2 files changed, 19 insertions, 1 deletions

diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c
index cad510309dcf..17f7fb720553 100644
--- a/net/bluetooth/hci_sysfs.c
+++ b/net/bluetooth/hci_sysfs.c
@@ -316,9 +316,26 @@ void hci_conn_add_sysfs(struct hci_conn *conn)
         schedule_work(&conn->work);
 }
 
+static int __match_tty(struct device *dev, void *data)
+{
+        /* The rfcomm tty device will possibly retain even when conn
+         * is down, and sysfs doesn't support move zombie device,
+         * so we should move the device before conn device is destroyed.
+         * Due to the only child device of hci_conn dev is rfcomm
+         * tty_dev, here just return 1
+         */
+        return 1;
+}
+
 static void del_conn(struct work_struct *work)
 {
+        struct device *dev;
         struct hci_conn *conn = container_of(work, struct hci_conn, work);
+
+        while (dev = device_find_child(&conn->dev, NULL, __match_tty)) {
+                device_move(dev, NULL);
+                put_device(dev);
+        }
         device_del(&conn->dev);
         put_device(&conn->dev);
 }
diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
index a6a758dd1f7d..788c70321858 100644
--- a/net/bluetooth/rfcomm/tty.c
+++ b/net/bluetooth/rfcomm/tty.c
@@ -696,7 +696,8 @@ static void rfcomm_tty_close(struct tty_struct *tty, struct file *filp)
         BT_DBG("tty %p dev %p dlc %p opened %d", tty, dev, dev->dlc, dev->opened);
 
         if (--dev->opened == 0) {
-                device_move(dev->tty_dev, NULL);
+                if (dev->tty_dev->parent)
+                        device_move(dev->tty_dev, NULL);
 
                 /* Close DLC and dettach TTY */
                 rfcomm_dlc_close(dev->dlc, 0);