diff --git a/[refs] b/[refs]
index 6312dc8b6e72..36fc434c7662 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 77f918bc7babb8473933ca0a6deefc64fe24b06c
+refs/heads/master: 09bfb2ee52a66845bbefad0b6eaeae1b5adea949
diff --git a/trunk/net/bluetooth/l2cap_core.c b/trunk/net/bluetooth/l2cap_core.c
index 778ceb2b8402..6773453927ef 100644
--- a/trunk/net/bluetooth/l2cap_core.c
+++ b/trunk/net/bluetooth/l2cap_core.c
@@ -1996,6 +1996,8 @@ static void l2cap_ack_timeout(struct work_struct *work)
 	lock_sock(chan->sk);
 	__l2cap_send_ack(chan);
 	release_sock(chan->sk);
+
+	l2cap_chan_put(chan);
 }
 
 static inline void l2cap_ertm_init(struct l2cap_chan *chan)