diff --git a/[refs] b/[refs]
index ba6fa0e70413..5ab27a2504ce 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 7c355f532dd43036622e1880c114773463bafd23
+refs/heads/master: b00b4bf94edb42852d55619af453588b2de2dc5e
diff --git a/trunk/net/sched/sch_atm.c b/trunk/net/sched/sch_atm.c
index be7d299acd73..d1c383fca82c 100644
--- a/trunk/net/sched/sch_atm.c
+++ b/trunk/net/sched/sch_atm.c
@@ -599,6 +599,7 @@ static void atm_tc_destroy(struct Qdisc *sch)
 	/* races ? */
 	while ((flow = p->flows)) {
 		tcf_destroy_chain(flow->filter_list);
+		flow->filter_list = NULL;
 		if (flow->ref > 1)
 			printk(KERN_ERR "atm_destroy: %p->ref = %d\n",flow,
 			    flow->ref);
diff --git a/trunk/net/sched/sch_cbq.c b/trunk/net/sched/sch_cbq.c
index a294542cb8e4..ee2d5967d109 100644
--- a/trunk/net/sched/sch_cbq.c
+++ b/trunk/net/sched/sch_cbq.c
@@ -1748,10 +1748,12 @@ cbq_destroy(struct Qdisc* sch)
 	 * classes from root to leafs which means that filters can still
 	 * be bound to classes which have been destroyed already. --TGR '04
 	 */
-	for (h = 0; h < 16; h++)
-		for (cl = q->classes[h]; cl; cl = cl->next)
+	for (h = 0; h < 16; h++) {
+		for (cl = q->classes[h]; cl; cl = cl->next) {
 			tcf_destroy_chain(cl->filter_list);
-
+			cl->filter_list = NULL;
+		}
+	}
 	for (h = 0; h < 16; h++) {
 		struct cbq_class *next;