        inet_sk_rx_dst_set(sk, skb);
-
                 if (tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len)) {
                         rsk = sk;
                         goto reset;
@@ -1872,10 +1869,21 @@ static struct timewait_sock_ops tcp_timewait_sock_ops = {
         .twsk_destructor= tcp_twsk_destructor,
 };
 
+void inet_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
+{
+        struct dst_entry *dst = skb_dst(skb);
+
+        dst_hold(dst);
+        sk->sk_rx_dst = dst;
+        inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
+}
+EXPORT_SYMBOL(inet_sk_rx_dst_set);
+
 const struct inet_connection_sock_af_ops ipv4_specific = {
         .queue_xmit        = ip_queue_xmit,
         .send_check        = tcp_v4_send_check,
         .rebuild_header    = inet_sk_rebuild_header,
+        .sk_rx_dst_set     = inet_sk_rx_dst_set,
         .conn_request      = tcp_v4_conn_request,
         .syn_recv_sock     = tcp_v4_syn_recv_sock,
         .net_header_len    = sizeof(struct iphdr),
diff --git a/net/ipv4/tcp_metrics.c b/net/ipv4/tcp_metrics.c
index 2288a6399e1e..0abe67bb4d3a 100644
--- a/net/ipv4/tcp_metrics.c
+++ b/net/ipv4/tcp_metrics.c
@@ -731,6 +731,18 @@ static int __net_init tcp_net_metrics_init(struct net *net)
 
 static void __net_exit tcp_net_metrics_exit(struct net *net)
 {
+        unsigned int i;
+
+        for (i = 0; i < (1U << net->ipv4.tcp_metrics_hash_log) ; i++) {
+                struct tcp_metrics_block *tm, *next;
+
+                tm = rcu_dereference_protected(net->ipv4.tcp_metrics_hash[i].chain, 1);
+                while (tm) {
+                        next = rcu_dereference_protected(tm->tcpm_next, 1);
+                        kfree(tm);
+                        tm = next;
+                }
+        }
         kfree(net->ipv4.tcp_metrics_hash);
 }
 
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index 232a90c3ec86..d9c9dcef2de3 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -387,7 +387,7 @@ struct sock *tcp_create_openreq_child(struct sock *sk, struct request_sock *req,
                 struct tcp_sock *oldtp = tcp_sk(sk);
                 struct tcp_cookie_values *oldcvp = oldtp->cookie_values;
 
-                inet_sk_rx_dst_set(newsk, skb);
+                newicsk->icsk_af_ops->sk_rx_dst_set(newsk, skb);
 
                 /* TCP Cookie Transactions require space for the cookie pair,
                  * as it differs for each connection.  There is no need to
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index a7b3ec9b6c3e..20dfd892c86f 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -940,7 +940,7 @@ void __init tcp_tasklet_init(void)
  * We cant xmit new skbs from this context, as we might already
  * hold qdisc lock.
  */
-void tcp_wfree(struct sk_buff *skb)
+static void tcp_wfree(struct sk_buff *skb)
 {
         struct sock *sk = skb->sk;
         struct tcp_sock *tp = tcp_sk(sk);
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index b4c3582a991f..6f6d1aca3c3d 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -758,7 +758,7 @@ static int udp_send_skb(struct sk_buff *skb, struct flowi4 *fl4)
                 uh->check = CSUM_MANGLED_0;
 
 send:
-        err = ip_send_skb(skb);
+        err = ip_send_skb(sock_net(sk), skb);
         if (err) {
                 if (err == -ENOBUFS && !inet->recverr) {
                         UDP_INC_STATS_USER(sock_net(sk),
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index c66b90f71c9b..bb9ce2b2f377 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1447,7 +1447,17 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
                 opt_skb = skb_clone(skb, sk_gfp_atomic(sk, GFP_ATOMIC));
 
         if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
+                struct dst_entry *dst = sk->sk_rx_dst;
+
                 sock_rps_save_rxhash(sk, skb);
+                if (dst) {
+                        if (inet_sk(sk)->rx_dst_ifindex != skb->skb_iif ||
+                            dst->ops->check(dst, np->rx_dst_cookie) == NULL) {
+                                dst_release(dst);
+                                sk->sk_rx_dst = NULL;
+                        }
+                }
+
                 if (tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len))
                         goto reset;
                 if (opt_skb)
@@ -1705,9 +1715,9 @@ static void tcp_v6_early_demux(struct sk_buff *skb)
                         struct dst_entry *dst = sk->sk_rx_dst;
                         struct inet_sock *icsk = inet_sk(sk);
                         if (dst)
-                                dst = dst_check(dst, 0);
+                                dst = dst_check(dst, inet6_sk(sk)->rx_dst_cookie);
                         if (dst &&
-                            icsk->rx_dst_ifindex == inet6_iif(skb))
+                            icsk->rx_dst_ifindex == skb->skb_iif)
                                 skb_dst_set_noref(skb, dst);
                 }
         }
@@ -1719,10 +1729,23 @@ static struct timewait_sock_ops tcp6_timewait_sock_ops = {
         .twsk_destructor= tcp_twsk_destructor,
 };
 
