2 files changed, 9 insertions, 4 deletions

diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index 754b6fe4f742..af73bc3acb40 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -227,7 +227,8 @@ static int rfcomm_check_security(struct rfcomm_dlc *d)
                 break;
         }
 
-        return hci_conn_security(conn->hcon, d->sec_level, auth_type);
+        return hci_conn_security(conn->hcon, d->sec_level, auth_type,
+                                 d->out);
 }
 
 static void rfcomm_session_timeout(unsigned long arg)
@@ -1909,10 +1910,13 @@ static struct rfcomm_session *rfcomm_process_rx(struct rfcomm_session *s)
         /* Get data directly from socket receive queue without copying it. */
         while ((skb = skb_dequeue(&sk->sk_receive_queue))) {
                 skb_orphan(skb);
-                if (!skb_linearize(skb))
+                if (!skb_linearize(skb)) {
                         s = rfcomm_recv_frame(s, skb);
-                else
+                        if (!s)
+                                break;
+                } else {
                         kfree_skb(skb);
+                }
         }
 
         if (s && (sk->sk_state == BT_CLOSED))
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index c603a5eb4720..8bbbb5ec468c 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -918,7 +918,8 @@ static int rfcomm_sock_shutdown(struct socket *sock, int how)
                 sk->sk_shutdown = SHUTDOWN_MASK;
                 __rfcomm_sock_close(sk);
 
-                if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime)
+                if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime &&
+                    !(current->flags & PF_EXITING))
                         err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime);
         }
         release_sock(sk);