Kernel oops in 2.6.27-rc1 qdisc.

Kernel oops in 2.6.27-rc1 qdisc.

[Steven Jan Springl]

[-- Attachment #1: Type: text/plain, Size: 223 bytes --]

Hello

Issuing the following command causes a kernel oops:
	tc qdisc add dev eth0 handle ffff: ingress

The problem is recreatable.
The kernel is 2.6.27-rc1.
I am using Debian etch.

The oops is attached.

Regards

Steven.

[-- Attachment #2: qdisc-oops.txt --]
[-- Type: text/plain, Size: 15813 bytes --]

Duron(tm) processor stepping 01
Checking 'hlt' instruction... OK.
Freeing SMP alternatives: 0k freed
ACPI: Core revision 20080609
ACPI: setting ELCR to 0800 (from 0e20)
net_namespace: 784 bytes
NET: Registered protocol family 16
ACPI: bus type pci registered
PCI: PCI BIOS revision 2.10 entry at 0xfb690, last bus=2
PCI: Using configuration type 1 for base access
ACPI: EC: Look up EC in DSDT
ACPI: Interpreter enabled
ACPI: (supports S0 S1 S5)
ACPI: Using PIC for interrupt routing
ACPI: PCI Root Bridge [PCI0] (0000:00)
pci 0000:00:07.4: quirk: region 6000-607f claimed by vt82c686 HW-mon
pci 0000:00:07.4: quirk: region 5000-500f claimed by vt82c686 SMB
pci 0000:00:0b.0: supports D1
pci 0000:00:0b.0: supports D2
pci 0000:00:0b.0: PME# supported from D1 D2 D3hot D3cold
pci 0000:00:0b.0: PME# disabled
bus 00 -> node 0
ACPI: PCI Interrupt Routing Table [\_SB_.PCI0._PRT]
ACPI: PCI Interrupt Link [LNKA] (IRQs 1 3 4 *5 6 7 10 11 12 14 15)
ACPI: PCI Interrupt Link [LNKB] (IRQs 1 3 4 5 6 7 10 11 12 14 15) *9
ACPI: PCI Interrupt Link [LNKC] (IRQs 1 3 4 5 6 7 10 *11 12 14 15)
ACPI: PCI Interrupt Link [LNKD] (IRQs 1 3 4 5 6 7 *10 11 12 14 15)
Linux Plug and Play Support v0.97 (c) Adam Belay
pnp: PnP ACPI init
ACPI: bus type pnp registered
pnp: PnP ACPI: found 13 devices
ACPI: ACPI bus type pnp unregistered
PnPBIOS: Disabled by ACPI PNP
PCI: Using ACPI for IRQ routing
NET: Registered protocol family 8
NET: Registered protocol family 20
system 00:00: iomem range 0xca800-0xcbfff has been reserved
system 00:00: iomem range 0xf0000-0xf7fff could not be reserved
system 00:00: iomem range 0xf8000-0xfbfff could not be reserved
system 00:00: iomem range 0xfc000-0xfffff could not be reserved
system 00:00: iomem range 0x2fff0000-0x2fffffff could not be reserved
system 00:00: iomem range 0xffff0000-0xffffffff could not be reserved
system 00:00: iomem range 0x0-0x9ffff could not be reserved
system 00:00: iomem range 0x100000-0x2ffeffff could not be reserved
system 00:00: iomem range 0xfee00000-0xfee00fff has been reserved
system 00:02: ioport range 0x4d0-0x4d1 has been reserved
pci 0000:00:01.0: PCI bridge, secondary bus 0000:01
pci 0000:00:01.0:   IO window: disabled
pci 0000:00:01.0:   MEM window: 0xf6000000-0xf7ffffff
pci 0000:00:01.0:   PREFETCH window: 0x000000f4000000-0x000000f5ffffff
pci 0000:00:0d.0: PCI bridge, secondary bus 0000:02
pci 0000:00:0d.0:   IO window: 0xc000-0xcfff
