---

yaml
---
r: 290907
b: refs/heads/master
c: 66f0129
h: refs/heads/master
i:
  290905: b0e3993
  290903: 4964dbe
v: v3

[refs]

@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 4777bfdebbddc1f58d9148de5a3e00375d063768
+refs/heads/master: 66f01296962dfebf032c18ffe61c53a199b4a7bd

trunk/net/bluetooth/rfcomm/core.c

@@ -1164,12 +1164,18 @@ static int rfcomm_recv_ua(struct rfcomm_session *s, u8 dlci)
 			break;
 
 		case BT_DISCONN:
-			/* When socket is closed and we are not RFCOMM
-			 * initiator rfcomm_process_rx already calls
-			 * rfcomm_session_put() */
-			if (s->sock->sk->sk_state != BT_CLOSED)
-				if (list_empty(&s->dlcs))
-					rfcomm_session_put(s);
+			/* rfcomm_session_put is called later so don't do
+			 * anything here otherwise we will mess up the session
+			 * reference counter:
+			 *
+			 * (a) when we are the initiator dlc_unlink will drive
+			 * the reference counter to 0 (there is no initial put
+			 * after session_add)
+			 *
+			 * (b) when we are not the initiator rfcomm_rx_process
+			 * will explicitly call put to balance the initial hold
+			 * done after session add.
+			 */
 			break;
 		}
 	}