+static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
+{
+        struct dst_entry *dst = skb_dst(skb);
+        const struct rt6_info *rt = (const struct rt6_info *)dst;
+
+        dst_hold(dst);
+        sk->sk_rx_dst = dst;
+        inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
+        if (rt->rt6i_node)
+                inet6_sk(sk)->rx_dst_cookie = rt->rt6i_node->fn_sernum;
+}
+
 static const struct inet_connection_sock_af_ops ipv6_specific = {
         .queue_xmit        = inet6_csk_xmit,
         .send_check        = tcp_v6_send_check,
         .rebuild_header    = inet6_sk_rebuild_header,
+        .sk_rx_dst_set     = inet6_sk_rx_dst_set,
         .conn_request      = tcp_v6_conn_request,
         .syn_recv_sock     = tcp_v6_syn_recv_sock,
         .net_header_len    = sizeof(struct ipv6hdr),
@@ -1754,6 +1777,7 @@ static const struct inet_connection_sock_af_ops ipv6_mapped = {
         .queue_xmit        = ip_queue_xmit,
         .send_check        = tcp_v4_send_check,
         .rebuild_header    = inet_sk_rebuild_header,
+        .sk_rx_dst_set     = inet_sk_rx_dst_set,
         .conn_request      = tcp_v6_conn_request,
         .syn_recv_sock     = tcp_v6_syn_recv_sock,
         .net_header_len    = sizeof(struct iphdr),
diff --git a/net/llc/llc_station.c b/net/llc/llc_station.c
index 39a8d8924b9c..6828e39ec2ec 100644
--- a/net/llc/llc_station.c
+++ b/net/llc/llc_station.c
@@ -268,7 +268,7 @@ static int llc_station_ac_send_null_dsap_xid_c(struct sk_buff *skb)
 out:
         return rc;
 free:
-        kfree_skb(skb);
+        kfree_skb(nskb);
         goto out;
 }
 
@@ -293,7 +293,7 @@ static int llc_station_ac_send_xid_r(struct sk_buff *skb)
 out:
         return rc;
 free:
-        kfree_skb(skb);
+        kfree_skb(nskb);
         goto out;
 }
 
@@ -322,7 +322,7 @@ static int llc_station_ac_send_test_r(struct sk_buff *skb)
 out:
         return rc;
 free:
-        kfree_skb(skb);
+        kfree_skb(nskb);
         goto out;
 }
 
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index ceaca7c134a0..8ac890a1a4c0 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -1079,7 +1079,7 @@ static void *packet_current_rx_frame(struct packet_sock *po,
         default:
                 WARN(1, "TPACKET version not supported\n");
                 BUG();
-                return 0;
+                return NULL;
         }
 }
 
@@ -1936,7 +1936,6 @@ static void tpacket_destruct_skb(struct sk_buff *skb)
 
         if (likely(po->tx_ring.pg_vec)) {
                 ph = skb_shinfo(skb)->destructor_arg;
-                BUG_ON(__packet_get_status(po, ph) != TP_STATUS_SENDING);
                 BUG_ON(atomic_read(&po->tx_ring.pending) == 0);
                 atomic_dec(&po->tx_ring.pending);
                 __packet_set_status(po, ph, TP_STATUS_AVAILABLE);
diff --git a/net/sched/act_gact.c b/net/sched/act_gact.c
index f10fb8256442..05d60859d8e3 100644
--- a/net/sched/act_gact.c
+++ b/net/sched/act_gact.c
@@ -67,6 +67,9 @@ static int tcf_gact_init(struct nlattr *nla, struct nlattr *est,
         struct tcf_common *pc;
         int ret = 0;
         int err;
+#ifdef CONFIG_GACT_PROB
+        struct tc_gact_p *p_parm = NULL;
+#endif
 
         if (nla == NULL)
                 return -EINVAL;
@@ -82,6 +85,12 @@ static int tcf_gact_init(struct nlattr *nla, struct nlattr *est,
 #ifndef CONFIG_GACT_PROB
         if (tb[TCA_GACT_PROB] != NULL)
                 return -EOPNOTSUPP;
+#else
+        if (tb[TCA_GACT_PROB]) {
+                p_parm = nla_data(tb[TCA_GACT_PROB]);
+                if (p_parm->ptype >= MAX_RAND)
+                        return -EINVAL;
+        }
 #endif
 