pci 0000:00:0d.0:   MEM window: 0xf8000000-0xf9ffffff
pci 0000:00:0d.0:   PREFETCH window: 0x00000040000000-0x000000400fffff
NET: Registered protocol family 2
IP route cache hash table entries: 32768 (order: 5, 131072 bytes)
TCP established hash table entries: 131072 (order: 8, 1048576 bytes)
TCP bind hash table entries: 65536 (order: 6, 262144 bytes)
TCP: Hash tables configured (established 131072 bind 65536)
TCP reno registered
NET: Registered protocol family 1
checking if image is initramfs... it is
Freeing initrd memory: 3251k freed
audit: initializing netlink socket (disabled)
type=2000 audit(1217338387.568:1): initialized
VFS: Disk quotas dquot_6.5.1
Dquot-cache hash table entries: 1024 (order 0, 4096 bytes)
msgmni has been set to 1516
io scheduler noop registered
io scheduler anticipatory registered
io scheduler deadline registered
io scheduler cfq registered (default)
pci 0000:00:07.0: Disabling VIA external APIC routing
pci 0000:01:05.0: Boot video device
isapnp: Scanning for PnP cards...
isapnp: No Plug & Play device found
Serial: 8250/16550 driver4 ports, IRQ sharing enabled
serial8250: ttyS0 at I/O 0x3f8 (irq = 4) is a 16550A
serial8250: ttyS1 at I/O 0x2f8 (irq = 3) is a 16550A
00:08: ttyS0 at I/O 0x3f8 (irq = 4) is a 16550A
00:09: ttyS1 at I/O 0x2f8 (irq = 3) is a 16550A
brd: module loaded
PNP: PS/2 Controller [PNP0303:PS2K,PNP0f13:PS2M] at 0x60,0x64 irq 1,12
serio: i8042 KBD port at 0x60,0x64 irq 1
serio: i8042 AUX port at 0x60,0x64 irq 12
mice: PS/2 mouse device common for all mice
TCP bic registered
NET: Registered protocol family 17
Using IPI Shortcut mode
Freeing unused kernel memory: 208k freed
input: AT Translated Set 2 keyboard as /class/input/input0
processor ACPI0007:00: registered as cooling_device0
ACPI: Processor [CPU0] (supports 2 throttling states)
Uniform Multi-Platform E-IDE driver
8139cp: 10/100 PCI Ethernet driver v1.3 (Mar 22, 2004)
8139cp 0000:00:0b.0: This (id 10ec:8139 rev 10) is not an 8139C+ compatible chip
8139cp 0000:00:0b.0: Try the "8139too" driver instead.
via82cxxx 0000:00:07.1: VIA vt82c686b (rev 40) IDE UDMA100
via82cxxx 0000:00:07.1: IDE controller (0x1106:0x0571 rev 0x06)
via82cxxx 0000:00:07.1: not 100% native mode: will probe irqs later
    ide0: BM-DMA at 0xd000-0xd007
    ide1: BM-DMA at 0xd008-0xd00f
Probing IDE interface ide0...
8139too Fast Ethernet driver 0.9.28
Linux Tulip driver version 1.1.15-NAPI (Feb 27, 2007)
hda: WDC WD200EB-00CPF0, ATA DISK drive
hda: host max PIO5 wanted PIO255(auto-tune) selected PIO4
hda: UDMA/100 mode selected
Probing IDE interface ide1...
hdc: COMPAQ CR-587, ATAPI CD/DVD-ROM drive
hdc: host max PIO5 wanted PIO255(auto-tune) selected PIO4
hdc: MWDMA2 mode selected
ide0 at 0x1f0-0x1f7,0x3f6 on irq 14
ide1 at 0x170-0x177,0x376 on irq 15
ACPI: PCI Interrupt Link [LNKD] enabled at IRQ 10
PCI: setting IRQ 10 as level-triggered
