diff --git a/[refs] b/[refs]
index 4d88d4760337..76339fb84652 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: a0cc9a1b5712ea52aaa4e7abfa0ec2dbe0d820ff
+refs/heads/master: b77dcf8460ae57d4eb9fd3633eb4f97b8fb20716
diff --git a/trunk/net/bluetooth/hci_core.c b/trunk/net/bluetooth/hci_core.c
index 92b48e257b89..2216620ff296 100644
--- a/trunk/net/bluetooth/hci_core.c
+++ b/trunk/net/bluetooth/hci_core.c
@@ -587,6 +587,9 @@ static int hci_dev_do_close(struct hci_dev *hdev)
 	hci_req_cancel(hdev, ENODEV);
 	hci_req_lock(hdev);
 
+	/* Stop timer, it might be running */
+	del_timer_sync(&hdev->cmd_timer);
+
 	if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
 		hci_req_unlock(hdev);
 		return 0;
@@ -626,7 +629,6 @@ static int hci_dev_do_close(struct hci_dev *hdev)
 
 	/* Drop last sent command */
 	if (hdev->sent_cmd) {
-		del_timer_sync(&hdev->cmd_timer);
 		kfree_skb(hdev->sent_cmd);
 		hdev->sent_cmd = NULL;
 	}