diff --git a/[refs] b/[refs]
index 24c103823e91..d80f185a9123 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 926e61b7c44db83013159ac2f74bccd451607b5a
+refs/heads/master: 7c64b9f3f584008000cf3b960f25cd6a68fce191
diff --git a/trunk/net/sched/sch_api.c b/trunk/net/sched/sch_api.c
index 1367aa21fad5..903e4188b6ca 100644
--- a/trunk/net/sched/sch_api.c
+++ b/trunk/net/sched/sch_api.c
@@ -809,7 +809,7 @@ qdisc_create(struct net_device *dev, struct netdev_queue *dev_queue,
 			stab = qdisc_get_stab(tca[TCA_STAB]);
 			if (IS_ERR(stab)) {
 				err = PTR_ERR(stab);
-				goto err_out3;
+				goto err_out4;
 			}
 			sch->stab = stab;
 		}
@@ -838,7 +838,6 @@ qdisc_create(struct net_device *dev, struct netdev_queue *dev_queue,
 		return sch;
 	}
 err_out3:
-	qdisc_put_stab(sch->stab);
 	dev_put(dev);
 	kfree((char *) sch - sch->padded);
 err_out2:
@@ -852,6 +851,7 @@ qdisc_create(struct net_device *dev, struct netdev_queue *dev_queue,
 	 * Any broken qdiscs that would require a ops->reset() here?
 	 * The qdisc was never in action so it shouldn't be necessary.
 	 */
+	qdisc_put_stab(sch->stab);
 	if (ops->destroy)
 		ops->destroy(sch);
 	goto err_out3;