From 31e684608a9481c8261e389a888a599c71fee187 Mon Sep 17 00:00:00 2001
From: Yasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp>
Date: Sat, 7 Jul 2007 22:40:08 -0700
Subject: [PATCH] --- yaml --- r: 59011 b: refs/heads/master c:
 ce7663d84a87bb4e1743f62950bf7dceed723a13 h: refs/heads/master i:   59009:
 99b515329ce194b73ba07f83f2c0f939692e3b7c   59007:
 ac4f56acf1bbfc42bd5bcd2f4316e19b82c0576d v: v3

---
 [refs]                                | 2 +-
 trunk/include/linux/netfilter.h       | 3 ++-
 trunk/net/netfilter/nf_queue.c        | 7 ++++++-
 trunk/net/netfilter/nfnetlink_queue.c | 4 +---
 4 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/[refs] b/[refs]
index 24b65a0e2fc0..86a5f26d2deb 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 0d53778e81ac7af266dac8a20cc328328c327112
+refs/heads/master: ce7663d84a87bb4e1743f62950bf7dceed723a13
diff --git a/trunk/include/linux/netfilter.h b/trunk/include/linux/netfilter.h
index 10b5c6275706..0eed0b7ab2df 100644
--- a/trunk/include/linux/netfilter.h
+++ b/trunk/include/linux/netfilter.h
@@ -275,7 +275,8 @@ struct nf_queue_handler {
 };
 extern int nf_register_queue_handler(int pf, 
                                      struct nf_queue_handler *qh);
-extern int nf_unregister_queue_handler(int pf);
+extern int nf_unregister_queue_handler(int pf,
+				       struct nf_queue_handler *qh);
 extern void nf_unregister_queue_handlers(struct nf_queue_handler *qh);
 extern void nf_reinject(struct sk_buff *skb,
 			struct nf_info *info,
diff --git a/trunk/net/netfilter/nf_queue.c b/trunk/net/netfilter/nf_queue.c
index b1f2ace96f6d..f402894d7e72 100644
--- a/trunk/net/netfilter/nf_queue.c
+++ b/trunk/net/netfilter/nf_queue.c
@@ -44,12 +44,17 @@ int nf_register_queue_handler(int pf, struct nf_queue_handler *qh)
 EXPORT_SYMBOL(nf_register_queue_handler);
 
 /* The caller must flush their queue before this */
-int nf_unregister_queue_handler(int pf)
+int nf_unregister_queue_handler(int pf, struct nf_queue_handler *qh)
 {
 	if (pf >= NPROTO)
 		return -EINVAL;
 
 	write_lock_bh(&queue_handler_lock);
+	if (queue_handler[pf] != qh) {
+		write_unlock_bh(&queue_handler_lock);
+		return -EINVAL;
+	}
+
 	queue_handler[pf] = NULL;
 	write_unlock_bh(&queue_handler_lock);
 
diff --git a/trunk/net/netfilter/nfnetlink_queue.c b/trunk/net/netfilter/nfnetlink_queue.c
index 7a97bec67729..7d47fc4b19c6 100644
--- a/trunk/net/netfilter/nfnetlink_queue.c
+++ b/trunk/net/netfilter/nfnetlink_queue.c
@@ -913,9 +913,7 @@ nfqnl_recv_config(struct sock *ctnl, struct sk_buff *skb,
 		case NFQNL_CFG_CMD_PF_UNBIND:
 			QDEBUG("unregistering queue handler for pf=%u\n",
 				ntohs(cmd->pf));
-			/* This is a bug and a feature.  We can unregister
-			 * other handlers(!) */
-			ret = nf_unregister_queue_handler(ntohs(cmd->pf));
+			ret = nf_unregister_queue_handler(ntohs(cmd->pf), &nfqh);
 			break;
 		default:
 			ret = -EINVAL;