There is no dev_put ending positive SO_BINDTODEVICE call in
ax25_setsockopt and no matching dev_put later. This ref isn't used by
ax25_cb's because it's handled with up and down device events.

BTW of reported-by: Bernard Pidoux F6BVP [off-list ref]

Signed-off-by: Jarek Poplawski <redacted>
---

 net/ax25/af_ax25.c |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index fbcac76..3eee8eb 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c

@@ -663,6 +663,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname,
 
 		ax25->ax25_dev = ax25_dev_ax25dev(dev);
 		ax25_fillin_cb(ax25, ax25->ax25_dev);
+		dev_put(dev);
 		break;
 
 	default: