1 files changed, 7 insertions, 3 deletions

diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index 754b6fe4f742..af73bc3acb40 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -227,7 +227,8 @@ static int rfcomm_check_security(struct rfcomm_dlc *d)
                 break;
         }
 
-        return hci_conn_security(conn->hcon, d->sec_level, auth_type);
+        return hci_conn_security(conn->hcon, d->sec_level, auth_type,
+                                 d->out);
 }
 
 static void rfcomm_session_timeout(unsigned long arg)
@@ -1909,10 +1910,13 @@ static struct rfcomm_session *rfcomm_process_rx(struct rfcomm_session *s)
         /* Get data directly from socket receive queue without copying it. */
         while ((skb = skb_dequeue(&sk->sk_receive_queue))) {
                 skb_orphan(skb);
-                if (!skb_linearize(skb))
+                if (!skb_linearize(skb)) {
                         s = rfcomm_recv_frame(s, skb);
-                else
+                        if (!s)
+                                break;
+                } else {
                         kfree_skb(skb);
+                }
         }
 
         if (s && (sk->sk_state == BT_CLOSED))