         pc = tcf_hash_check(parm->index, a, bind, &gact_hash_info);
@@ -103,8 +112,7 @@ static int tcf_gact_init(struct nlattr *nla, struct nlattr *est,
         spin_lock_bh(&gact->tcf_lock);
         gact->tcf_action = parm->action;
 #ifdef CONFIG_GACT_PROB
-        if (tb[TCA_GACT_PROB] != NULL) {
-                struct tc_gact_p *p_parm = nla_data(tb[TCA_GACT_PROB]);
+        if (p_parm) {
                 gact->tcfg_paction = p_parm->paction;
                 gact->tcfg_pval    = p_parm->pval;
                 gact->tcfg_ptype   = p_parm->ptype;
@@ -133,7 +141,7 @@ static int tcf_gact(struct sk_buff *skb, const struct tc_action *a,
 
         spin_lock(&gact->tcf_lock);
 #ifdef CONFIG_GACT_PROB
-        if (gact->tcfg_ptype && gact_rand[gact->tcfg_ptype] != NULL)
+        if (gact->tcfg_ptype)
                 action = gact_rand[gact->tcfg_ptype](gact);
         else
                 action = gact->tcf_action;
diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c
index 60e281ad0f07..58fb3c7aab9e 100644
--- a/net/sched/act_ipt.c
+++ b/net/sched/act_ipt.c
@@ -185,7 +185,12 @@ err3:
 err2:
         kfree(tname);
 err1:
-        kfree(pc);
+        if (ret == ACT_P_CREATED) {
+                if (est)
+                        gen_kill_estimator(&pc->tcfc_bstats,
+                                           &pc->tcfc_rate_est);
+                kfree_rcu(pc, tcfc_rcu);
+        }
         return err;
 }
 
diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
index 26aa2f6ce257..45c53ab067a6 100644
--- a/net/sched/act_pedit.c
+++ b/net/sched/act_pedit.c
@@ -74,7 +74,10 @@ static int tcf_pedit_init(struct nlattr *nla, struct nlattr *est,
                 p = to_pedit(pc);
                 keys = kmalloc(ksize, GFP_KERNEL);
                 if (keys == NULL) {
-                        kfree(pc);
+                        if (est)
+                                gen_kill_estimator(&pc->tcfc_bstats,
+                                                   &pc->tcfc_rate_est);
+                        kfree_rcu(pc, tcfc_rcu);
                         return -ENOMEM;
                 }
                 ret = ACT_P_CREATED;
diff --git a/net/sched/act_simple.c b/net/sched/act_simple.c
index 3922f2a2821b..3714f60f0b3c 100644
--- a/net/sched/act_simple.c
+++ b/net/sched/act_simple.c
@@ -131,7 +131,10 @@ static int tcf_simp_init(struct nlattr *nla, struct nlattr *est,
                 d = to_defact(pc);
                 ret = alloc_defdata(d, defdata);
                 if (ret < 0) {
-                        kfree(pc);
+                        if (est)
+                                gen_kill_estimator(&pc->tcfc_bstats,
+                                                   &pc->tcfc_rate_est);
+                        kfree_rcu(pc, tcfc_rcu);
                         return ret;
                 }
                 d->tcf_action = parm->action;
diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c
index 9af01f3df18c..e4723d31fdd5 100644
--- a/net/sched/sch_qfq.c
+++ b/net/sched/sch_qfq.c
@@ -203,6 +203,34 @@ out:
         return index;
 }
 
+/* Length of the next packet (0 if the queue is empty). */
+static unsigned int qdisc_peek_len(struct Qdisc *sch)
+{
+        struct sk_buff *skb;
+
+        skb = sch->ops->peek(sch);
+        return skb ? qdisc_pkt_len(skb) : 0;
+}
+
+static void qfq_deactivate_class(struct qfq_sched *, struct qfq_class *);
+static void qfq_activate_class(struct qfq_sched *q, struct qfq_class *cl,
+                               unsigned int len);
+
+static void qfq_update_class_params(struct qfq_sched *q, struct qfq_class *cl,
+                                    u32 lmax, u32 inv_w, int delta_w)
+{
+        int i;
+
+        /* update qfq-specific data */
+        cl->lmax = lmax;
+        cl->inv_w = inv_w;
+        i = qfq_calc_index(cl->inv_w, cl->lmax);
+
+        cl->grp = &q->groups[i];
+
+        q->wsum += delta_w;
+}
+
 static int qfq_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
                             struct nlattr **tca, unsigned long *arg)
 {
@@ -250,6 +278,8 @@ static int qfq_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
                 lmax = 1UL << QFQ_MTU_SHIFT;
 
         if (cl != NULL) {
+                bool need_reactivation = false;
+
                 if (tca[TCA_RATE]) {
                         err = gen_replace_estimator(&cl->bstats, &cl->rate_est,
                                                     qdisc_root_sleeping_lock(sch),
@@ -258,12 +288,29 @@ static int qfq_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
                                 return err;
                 }
 
