2 files changed, 31 insertions, 4 deletions

diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 7e9515b41cc0..90e3a285a17e 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -84,6 +84,20 @@ static void hci_acl_connect(struct hci_conn *conn)
         hci_send_cmd(hdev, OGF_LINK_CTL, OCF_CREATE_CONN, sizeof(cp), &cp);
 }
 
+static void hci_acl_connect_cancel(struct hci_conn *conn)
+{
+        struct hci_cp_create_conn_cancel cp;
+
+        BT_DBG("%p", conn);
+
+        if (conn->hdev->hci_ver < 2)
+                return;
+
+        bacpy(&cp.bdaddr, &conn->dst);
+        hci_send_cmd(conn->hdev, OGF_LINK_CTL,
+                                OCF_CREATE_CONN_CANCEL, sizeof(cp), &cp);
+}
+
 void hci_acl_disconn(struct hci_conn *conn, __u8 reason)
 {
         struct hci_cp_disconnect cp;
@@ -94,7 +108,8 @@ void hci_acl_disconn(struct hci_conn *conn, __u8 reason)
 
         cp.handle = __cpu_to_le16(conn->handle);
         cp.reason = reason;
-        hci_send_cmd(conn->hdev, OGF_LINK_CTL, OCF_DISCONNECT, sizeof(cp), &cp);
+        hci_send_cmd(conn->hdev, OGF_LINK_CTL,
+                                OCF_DISCONNECT, sizeof(cp), &cp);
 }
 
 void hci_add_sco(struct hci_conn *conn, __u16 handle)
@@ -124,12 +139,20 @@ static void hci_conn_timeout(unsigned long arg)
                 return;
 
         hci_dev_lock(hdev);
-        if (conn->state == BT_CONNECTED)
+
+        switch (conn->state) {
+        case BT_CONNECT:
+                hci_acl_connect_cancel(conn);
+                break;
+        case BT_CONNECTED:
                 hci_acl_disconn(conn, 0x13);
-        else
+                break;
+        default:
                 conn->state = BT_CLOSED;
+                break;
+        }
+
         hci_dev_unlock(hdev);
-        return;
 }
 
 static void hci_conn_idle(unsigned long arg)
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 7518bdbf34cd..bb25484b8747 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -750,6 +750,8 @@ static inline void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *s
                 if (test_bit(HCI_ENCRYPT, &hdev->flags))
                         conn->link_mode |= HCI_LM_ENCRYPT;
 
+                hci_conn_hold(conn);
+
                 /* Get remote features */
                 if (conn->type == ACL_LINK) {
                         struct hci_cp_read_remote_features cp;
@@ -778,6 +780,8 @@ static inline void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *s
                         hci_send_cmd(hdev, OGF_LINK_CTL,
                                 OCF_CHANGE_CONN_PTYPE, sizeof(cp), &cp);
                 }
+
+                hci_conn_put(conn);
         } else
                 conn->state = BT_CLOSED;