[PKT_SCHED]: Refcount qdisc->dev for __qdisc_destroy rcu-callback

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@redhat.com>

diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index 5d601c2cf481824f72059538bdb06d0221ff4cd1..f73f495d44d3084c95ce5acbab6956ad30cec631 100644 (file)
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -430,6 +430,7 @@ qdisc_create(struct net_device *dev, u32 handle, struct rtattr **tca, int *errp)
        sch->enqueue = ops->enqueue;
        sch->dequeue = ops->dequeue;
        sch->dev = dev;
+       dev_hold(dev);
        atomic_set(&sch->refcnt, 1);
        sch->stats_lock = &dev->queue_lock;
        if (handle == 0) {

diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 34c75b5020b2c1a1a7b6e7c843e8d0aff9c8a6ee..deed19c3e9012b72b8e8e27b4ec4aacc1941b190 100644 (file)
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -399,6 +399,7 @@ struct Qdisc * qdisc_create_dflt(struct net_device *dev, struct Qdisc_ops *ops)
        sch->enqueue = ops->enqueue;
        sch->dequeue = ops->dequeue;
        sch->dev = dev;
+       dev_hold(dev);
        sch->stats_lock = &dev->queue_lock;
        atomic_set(&sch->refcnt, 1);
        /* enqueue is accessed locklessly - make sure it's visible
@@ -440,6 +441,8 @@ static void __qdisc_destroy(struct rcu_head *head)
        write_unlock(&qdisc_tree_lock);
        module_put(ops->owner);
 
+       if (qdisc->dev)
+               dev_put(qdisc->dev);
        if (!(qdisc->flags&TCQ_F_BUILTIN))
                kfree(qdisc);
 }