diff --git a/[refs] b/[refs]
index b4574f381651..2ce2b0fcdd90 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 2f3b89a1fe0823fceb544856c9eeb036a75ff091
+refs/heads/master: a0143efa96671dc51dab9bba776a66f9bfa1757f
diff --git a/trunk/net/sched/sch_qfq.c b/trunk/net/sched/sch_qfq.c
index 8c5172c7f193..c34af93ddfe2 100644
--- a/trunk/net/sched/sch_qfq.c
+++ b/trunk/net/sched/sch_qfq.c
@@ -1068,7 +1068,15 @@ static struct sk_buff *qfq_dequeue(struct Qdisc *sch)
 	qdisc_bstats_update(sch, skb);
 
 	agg_dequeue(in_serv_agg, cl, len);
-	in_serv_agg->budget -= len;
+	/* If lmax is lowered, through qfq_change_class, for a class
+	 * owning pending packets with larger size than the new value
+	 * of lmax, then the following condition may hold.
+	 */
+	if (unlikely(in_serv_agg->budget < len))
+		in_serv_agg->budget = 0;
+	else
+		in_serv_agg->budget -= len;
+
 	q->V += (u64)len * IWSUM;
 	pr_debug("qfq dequeue: len %u F %lld now %lld\n",
 		 len, (unsigned long long) in_serv_agg->F,