diff --git a/[refs] b/[refs]
index 31acc3f07ee6..a494885dd608 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 812e737e29a1d559e7bfbea675fdcfcbad9f5e1f
+refs/heads/master: 3b1a9f3fa6ad842991538da2c3b2e29e047b131f
diff --git a/trunk/net/bluetooth/l2cap.c b/trunk/net/bluetooth/l2cap.c
index 042fd967e79c..187f46dd8309 100644
--- a/trunk/net/bluetooth/l2cap.c
+++ b/trunk/net/bluetooth/l2cap.c
@@ -3542,7 +3542,9 @@ static inline int l2cap_data_channel_iframe(struct sock *sk, u16 rx_control, str
 	pi->expected_tx_seq = (pi->expected_tx_seq + 1) % 64;
 
 	if (pi->conn_state & L2CAP_CONN_SREJ_SENT) {
-		l2cap_add_to_srej_queue(sk, skb, tx_seq, sar);
+		bt_cb(skb)->tx_seq = tx_seq;
+		bt_cb(skb)->sar = sar;
+		__skb_queue_tail(SREJ_QUEUE(sk), skb);
 		return 0;
 	}