1 files changed, 11 insertions, 2 deletions

diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index e9ac9fb11917..f3869857ee9f 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -3499,8 +3499,17 @@ static inline void l2cap_data_channel_rrframe(struct sock *sk, u16 rx_control)
         l2cap_drop_acked_frames(sk);
 
         if (rx_control & L2CAP_CTRL_POLL) {
-                l2cap_send_i_or_rr_or_rnr(sk);
-                pi->conn_state &= ~L2CAP_CONN_REMOTE_BUSY;
+                if (pi->conn_state & L2CAP_CONN_SREJ_SENT) {
+                        if ((pi->conn_state & L2CAP_CONN_REMOTE_BUSY) &&
+                                        (pi->unacked_frames > 0))
+                                __mod_retrans_timer();
+
+                        pi->conn_state &= ~L2CAP_CONN_REMOTE_BUSY;
+                        l2cap_send_srejtail(sk);
+                } else {
+                        l2cap_send_i_or_rr_or_rnr(sk);
+                        pi->conn_state &= ~L2CAP_CONN_REMOTE_BUSY;
+                }
 
         } else if (rx_control & L2CAP_CTRL_FINAL) {
                 pi->conn_state &= ~L2CAP_CONN_REMOTE_BUSY;