3 files changed, 19 insertions, 2 deletions

diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index cedda399f9c0..1558eccb19db 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -711,6 +711,7 @@ enum {
         FLAG_DEFER_SETUP,
         FLAG_LE_CONN_REQ_SENT,
         FLAG_PENDING_SECURITY,
+        FLAG_HOLD_HCI_CONN,
 };
 
 enum {
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 777c41dbfdbe..a6559225bb50 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -546,7 +546,10 @@ void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
 
         l2cap_chan_hold(chan);
 
-        hci_conn_hold(conn->hcon);
+        /* Only keep a reference for fixed channels if they requested it */
+        if (chan->chan_type != L2CAP_CHAN_FIXED ||
+            test_bit(FLAG_HOLD_HCI_CONN, &chan->flags))
+                hci_conn_hold(conn->hcon);
 
         list_add(&chan->list, &conn->chan_l);
 }
@@ -577,7 +580,12 @@ void l2cap_chan_del(struct l2cap_chan *chan, int err)
 
                 chan->conn = NULL;
 
-                if (chan->scid != L2CAP_CID_A2MP)
+                /* Reference was only held for non-fixed channels or
+                 * fixed channels that explicitly requested it using the
+                 * FLAG_HOLD_HCI_CONN flag.
+                 */
+                if (chan->chan_type != L2CAP_CHAN_FIXED ||
+                    test_bit(FLAG_HOLD_HCI_CONN, &chan->flags))
                         hci_conn_drop(conn->hcon);
 
                 if (mgr && mgr->bredr_chan == chan)
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index ed06f88e6f10..31f106e61ca2 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -146,6 +146,14 @@ static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
         case L2CAP_CHAN_RAW:
                 chan->sec_level = BT_SECURITY_SDP;
                 break;
+        case L2CAP_CHAN_FIXED:
+                /* Fixed channels default to the L2CAP core not holding a
+                 * hci_conn reference for them. For fixed channels mapping to
+                 * L2CAP sockets we do want to hold a reference so set the
+                 * appropriate flag to request it.
+                 */
+                set_bit(FLAG_HOLD_HCI_CONN, &chan->flags);
+                break;
         }
 
         bacpy(&chan->src, &la.l2_bdaddr);