8139too 0000:00:0b.0: PCI INT A -> Link[LNKD] -> GSI 10 (level, low) -> IRQ 10
eth0: RealTek RTL8139 at 0xdc00, 00:40:f4:4d:77:73, IRQ 10
eth0:  Identified 8139 chip type 'RTL-8100B/8139D'
ACPI: PCI Interrupt Link [LNKB] enabled at IRQ 11
PCI: setting IRQ 11 as level-triggered
tulip 0000:02:04.0: PCI INT A -> Link[LNKB] -> GSI 11 (level, low) -> IRQ 11
tulip0:  EEPROM default media type Autosense.
tulip0:  Index #0 - Media 10baseT (#0) described by a 21142 Serial PHY (2) block.
tulip0:  Index #1 - Media 10baseT-FDX (#4) described by a 21142 Serial PHY (2) block.
tulip0:  Index #2 - Media 100baseTx (#3) described by a 21143 SYM PHY (4) block.
tulip0:  Index #3 - Media 100baseTx-FDX (#5) described by a 21143 SYM PHY (4) block.
eth1: Digital DS21142/43 Tulip rev 65 at Port 0xc000, 00:c0:95:e0:a5:8c, IRQ 11.
ACPI: PCI Interrupt Link [LNKA] enabled at IRQ 5
PCI: setting IRQ 5 as level-triggered
tulip 0000:02:05.0: PCI INT A -> Link[LNKA] -> GSI 5 (level, low) -> IRQ 5
tulip1:  EEPROM default media type Autosense.
tulip1:  Index #0 - Media 10baseT (#0) described by a 21142 Serial PHY (2) block.
tulip1:  Index #1 - Media 10baseT-FDX (#4) described by a 21142 Serial PHY (2) block.
tulip1:  Index #2 - Media 100baseTx (#3) described by a 21143 SYM PHY (4) block.
tulip1:  Index #3 - Media 100baseTx-FDX (#5) described by a 21143 SYM PHY (4) block.
eth2: Digital DS21142/43 Tulip rev 65 at Port 0xc400, 00:c0:95:e0:a5:8d, IRQ 5.
tulip 0000:02:06.0: PCI INT A -> Link[LNKD] -> GSI 10 (level, low) -> IRQ 10
tulip2:  EEPROM default media type Autosense.
tulip2:  Index #0 - Media 10baseT (#0) described by a 21142 Serial PHY (2) block.
tulip2:  Index #1 - Media 10baseT-FDX (#4) described by a 21142 Serial PHY (2) block.
tulip2:  Index #2 - Media 100baseTx (#3) described by a 21143 SYM PHY (4) block.
tulip2:  Index #3 - Media 100baseTx-FDX (#5) described by a 21143 SYM PHY (4) block.
eth3: Digital DS21142/43 Tulip rev 65 at Port 0xc800, 00:c0:95:e0:a5:8e, IRQ 10.
ACPI: PCI Interrupt Link [LNKC] enabled at IRQ 11
tulip 0000:02:07.0: PCI INT A -> Link[LNKC] -> GSI 11 (level, low) -> IRQ 11
tulip3:  EEPROM default media type Autosense.
tulip3:  Index #0 - Media 10baseT (#0) described by a 21142 Serial PHY (2) block.
tulip3:  Index #1 - Media 10baseT-FDX (#4) described by a 21142 Serial PHY (2) block.
tulip3:  Index #2 - Media 100baseTx (#3) described by a 21143 SYM PHY (4) block.
tulip3:  Index #3 - Media 100baseTx-FDX (#5) described by a 21143 SYM PHY (4) block.
eth4: Digital DS21142/43 Tulip rev 65 at Port 0xcc00, 00:c0:95:e0:a5:8f, IRQ 11.
hda: max request size: 128KiB
hda: 39102336 sectors (20020 MB) w/2048KiB Cache, CHS=38792/16/63
hda: cache flushes not supported
 hda: hda1 hda2
hdc: ATAPI 24X CD-ROM drive, 128kB Cache
Uniform CD-ROM driver Revision: 3.20
EXT3-fs: INFO: recovery required on readonly filesystem.
