2 files changed, 29 insertions, 11 deletions

diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 55534244c3a..15f40ea8d54 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -866,8 +866,16 @@ static inline void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *s
         hci_dev_lock(hdev);
 
         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
-        if (!conn)
-                goto unlock;
+        if (!conn) {
+                if (ev->link_type != SCO_LINK)
+                        goto unlock;
+
+                conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
+                if (!conn)
+                        goto unlock;
+
+                conn->type = SCO_LINK;
+        }
 
         if (!ev->status) {
                 conn->handle = __le16_to_cpu(ev->handle);
@@ -1646,20 +1654,28 @@ static inline void hci_sync_conn_complete_evt(struct hci_dev *hdev, struct sk_bu
                 conn->type = SCO_LINK;
         }
 
-        if (conn->out && ev->status == 0x1c && conn->attempt < 2) {
-                conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
-                                        (hdev->esco_type & EDR_ESCO_MASK);
-                hci_setup_sync(conn, conn->link->handle);
-                goto unlock;
-        }
-
-        if (!ev->status) {
+        switch (ev->status) {
+        case 0x00:
                 conn->handle = __le16_to_cpu(ev->handle);
                 conn->state  = BT_CONNECTED;
 
                 hci_conn_add_sysfs(conn);
-        } else
+                break;
+
+        case 0x1c:      /* SCO interval rejected */
+        case 0x1f:      /* Unspecified error */
+                if (conn->out && conn->attempt < 2) {
+                        conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
+                                        (hdev->esco_type & EDR_ESCO_MASK);
+                        hci_setup_sync(conn, conn->link->handle);
+                        goto unlock;
+                }
+                /* fall through */
+
+        default:
                 conn->state = BT_CLOSED;
+                break;
+        }
 
         hci_proto_connect_cfm(conn, ev->status);
         if (ev->status)
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index 1d0fb0f23c6..374536e050a 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -1194,6 +1194,8 @@ void rfcomm_dlc_accept(struct rfcomm_dlc *d)
 
         rfcomm_send_ua(d->session, d->dlci);
 
+        rfcomm_dlc_clear_timer(d);
+
         rfcomm_dlc_lock(d);
         d->state = BT_CONNECTED;
         d->state_change(d, 0);