The wireless tree has commit 5e25f6b1b18d ("wifi: nl80211: fix ERR_PTR use on wdev disappearance"), which returns right away when __nl80211_lock_held_wdev() fails. wireless-next changed the same lines in commit a357675fd740 ("wifi: cfg80211: enable context analysis") and still jumps to out_err there. The merge kept the wireless-next version. That is a double put: the helper has already dropped the wdev reference by the time it fails, and out_err drops it again. Just return the error, like the wireless fix does. Fixes: cf03388aa81e ("Merge branch 'for-next' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next.git") Link: https://lore.kernel.org/all/avNx0gmZTCIjln1Y@sirena.org.uk/ Signed-off-by: Sasha Levin --- Mark, this is against next-20261110. Please fold it into the wireless-next merge. Johannes, wireless-next has the same double put on its own until wireless gets merged into it. Found by comparing with our llminus-assisted integration tree. Build tested only. net/wireless/nl80211.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index d695040cc85cb..8a5c9dd9d0dba 100644 --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -9079,7 +9079,7 @@ static int nl80211_dump_station(struct sk_buff *skb, err = __nl80211_lock_held_wdev(rdev, netns, wdev); if (err) - goto out_err; + return err; /* try again locked now */ locked = true; base-commit: 793807ca13bf3072fc6d16ce6d90e9ab9beff2a5 -- 2.53.0