diff --git a/[refs] b/[refs]
index 7bb7c4292a64..6d0551567add 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 27d1cba21fcc50c37eef5042c6be9fa7135e88fc
+refs/heads/master: ecd2ebdea350c40e73c00d400d74c8a09c072082
diff --git a/trunk/net/ax25/af_ax25.c b/trunk/net/ax25/af_ax25.c
index ecb14ee00498..b4725ff317c0 100644
--- a/trunk/net/ax25/af_ax25.c
+++ b/trunk/net/ax25/af_ax25.c
@@ -87,10 +87,22 @@ static void ax25_kill_by_device(struct net_device *dev)
 		return;
 
 	spin_lock_bh(&ax25_list_lock);
+again:
 	ax25_for_each(s, node, &ax25_list) {
 		if (s->ax25_dev == ax25_dev) {
 			s->ax25_dev = NULL;
+			spin_unlock_bh(&ax25_list_lock);
 			ax25_disconnect(s, ENETUNREACH);
+			spin_lock_bh(&ax25_list_lock);
+
+			/* The entry could have been deleted from the
+			 * list meanwhile and thus the next pointer is
+			 * no longer valid.  Play it safe and restart
+			 * the scan.  Forward progress is ensured
+			 * because we set s->ax25_dev to NULL and we
+			 * are never passed a NULL 'dev' argument.
+			 */
+			goto again;
 		}
 	}
 	spin_unlock_bh(&ax25_list_lock);