diff --git a/[refs] b/[refs]
index 0042c3216d5f..09ccaf87d0c8 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 8763b4da41132e2d5a896cd5e629c3c0a652205e
+refs/heads/master: 6994ca5e8ade57d18b7d1e05aad040c441a2ad37
diff --git a/trunk/net/bluetooth/mgmt.c b/trunk/net/bluetooth/mgmt.c
index 0054c74e27b7..4476d8e3c0f2 100644
--- a/trunk/net/bluetooth/mgmt.c
+++ b/trunk/net/bluetooth/mgmt.c
@@ -1230,6 +1230,8 @@ static int user_confirm_reply(struct sock *sk, u16 index, unsigned char *data,
 	if (!hdev)
 		return cmd_status(sk, index, mgmt_op, ENODEV);
 
+	hci_dev_lock_bh(hdev);
+
 	if (!test_bit(HCI_UP, &hdev->flags)) {
 		err = cmd_status(sk, index, mgmt_op, ENETDOWN);
 		goto failed;