1 files changed, 9 insertions, 5 deletions

diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index b9517bd17190..96887ae8375b 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -141,10 +141,11 @@ int hci_disconnect(struct hci_conn *conn, __u8 reason)
          */
         if (conn->type == ACL_LINK && conn->role == HCI_ROLE_MASTER) {
                 struct hci_dev *hdev = conn->hdev;
-                struct hci_cp_read_clock_offset cp;
+                struct hci_cp_read_clock_offset clkoff_cp;
 
-                cp.handle = cpu_to_le16(conn->handle);
-                hci_send_cmd(hdev, HCI_OP_READ_CLOCK_OFFSET, sizeof(cp), &cp);
+                clkoff_cp.handle = cpu_to_le16(conn->handle);
+                hci_send_cmd(hdev, HCI_OP_READ_CLOCK_OFFSET, sizeof(clkoff_cp),
+                             &clkoff_cp);
         }
 
         conn->state = BT_DISCONN;
@@ -415,7 +416,7 @@ static void le_conn_timeout(struct work_struct *work)
          * happen with broken hardware or if low duty cycle was used
          * (which doesn't have a timeout of its own).
          */
-        if (test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
+        if (conn->role == HCI_ROLE_SLAVE) {
                 u8 enable = 0x00;
                 hci_send_cmd(hdev, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable),
                              &enable);
@@ -517,7 +518,7 @@ int hci_conn_del(struct hci_conn *conn)
                 /* Unacked frames */
                 hdev->acl_cnt += conn->sent;
         } else if (conn->type == LE_LINK) {
-                cancel_delayed_work_sync(&conn->le_conn_timeout);
+                cancel_delayed_work(&conn->le_conn_timeout);
 
                 if (hdev->le_pkts)
                         hdev->le_cnt += conn->sent;
@@ -544,6 +545,9 @@ int hci_conn_del(struct hci_conn *conn)
 
         hci_conn_del_sysfs(conn);
 
+        if (test_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags))
+                hci_conn_params_del(conn->hdev, &conn->dst, conn->dst_type);
+
         hci_dev_put(hdev);
 
         hci_conn_put(conn);