2 files changed, 1 insertions, 6 deletions

diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index 0c2c93735e93..eb62558e9b09 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -423,8 +423,8 @@ static int __rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
 
                 rfcomm_dlc_lock(d);
                 d->state = BT_CLOSED;
-                d->state_change(d, err);
                 rfcomm_dlc_unlock(d);
+                d->state_change(d, err);
 
                 skb_queue_purge(&d->tx_queue);
                 rfcomm_dlc_unlink(d);
diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
index e4c779bb8d76..c3f749abb2d0 100644
--- a/net/bluetooth/rfcomm/tty.c
+++ b/net/bluetooth/rfcomm/tty.c
@@ -570,12 +570,7 @@ static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err)
                                         return;
 
                                 rfcomm_dev_del(dev);
-                                /* We have to drop DLC lock here, otherwise
-                                   rfcomm_dev_put() will dead lock if it's
-                                   the last reference. */
-                                rfcomm_dlc_unlock(dlc);
                                 rfcomm_dev_put(dev);
-                                rfcomm_dlc_lock(dlc);
                         }
                 } else
                         tty_hangup(dev->tty);