EXT3-fs: write access will be enabled during recovery.
kjournald starting.  Commit interval 5 seconds
EXT3-fs: recovery complete.
EXT3-fs: mounted filesystem with ordered data mode.
Linux agpgart interface v0.103
pci_hotplug: PCI Hot Plug PCI Core version: 0.5
shpchp: HPC vendor_id 1022 device_id 700f ss_vid 0 ss_did 0
shpchp: shpc_init: cannot reserve MMIO region
shpchp: Standard Hot Plug PCI Controller Driver version: 0.4
parport_pc: VIA 686A/8231 detected
parport_pc: probing current configuration
parport_pc: Current parallel port base: 0x378
parport0: PC-style at 0x378, irq 7 [PCSPP,EPP]
input: Power Button (FF) as /class/input/input1
agpgart: Detected AMD 761 chipset
agpgart: AGP aperture is 64M @ 0xf0000000
ACPI: Power Button (FF) [PWRF]
input: Power Button (CM) as /class/input/input2
ACPI: Power Button (CM) [PWRB]
input: Sleep Button (CM) as /class/input/input3
parport_pc: VIA parallel port: io=0x378, irq=7
ACPI: Sleep Button (CM) [SLPB]
input: PC Speaker as /class/input/input4
Floppy drive(s): fd0 is 1.44M
FDC 0 is a post-1991 82077
input: GenPS/2 Genius Mouse as /class/input/input5
Adding 497972k swap on /dev/hda1.  Priority:-1 extents:1 across:497972k
EXT3 FS on hda2, internal journal
loop: module loaded
Bridge firewalling registered
br0: Dropping NETIF_F_UFO since no NETIF_F_HW_CSUM feature.
device eth2 entered promiscuous mode
device eth1 entered promiscuous mode
br0: port 2(eth1) entering learning state
br0: port 1(eth2) entering learning state
eth0: link up, 100Mbps, full-duplex, lpa 0x45E1
br0: topology change detected, propagating
br0: port 2(eth1) entering forwarding state
br0: topology change detected, propagating
br0: port 1(eth2) entering forwarding state
br1: Dropping NETIF_F_UFO since no NETIF_F_HW_CSUM feature.
device eth4 entered promiscuous mode
device eth3 entered promiscuous mode
br1: port 2(eth3) entering learning state
br1: port 1(eth4) entering learning state
br1: topology change detected, propagating
br1: port 2(eth3) entering forwarding state
br1: topology change detected, propagating
br1: port 1(eth4) entering forwarding state
NET: Registered protocol family 10
lo: Disabled Privacy Extensions
0000:02:07.0: tulip_stop_rxtx() failed (CSR5 0xf0260000 CSR6 0xb38620c2)
0000:02:06.0: tulip_stop_rxtx() failed (CSR5 0xf0260000 CSR6 0xb38620c2)
0000:02:05.0: tulip_stop_rxtx() failed (CSR5 0xf0260000 CSR6 0xb3862002)
0000:02:04.0: tulip_stop_rxtx() failed (CSR5 0xf0260000 CSR6 0xb3862002)
0000:02:07.0: tulip_stop_rxtx() failed (CSR5 0xf0260000 CSR6 0xb3862002)
0000:02:06.0: tulip_stop_rxtx() failed (CSR5 0xf0260000 CSR6 0xb3862002)
br0: no IPv6 routers present
br1: no IPv6 routers present
0000:02:05.0: tulip_stop_rxtx() failed (CSR5 0xf0660000 CSR6 0xb3862002)
0000:02:04.0: tulip_stop_rxtx() failed (CSR5 0xf0260000 CSR6 0xb3862002)
eth1: no IPv6 routers present
eth4: no IPv6 routers present
eth3: no IPv6 routers present
eth2: no IPv6 routers present
0000:02:07.0: tulip_stop_rxtx() failed (CSR5 0xf0660000 CSR6 0xb3862002)
0000:02:06.0: tulip_stop_rxtx() failed (CSR5 0xf0660000 CSR6 0xb3862002)
0000:02:04.0: tulip_stop_rxtx() failed (CSR5 0xf0260000 CSR6 0xb3862002)
0000:02:04.0: tulip_stop_rxtx() failed (CSR5 0xf0660000 CSR6 0xb3862002)
0000:02:05.0: tulip_stop_rxtx() failed (CSR5 0xf0660000 CSR6 0xb3862002)
0000:02:07.0: tulip_stop_rxtx() failed (CSR5 0xf0660000 CSR6 0xb3862002)
0000:02:05.0: tulip_stop_rxtx() failed (CSR5 0xf0660000 CSR6 0xb3862002)
0000:02:05.0: tulip_stop_rxtx() failed (CSR5 0xf0660000 CSR6 0xb3862002)
0000:02:05.0: tulip_stop_rxtx() failed (CSR5 0xf0660000 CSR6 0xb3862002)
0000:02:05.0: tulip_stop_rxtx() failed (CSR5 0xf0660000 CSR6 0xb3862002)
0000:02:07.0: tulip_stop_rxtx() failed (CSR5 0xf0660000 CSR6 0xb3862002)
0000:02:05.0: tulip_stop_rxtx() failed (CSR5 0xf0660000 CSR6 0xb3862002)
0000:02:06.0: tulip_stop_rxtx() failed (CSR5 0xf0660000 CSR6 0xb3862002)
0000:02:05.0: tulip_stop_rxtx() failed (CSR5 0xf0660000 CSR6 0xb3862002)
Netfilter messages via NETLINK v0.30.
ip_tables: (C) 2000-2006 Netfilter Core Team
nf_conntrack version 0.5.0 (12288 buckets, 49152 max)
CONFIG_NF_CT_ACCT is deprecated and will be removed soon. Plase use
nf_conntrack.acct=1 kernel paramater, acct=1 nf_conntrack module option or
sysctl net.netfilter.nf_conntrack_acct=1 to enable it.
ctnetlink v0.93: registering with nfnetlink.
ClusterIP Version 0.8 loaded successfully
HTB: quantum of class 20001 is big. Consider r2q change.
BUG: unable to handle kernel NULL pointer dereference at 00000044
IP: [<c023c894>] qdisc_create+0x18f/0x1e7
*pde = 00000000 
Oops: 0000 [#1] 
Modules linked in: sch_ingress sch_htb ipt_ULOG ipt_TTL ipt_ttl ipt_REJECT ipt_REDIRECT ipt_recent ipt_NETMAP ipt_MASQUERADE ipt_LOG ipt_ECN ipt_ecn ipt_CLUSTERIP ipt_ah ipt_addrtype nf_nat_tftp nf_nat_snmp_basic nf_nat_sip nf_nat_pptp nf_nat_proto_gre nf_nat_irc nf_nat_h323 nf_nat_ftp nf_nat_amanda ts_kmp nf_conntrack_amanda nf_conntrack_sane nf_conntrack_tftp nf_conntrack_sip nf_conntrack_pptp nf_conntrack_proto_gre nf_conntrack_netlink nf_conntrack_netbios_ns nf_conntrack_irc nf_conntrack_h323 nf_conntrack_ftp xt_tcpmss xt_pkttype xt_physdev xt_owner xt_NFQUEUE xt_NFLOG xt_multiport xt_MARK xt_mark xt_mac xt_limit xt_length xt_iprange xt_helper xt_hashlimit xt_DSCP xt_dscp xt_dccp xt_conntrack xt_CONNMARK xt_connmark xt_CLASSIFY xt_tcpudp xt_state iptable_nat nf_nat nf_conntrack_ipv4 nf_conntrack iptable_mangle iptable_filter ip_tables x_tables nfnetlink ipv6 bridge stp loop floppy serio_raw i2c_viapro pcspkr i2c_core psmouse via686a amd_k7_agp button parport_pc parport shpchp pci_hotplug agpgart evdev ext3 jbd mbcache ide_cd_mod cdrom ide_disk tulip 8139too via82cxxx 8139cp mii ide_core thermal processor fan

