---

yaml
---
r: 287961
b: refs/heads/master
c: cf33e77
h: refs/heads/master
i:
  287959: 4b54ac6
v: v3

[refs]

@@ -1,2 +1,2 @@
 ---
-refs/heads/master: a51cd2be864a3cc0272359b1995e213341dfc7e7
+refs/heads/master: cf33e77b76d7439f21a23a94eab4ab3b405a6a7d

trunk/net/bluetooth/rfcomm/core.c

@@ -1164,12 +1164,18 @@ static int rfcomm_recv_ua(struct rfcomm_session *s, u8 dlci)
 			break;
 
 		case BT_DISCONN:
-			/* When socket is closed and we are not RFCOMM
-			 * initiator rfcomm_process_rx already calls
-			 * rfcomm_session_put() */
-			if (s->sock->sk->sk_state != BT_CLOSED)
-				if (list_empty(&s->dlcs))
-					rfcomm_session_put(s);
+			/* rfcomm_session_put is called later so don't do
+			 * anything here otherwise we will mess up the session
+			 * reference counter:
+			 *
+			 * (a) when we are the initiator dlc_unlink will drive
+			 * the reference counter to 0 (there is no initial put
+			 * after session_add)
+			 *
+			 * (b) when we are not the initiator rfcomm_rx_process
+			 * will explicitly call put to balance the initial hold
+			 * done after session add.
+			 */
 			break;
 		}
 	}