2 files changed, 7 insertions, 4 deletions

diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c
index b1f2ace96f..f402894d7e 100644
--- a/net/netfilter/nf_queue.c
+++ b/net/netfilter/nf_queue.c
@@ -44,12 +44,17 @@ int nf_register_queue_handler(int pf, struct nf_queue_handler *qh)
 EXPORT_SYMBOL(nf_register_queue_handler);
 
 /* The caller must flush their queue before this */
-int nf_unregister_queue_handler(int pf)
+int nf_unregister_queue_handler(int pf, struct nf_queue_handler *qh)
 {
         if (pf >= NPROTO)
                 return -EINVAL;
 
         write_lock_bh(&queue_handler_lock);
+        if (queue_handler[pf] != qh) {
+                write_unlock_bh(&queue_handler_lock);
+                return -EINVAL;
+        }
+
         queue_handler[pf] = NULL;
         write_unlock_bh(&queue_handler_lock);
 
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index 7a97bec677..7d47fc4b19 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -913,9 +913,7 @@ nfqnl_recv_config(struct sock *ctnl, struct sk_buff *skb,
                 case NFQNL_CFG_CMD_PF_UNBIND:
                         QDEBUG("unregistering queue handler for pf=%u\n",
                                 ntohs(cmd->pf));
-                        /* This is a bug and a feature.  We can unregister
-                         * other handlers(!) */
-                        ret = nf_unregister_queue_handler(ntohs(cmd->pf));
+                        ret = nf_unregister_queue_handler(ntohs(cmd->pf), &nfqh);
                         break;
                 default:
                         ret = -EINVAL;