Pid: 3011, comm: tc Not tainted (2.6.27-rc1 #1)
EIP: 0060:[<c023c894>] EFLAGS: 00010202 CPU: 0
EIP is at qdisc_create+0x18f/0x1e7
EAX: 00000040 EBX: efb9d280 ECX: 00000000 EDX: efb9d2c0
ESI: 00000000 EDI: efb9d280 EBP: f0a2f620 ESP: ef139c64
 DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 0068
Process tc (pid: 3011, ti=ef138000 task=eeea4040 task.ti=ef138000)
Stack: fffffff1 eedf197c eedf1800 00df73b4 72676e69 00737365 00000009 00000008 
       ef139cb0 eedf1800 00000000 eef0da10 c023d2e4 fffffff1 ef139cb0 ef139cd4 
       eef0da00 eec8d620 fffffff1 00000000 eef0da24 eef0da30 00000000 00000000 
Call Trace:
 [<c023d2e4>] tc_modify_qdisc+0x2ae/0x35e
 [<c023d036>] tc_modify_qdisc+0x0/0x35e
 [<c0235519>] rtnetlink_rcv_msg+0x190/0x1aa
 [<c0235389>] rtnetlink_rcv_msg+0x0/0x1aa
 [<c0240aab>] netlink_rcv_skb+0x2d/0x71
 [<c0235383>] rtnetlink_rcv+0x14/0x1a
 [<c02408db>] netlink_unicast+0x186/0x1e8
 [<c0241312>] netlink_sendmsg+0x237/0x244
 [<c0224dfa>] sock_sendmsg+0xc6/0xe0
 [<c01249d4>] autoremove_wake_function+0x0/0x2d
 [<c01249d4>] autoremove_wake_function+0x0/0x2d
 [<c022ae7e>] verify_iovec+0x3e/0x70
 [<c0224fa1>] sys_sendmsg+0x18d/0x1f0
 [<c022585f>] sys_recvmsg+0x146/0x1c8
 [<c013c501>] get_page_from_freelist+0x93/0x345
 [<c013c74c>] get_page_from_freelist+0x2de/0x345
 [<c0225f76>] sys_socketcall+0x164/0x19c
 [<c0110fb3>] do_page_fault+0x0/0x529
 [<c0103525>] sysenter_do_call+0x12/0x25
 =======================
Code: be fb fe ff 85 c0 89 c7 5e 74 0d 8b 55 34 85 d2 74 34 89 d8 ff d2 eb 2e 83 3c 24 00 74 5b 8b 54 24 04 8b 42 04 8d 53 40 83 c0 40 <8b> 48 04 89 43 40 89 50 04 89 11 89 4a 04 eb 3e 89 35 54 1e 33 
EIP: [<c023c894>] qdisc_create+0x18f/0x1e7 SS:ESP 0068:ef139c64
---[ end trace 37f0692c1922ef37 ]---