-                if (inv_w != cl->inv_w) {
-                        sch_tree_lock(sch);
-                        q->wsum += delta_w;
-                        cl->inv_w = inv_w;
-                        sch_tree_unlock(sch);
+                if (lmax == cl->lmax && inv_w == cl->inv_w)
+                        return 0; /* nothing to update */
+
+                i = qfq_calc_index(inv_w, lmax);
+                sch_tree_lock(sch);
+                if (&q->groups[i] != cl->grp && cl->qdisc->q.qlen > 0) {
+                        /*
+                         * shift cl->F back, to not charge the
+                         * class for the not-yet-served head
+                         * packet
+                         */
+                        cl->F = cl->S;
+                        /* remove class from its slot in the old group */
+                        qfq_deactivate_class(q, cl);
+                        need_reactivation = true;
                 }
+
+                qfq_update_class_params(q, cl, lmax, inv_w, delta_w);
+
+                if (need_reactivation) /* activate in new group */
+                        qfq_activate_class(q, cl, qdisc_peek_len(cl->qdisc));
+                sch_tree_unlock(sch);
+
                 return 0;
         }
 
@@ -273,11 +320,8 @@ static int qfq_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
 
         cl->refcnt = 1;
         cl->common.classid = classid;
-        cl->lmax = lmax;
-        cl->inv_w = inv_w;
-        i = qfq_calc_index(cl->inv_w, cl->lmax);
 
-        cl->grp = &q->groups[i];
+        qfq_update_class_params(q, cl, lmax, inv_w, delta_w);
 
         cl->qdisc = qdisc_create_dflt(sch->dev_queue,
                                       &pfifo_qdisc_ops, classid);
@@ -294,7 +338,6 @@ static int qfq_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
                         return err;
                 }
         }
-        q->wsum += weight;
 
         sch_tree_lock(sch);
         qdisc_class_hash_insert(&q->clhash, &cl->common);
@@ -711,15 +754,6 @@ static void qfq_update_eligible(struct qfq_sched *q, u64 old_V)
         }
 }
 
-/* What is length of next packet in queue (0 if queue is empty) */
-static unsigned int qdisc_peek_len(struct Qdisc *sch)
-{
-        struct sk_buff *skb;
-
-        skb = sch->ops->peek(sch);
-        return skb ? qdisc_pkt_len(skb) : 0;
-}
-
 /*
  * Updates the class, returns true if also the group needs to be updated.
  */
@@ -843,11 +877,8 @@ static void qfq_update_start(struct qfq_sched *q, struct qfq_class *cl)
 static int qfq_enqueue(struct sk_buff *skb, struct Qdisc *sch)
 {
         struct qfq_sched *q = qdisc_priv(sch);
-        struct qfq_group *grp;
         struct qfq_class *cl;
         int err;
-        u64 roundedS;
-        int s;
 
         cl = qfq_classify(skb, sch, &err);
         if (cl == NULL) {
@@ -876,11 +907,25 @@ static int qfq_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                 return err;
 
         /* If reach this point, queue q was idle */
-        grp = cl->grp;
+        qfq_activate_class(q, cl, qdisc_pkt_len(skb));
+
+        return err;
+}
+
+/*
+ * Handle class switch from idle to backlogged.
+ */
+static void qfq_activate_class(struct qfq_sched *q, struct qfq_class *cl,
+                               unsigned int pkt_len)
+{
+        struct qfq_group *grp = cl->grp;
+        u64 roundedS;
+        int s;
+
         qfq_update_start(q, cl);
 
         /* compute new finish time and rounded start. */
-        cl->F = cl->S + (u64)qdisc_pkt_len(skb) * cl->inv_w;
+        cl->F = cl->S + (u64)pkt_len * cl->inv_w;
         roundedS = qfq_round_down(cl->S, grp->slot_shift);
 
         /*
@@ -917,8 +962,6 @@ static int qfq_enqueue(struct sk_buff *skb, struct Qdisc *sch)
 
 skip_update:
         qfq_slot_insert(grp, cl, roundedS);
-
-        return err;
 }