--- /dev/null
+--- a/kernel/net/netfilter/ipset/ip_set_core.c
++++ b/kernel/net/netfilter/ipset/ip_set_core.c
+@@ -27,6 +27,13 @@
+ #include <linux/netfilter/nfnetlink.h>
+ #include <linux/netfilter/ipset/ip_set.h>
+
++#ifndef IPSET_IN_KERNEL_TREE
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 9, 0)
++#define nfnl_unlock() nfnl_unlock(NFNL_SUBSYS_IPSET)
++#define nfnl_lock() nfnl_lock(NFNL_SUBSYS_IPSET)
++#endif
++#endif
++
+ static LIST_HEAD(ip_set_type_list); /* all registered set types */
+ static DEFINE_MUTEX(ip_set_type_mutex); /* protects ip_set_type_list */
+ static DEFINE_RWLOCK(ip_set_ref_lock); /* protects the set refs */