Re: Kernel oops in 2.6.27-rc1 qdisc.

[David Miller]

From: Steven Jan Springl <steven@springl.ukfsn.org>
Date: Tue, 29 Jul 2008 19:23:22 +0100

> Issuing the following command causes a kernel oops:
> 	tc qdisc add dev eth0 handle ffff: ingress
> 
> The problem is recreatable.
> The kernel is 2.6.27-rc1.
> I am using Debian etch.
> 
> The oops is attached.

Thanks for the report, I'll fix this.

Please CC: netdev on networking bug reports in the future, thanks.

Re: Kernel oops in 2.6.27-rc1 qdisc.

[David Miller]

From: Steven Jan Springl <steven@springl.ukfsn.org>
Date: Tue, 29 Jul 2008 19:23:22 +0100

> Issuing the following command causes a kernel oops:
> 	tc qdisc add dev eth0 handle ffff: ingress
> 
> The problem is recreatable.
> The kernel is 2.6.27-rc1.
> I am using Debian etch.
> 
> The oops is attached.

This will fix it, thanks for your report:

pkt_sched: Fix OOPS on ingress qdisc add.

Bug report from Steven Jan Springl:

	Issuing the following command causes a kernel oops:
		tc qdisc add dev eth0 handle ffff: ingress

The problem mostly stems from all of the special case handling of
ingress qdiscs.

So, to fix this, do the grafting operation the same way we do for TX
qdiscs.  Which means that dev_activate() and dev_deactivate() now do
the "qdisc_sleeping <--> qdisc" transitions on dev->rx_queue too.

Future simplifications are possible now, mainly because it is
impossible for dev_queue->{qdisc,qdisc_sleeping} to be NULL.  There
are NULL checks all over to handle the ingress qdisc special case
that used to exist before this commit.

Signed-off-by: David S. Miller <davem@davemloft.net>
---
 net/core/dev.c          |    4 +-
 net/sched/sch_api.c     |   57 +++++++++++++---------------------------------
 net/sched/sch_generic.c |    8 ++++--
 3 files changed, 23 insertions(+), 46 deletions(-)

diff --git a/net/core/dev.c b/net/core/dev.c
index 8d13a9b..63d6bcd 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2100,7 +2100,7 @@ static int ing_filter(struct sk_buff *skb)
 	rxq = &dev->rx_queue;
 
 	q = rxq->qdisc;
-	if (q) {
+	if (q != &noop_qdisc) {
 		spin_lock(qdisc_lock(q));
 		result = qdisc_enqueue_root(skb, q);
 		spin_unlock(qdisc_lock(q));
@@ -2113,7 +2113,7 @@ static inline struct sk_buff *handle_ing(struct sk_buff *skb,
 					 struct packet_type **pt_prev,
 					 int *ret, struct net_device *orig_dev)
 {
-	if (!skb->dev->rx_queue.qdisc)
+	if (skb->dev->rx_queue.qdisc == &noop_qdisc)
 		goto out;
 
 	if (*pt_prev) {
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index b060164..4840aff 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -572,44 +572,21 @@ static u32 qdisc_alloc_handle(struct net_device *dev)
 static struct Qdisc *dev_graft_qdisc(struct netdev_queue *dev_queue,
 				     struct Qdisc *qdisc)
 {
+	struct Qdisc *oqdisc = dev_queue->qdisc_sleeping;
 	spinlock_t *root_lock;
-	struct Qdisc *oqdisc;
-	int ingress;
-
-	ingress = 0;
-	if (qdisc && qdisc->flags&TCQ_F_INGRESS)
-		ingress = 1;
-
-	if (ingress) {
-		oqdisc = dev_queue->qdisc;
-	} else {
-		oqdisc = dev_queue->qdisc_sleeping;
-	}
 
 	root_lock = qdisc_root_lock(oqdisc);
 	spin_lock_bh(root_lock);
 
-	if (ingress) {
-		/* Prune old scheduler */
-		if (oqdisc && atomic_read(&oqdisc->refcnt) <= 1) {
-			/* delete */
-			qdisc_reset(oqdisc);
-			dev_queue->qdisc = NULL;
-		} else {  /* new */
-			dev_queue->qdisc = qdisc;
-		}
+	/* Prune old scheduler */
+	if (oqdisc && atomic_read(&oqdisc->refcnt) <= 1)
+		qdisc_reset(oqdisc);
 
-	} else {
-		/* Prune old scheduler */
-		if (oqdisc && atomic_read(&oqdisc->refcnt) <= 1)
-			qdisc_reset(oqdisc);
-
-		/* ... and graft new one */
-		if (qdisc == NULL)
-			qdisc = &noop_qdisc;
-		dev_queue->qdisc_sleeping = qdisc;
-		dev_queue->qdisc = &noop_qdisc;
-	}
+	/* ... and graft new one */
+	if (qdisc == NULL)
+		qdisc = &noop_qdisc;
+	dev_queue->qdisc_sleeping = qdisc;
+	dev_queue->qdisc = &noop_qdisc;
 
 	spin_unlock_bh(root_lock);
 
