3 files changed, 35 insertions, 4 deletions

diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index b50dabb3f86a..faff6247ac8f 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -589,6 +589,14 @@ EXPORT_SYMBOL(hci_get_route);
 void hci_le_conn_failed(struct hci_conn *conn, u8 status)
 {
         struct hci_dev *hdev = conn->hdev;
+        struct hci_conn_params *params;
+
+        params = hci_pend_le_action_lookup(&hdev->pend_le_conns, &conn->dst,
+                                           conn->dst_type);
+        if (params && params->conn) {
+                hci_conn_drop(params->conn);
+                params->conn = NULL;
+        }
 
         conn->state = BT_CLOSED;
 
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index abeb5e47311e..9b7145959a49 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -2538,8 +2538,13 @@ static void hci_pend_le_actions_clear(struct hci_dev *hdev)
 {
         struct hci_conn_params *p;
 
-        list_for_each_entry(p, &hdev->le_conn_params, list)
+        list_for_each_entry(p, &hdev->le_conn_params, list) {
+                if (p->conn) {
+                        hci_conn_drop(p->conn);
+                        p->conn = NULL;
+                }
                 list_del_init(&p->action);
+        }
 
         BT_DBG("All LE pending actions cleared");
 }
@@ -2580,8 +2585,8 @@ static int hci_dev_do_close(struct hci_dev *hdev)
 
         hci_dev_lock(hdev);
         hci_inquiry_cache_flush(hdev);
-        hci_conn_hash_flush(hdev);
         hci_pend_le_actions_clear(hdev);
+        hci_conn_hash_flush(hdev);
         hci_dev_unlock(hdev);
 
         hci_notify(hdev, HCI_DEV_DOWN);
@@ -3729,6 +3734,9 @@ void hci_conn_params_del(struct hci_dev *hdev, bdaddr_t *addr, u8 addr_type)
         if (!params)
                 return;
 
+        if (params->conn)
+                hci_conn_drop(params->conn);
+
         list_del(&params->action);
         list_del(&params->list);
         kfree(params);
@@ -3759,6 +3767,8 @@ void hci_conn_params_clear_all(struct hci_dev *hdev)
         struct hci_conn_params *params, *tmp;
 
         list_for_each_entry_safe(params, tmp, &hdev->le_conn_params, list) {
+                if (params->conn)
+                        hci_conn_drop(params->conn);
                 list_del(&params->action);
                 list_del(&params->list);
                 kfree(params);
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index da7ab6b9bb69..3a99f30a3317 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -4226,8 +4226,13 @@ static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
         hci_proto_connect_cfm(conn, ev->status);
 
         params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
-        if (params)
+        if (params) {
                 list_del_init(&params->action);
+                if (params->conn) {
+                        hci_conn_drop(params->conn);
+                        params->conn = NULL;
+                }
+        }
 
 unlock:
         hci_update_background_scan(hdev);
@@ -4309,8 +4314,16 @@ static void check_pending_le_conn(struct hci_dev *hdev, bdaddr_t *addr,
 
         conn = hci_connect_le(hdev, addr, addr_type, BT_SECURITY_LOW,
                               HCI_LE_AUTOCONN_TIMEOUT, HCI_ROLE_MASTER);
-        if (!IS_ERR(conn))
+        if (!IS_ERR(conn)) {
+                /* Store the pointer since we don't really have any
+                 * other owner of the object besides the params that
+                 * triggered it. This way we can abort the connection if
+                 * the parameters get removed and keep the reference
+                 * count consistent once the connection is established.
+                 */
+                params->conn = conn;
                 return;
+        }
 
         switch (PTR_ERR(conn)) {
         case -EBUSY: