3 files changed, 15 insertions, 0 deletions

diff --git a/net/nfc/llcp.h b/net/nfc/llcp.h
index ac16ebe3069d..71f649e5ef49 100644
--- a/net/nfc/llcp.h
+++ b/net/nfc/llcp.h
@@ -19,6 +19,7 @@
 
 enum llcp_state {
         LLCP_CONNECTED = 1, /* wait_for_packet() wants that */
+        LLCP_DISCONNECTING,
         LLCP_CLOSED,
         LLCP_BOUND,
         LLCP_LISTEN,
diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c
index 158bdbf668cc..1c4c048e0a1b 100644
--- a/net/nfc/llcp_core.c
+++ b/net/nfc/llcp_core.c
@@ -730,6 +730,13 @@ static void nfc_llcp_tx_work(struct work_struct *work)
                                        DUMP_PREFIX_OFFSET, 16, 1,
                                        skb->data, skb->len, true);
 
+                        if (ptype == LLCP_PDU_DISC && sk != NULL &&
+                            sk->sk_state == LLCP_DISCONNECTING) {
+                                nfc_llcp_sock_unlink(&local->sockets, sk);
+                                sock_orphan(sk);
+                                sock_put(sk);
+                        }
+
                         if (ptype == LLCP_PDU_I)
                                 copy_skb = skb_copy(skb, GFP_ATOMIC);
 
diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c
index 03fd3162cee5..47e7acfc0236 100644
--- a/net/nfc/llcp_sock.c
+++ b/net/nfc/llcp_sock.c
@@ -626,6 +626,13 @@ static int llcp_sock_release(struct socket *sock)
 
         release_sock(sk);
 
+        /* Keep this sock alive and therefore do not remove it from the sockets
+         * list until the DISC PDU has been actually sent. Otherwise we would
+         * reply with DM PDUs before sending the DISC one.
+         */
+        if (sk->sk_state == LLCP_DISCONNECTING)
+                return err;
+
         if (sock->type == SOCK_RAW)
                 nfc_llcp_sock_unlink(&local->raw_sockets, sk);
         else