@@ -678,7 +655,8 @@ static int qdisc_graft(struct net_device *dev, struct Qdisc *parent,
 
 		ingress = 0;
 		num_q = dev->num_tx_queues;
-		if (q && q->flags & TCQ_F_INGRESS) {
+		if ((q && q->flags & TCQ_F_INGRESS) ||
+		    (new && new->flags & TCQ_F_INGRESS)) {
 			num_q = 1;
 			ingress = 1;
 		}
@@ -692,13 +670,10 @@ static int qdisc_graft(struct net_device *dev, struct Qdisc *parent,
 			if (!ingress)
 				dev_queue = netdev_get_tx_queue(dev, i);
 
-			if (ingress) {
-				old = dev_graft_qdisc(dev_queue, q);
-			} else {
-				old = dev_graft_qdisc(dev_queue, new);
-				if (new && i > 0)
-					atomic_inc(&new->refcnt);
-			}
+			old = dev_graft_qdisc(dev_queue, new);
+			if (new && i > 0)
+				atomic_inc(&new->refcnt);
+
 			notify_and_destroy(skb, n, classid, old, new);
 		}
 
@@ -817,7 +792,7 @@ qdisc_create(struct net_device *dev, struct netdev_queue *dev_queue,
 				goto err_out3;
 			}
 		}
-		if (parent)
+		if (parent && !(sch->flags & TCQ_F_INGRESS))
 			list_add_tail(&sch->list, &dev_queue->qdisc->list);
 
 		return sch;
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index fd2a6ca..345838a 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -596,7 +596,7 @@ static void transition_one_qdisc(struct net_device *dev,
 	int *need_watchdog_p = _need_watchdog;
 
 	rcu_assign_pointer(dev_queue->qdisc, new_qdisc);
-	if (new_qdisc != &noqueue_qdisc)
+	if (need_watchdog_p && new_qdisc != &noqueue_qdisc)
 		*need_watchdog_p = 1;
 }
 
@@ -619,6 +619,7 @@ void dev_activate(struct net_device *dev)
 
 	need_watchdog = 0;
 	netdev_for_each_tx_queue(dev, transition_one_qdisc, &need_watchdog);
+	transition_one_qdisc(dev, &dev->rx_queue, NULL);
 
 	if (need_watchdog) {
 		dev->trans_start = jiffies;
@@ -677,6 +678,7 @@ void dev_deactivate(struct net_device *dev)
 	bool running;
 
 	netdev_for_each_tx_queue(dev, dev_deactivate_queue, &noop_qdisc);
+	dev_deactivate_queue(dev, &dev->rx_queue, &noop_qdisc);
 
 	dev_watchdog_down(dev);
 
@@ -718,7 +720,7 @@ static void dev_init_scheduler_queue(struct net_device *dev,
 void dev_init_scheduler(struct net_device *dev)
 {
 	netdev_for_each_tx_queue(dev, dev_init_scheduler_queue, &noop_qdisc);
-	dev_init_scheduler_queue(dev, &dev->rx_queue, NULL);
+	dev_init_scheduler_queue(dev, &dev->rx_queue, &noop_qdisc);
 
 	setup_timer(&dev->watchdog_timer, dev_watchdog, (unsigned long)dev);
 }
@@ -745,6 +747,6 @@ static void shutdown_scheduler_queue(struct net_device *dev,
 void dev_shutdown(struct net_device *dev)
 {
 	netdev_for_each_tx_queue(dev, shutdown_scheduler_queue, &noop_qdisc);
-	shutdown_scheduler_queue(dev, &dev->rx_queue, NULL);
+	shutdown_scheduler_queue(dev, &dev->rx_queue, &noop_qdisc);
 	WARN_ON(timer_pending(&dev->watchdog_timer));
 }
-- 
1.5.6.GIT