gistfile1.txt

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 34c8dca2069f..d39e9c158dae 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -1522,8 +1522,8 @@ static void hci_cmd_timeout(struct work_struct *work)
        struct hci_dev *hdev = container_of(work, struct hci_dev,
                                            cmd_timer.work);
 
-       if (hdev->sent_cmd) {
-               u16 opcode = hci_skb_opcode(hdev->sent_cmd);
+       if (hdev->req_skb) {
+               u16 opcode = hci_skb_opcode(hdev->req_skb);
 
                bt_dev_err(hdev, "command 0x%4.4x tx timeout", opcode);
 
@@ -2828,6 +2828,7 @@ void hci_release_dev(struct hci_dev *hdev)
        ida_destroy(&hdev->unset_handle_ida);
        ida_free(&hci_index_ida, hdev->id);
        kfree_skb(hdev->sent_cmd);
+       kfree_skb(hdev->req_skb);
        kfree_skb(hdev->recv_event);
        kfree(hdev);
 }
@@ -3157,21 +3158,33 @@ int __hci_cmd_send(struct hci_dev *hdev, u16 opcode, u32 plen,
 EXPORT_SYMBOL(__hci_cmd_send);
 
 /* Get data from the previously sent command */
-void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
+static void *hci_cmd_data(struct sk_buff *skb, __u16 opcode)
 {
        struct hci_command_hdr *hdr;
 
-       if (!hdev->sent_cmd)
+       if (!skb || skb->len < HCI_COMMAND_HDR_SIZE)
                return NULL;
 
-       hdr = (void *) hdev->sent_cmd->data;
+       hdr = (void *) skb->data;
 
        if (hdr->opcode != cpu_to_le16(opcode))
                return NULL;
 
-       BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
+       return skb->data + HCI_COMMAND_HDR_SIZE;
+}
 
-       return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
+/* Get data from the previously sent command */
+void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
+{
+       void *data;
+
+       /* Check if opcode matches last sent command */
+       data = hci_cmd_data(hdev->sent_cmd, opcode);
+       if (!data)
+               /* Check if opcode matches last request */
+               data = hci_cmd_data(hdev->req_skb, opcode);
+
+       return data;
 }
 
 /* Get data from last received event */
@@ -4072,17 +4085,19 @@ void hci_req_cmd_complete(struct hci_dev *hdev, u16 opcode, u8 status,
        if (!status && !hci_req_is_complete(hdev))
                return;
 
+       skb = hdev->req_skb;
+
        /* If this was the last command in a request the complete
-        * callback would be found in hdev->sent_cmd instead of the
+        * callback would be found in hdev->req_skb instead of the
         * command queue (hdev->cmd_q).
         */
-       if (bt_cb(hdev->sent_cmd)->hci.req_flags & HCI_REQ_SKB) {
-               *req_complete_skb = bt_cb(hdev->sent_cmd)->hci.req_complete_skb;
+       if (skb && bt_cb(skb)->hci.req_flags & HCI_REQ_SKB) {
+               *req_complete_skb = bt_cb(skb)->hci.req_complete_skb;
                return;
        }
 
-       if (bt_cb(hdev->sent_cmd)->hci.req_complete) {
-               *req_complete = bt_cb(hdev->sent_cmd)->hci.req_complete;
+       if (skb && bt_cb(skb)->hci.req_complete) {
+               *req_complete = bt_cb(skb)->hci.req_complete;
                return;
        }
 
@@ -4199,8 +4214,11 @@ static void hci_send_cmd_sync(struct hci_dev *hdev, struct sk_buff *skb)
                return;
        }
 
-       if (hci_req_status_pend(hdev))
+       if (hci_req_status_pend(hdev)) {
                hci_dev_set_flag(hdev, HCI_CMD_PENDING);
+               kfree_skb(hdev->req_skb);
+               hdev->req_skb = skb_clone(skb, GFP_KERNEL);
+       }
 
        atomic_dec(&hdev->cmd_cnt);
 }
diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
index b7d8e99e2a30..13cf4767c9d5 100644
--- a/net/bluetooth/hci_sync.c
+++ b/net/bluetooth/hci_sync.c
@@ -39,6 +39,7 @@ static void hci_cmd_sync_complete(struct hci_dev *hdev, u8 result, u16 opcode,
                if (sk)
                        sock_put(sk);
 
+               kfree_skb(hdev->req_skb);
                hdev->req_skb = skb_get(skb);
        }