1 files changed, 5 insertions, 0 deletions

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index d3b5d6489a80..7264119b64a6 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -236,6 +236,10 @@ void l2cap_chan_del(struct l2cap_chan *chan, int err)
         } else
                 sk->sk_state_change(sk);
 
+        if (!(l2cap_pi(sk)->conf_state & L2CAP_CONF_OUTPUT_DONE &&
+                        l2cap_pi(sk)->conf_state & L2CAP_CONF_INPUT_DONE))
+                goto free;
+
         skb_queue_purge(TX_QUEUE(sk));
 
         if (l2cap_pi(sk)->mode == L2CAP_MODE_ERTM) {
@@ -254,6 +258,7 @@ void l2cap_chan_del(struct l2cap_chan *chan, int err)
                 }
         }
 
+free:
         kfree(chan);
 }