3 files changed, 8 insertions, 7 deletions

diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index d65db459c843..f57fab04e7c5 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -811,6 +811,6 @@ void l2cap_send_conn_req(struct l2cap_chan *chan);
 void l2cap_move_start(struct l2cap_chan *chan);
 void l2cap_logical_cfm(struct l2cap_chan *chan, struct hci_chan *hchan,
                        u8 status);
-void l2cap_physical_cfm(struct l2cap_chan *chan, int result);
+void __l2cap_physical_cfm(struct l2cap_chan *chan, int result);
 
 #endif /* __L2CAP_H */
diff --git a/net/bluetooth/amp.c b/net/bluetooth/amp.c
index 4b2fea6c1c2a..eaf473ffeef9 100644
--- a/net/bluetooth/amp.c
+++ b/net/bluetooth/amp.c
@@ -386,13 +386,17 @@ void amp_physical_cfm(struct hci_conn *bredr_hcon, struct hci_conn *hs_hcon)
 
         bredr_chan = mgr->bredr_chan;
 
+        l2cap_chan_lock(bredr_chan);
+
         set_bit(FLAG_EFS_ENABLE, &bredr_chan->flags);
         bredr_chan->remote_amp_id = hs_hcon->remote_id;
         bredr_chan->hs_hcon = hs_hcon;
         bredr_chan->conn->mtu = hs_hcon->hdev->block_mtu;
         bredr_chan->fcs = L2CAP_FCS_NONE;
 
-        l2cap_physical_cfm(bredr_chan, 0);
+        __l2cap_physical_cfm(bredr_chan, 0);
+
+        l2cap_chan_unlock(bredr_chan);
 
         hci_dev_put(bredr_hdev);
 }
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index e4f52a7f08c6..22c4ef926b0d 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -4611,7 +4611,8 @@ static void l2cap_do_move_cancel(struct l2cap_chan *chan, int result)
         l2cap_ertm_send(chan);
 }
 
-void l2cap_physical_cfm(struct l2cap_chan *chan, int result)
+/* Invoke with locked chan */
+void __l2cap_physical_cfm(struct l2cap_chan *chan, int result)
 {
         u8 local_amp_id = chan->local_amp_id;
         u8 remote_amp_id = chan->remote_amp_id;
@@ -4619,8 +4620,6 @@ void l2cap_physical_cfm(struct l2cap_chan *chan, int result)
         BT_DBG("chan %p, result %d, local_amp_id %d, remote_amp_id %d",
                chan, result, local_amp_id, remote_amp_id);
 
-        l2cap_chan_lock(chan);
-
         if (chan->state == BT_DISCONN || chan->state == BT_CLOSED) {
                 l2cap_chan_unlock(chan);
                 return;
@@ -4644,8 +4643,6 @@ void l2cap_physical_cfm(struct l2cap_chan *chan, int result)
                         break;
                 }
         }
-
-        l2cap_chan_unlock(chan);
 }
 
 static inline int l2cap_move_channel_req(struct l2cap_conn *conn,