.diff

diff --git a/src/gatt-database.c b/src/gatt-database.c
index a03c579cf..68f411ba4 100644
--- a/src/gatt-database.c
+++ b/src/gatt-database.c
@@ -141,8 +141,9 @@ struct external_desc {
 };
 
 struct pending_op {
-       struct btd_device *device;
+       struct bt_att *att;
        unsigned int id;
+       unsigned int disconn_id;
        uint16_t offset;
        uint8_t link_type;
        struct gatt_db_attribute *attrib;
@@ -941,6 +942,8 @@ static void pending_op_free(void *data)
        if (op->owner_queue)
                queue_remove(op->owner_queue, op);
 
+       bt_att_unregister_disconnect(op->att, op->disconn_id);
+       bt_att_unref(op->att);
        free(op);
 }
 
@@ -970,7 +973,7 @@ static struct pending_op *pending_ccc_new(struct bt_att *att,
        op->data.iov_base = UINT_TO_PTR(value);
        op->data.iov_len = sizeof(value);
 
-       op->device = device;
+       op->att = bt_att_ref(att);
        op->attrib = attrib;
        op->link_type = link_type;
 
@@ -2193,14 +2196,15 @@ static struct pending_op *pending_read_new(struct bt_att *att,
        op = new0(struct pending_op, 1);
 
        op->owner_queue = owner_queue;
-       op->device = att_get_device(att);
+       op->att = bt_att_ref(att);
        op->attrib = attrib;
        op->id = id;
        op->offset = offset;
        op->link_type = bt_att_get_link_type(att);
        queue_push_tail(owner_queue, op);
 
-       bt_att_register_disconnect(att, pending_disconnect_cb, op, NULL);
+       op->disconn_id = bt_att_register_disconnect(att, pending_disconnect_cb,
+                                                               op, NULL);
 
        return op;
 }
@@ -2208,7 +2212,8 @@ static struct pending_op *pending_read_new(struct bt_att *att,
 static void append_options(DBusMessageIter *iter, void *user_data)
 {
        struct pending_op *op = user_data;
-       const char *path = device_get_path(op->device);
+       struct btd_device *device = att_get_device(op->att);
+       const char *path = device_get_path(device);
        struct bt_gatt_server *server;
        const char *link;
        uint16_t mtu;
@@ -2235,7 +2240,7 @@ static void append_options(DBusMessageIter *iter, void *user_data)
                dict_append_entry(iter, "prepare-authorize", DBUS_TYPE_BOOLEAN,
                                                        &op->prep_authorize);
 
-       server = btd_device_get_gatt_server(op->device);
+       server = btd_device_get_gatt_server(device);
        mtu = bt_gatt_server_get_mtu(server);
 
        dict_append_entry(iter, "mtu", DBUS_TYPE_UINT16, &mtu);
@@ -2350,8 +2355,8 @@ static void write_reply_cb(DBusMessage *message, void *user_data)
        }
 
 done:
-       // Make sure that only reply if the device is connected
-       if (btd_device_is_connected(op->device))
+       /* Make sure that only reply if the device is connected */
+       if (!bt_att_get_fd(op->att))
                gatt_db_attribute_write_result(op->attrib, op->id, ecode);
 }
 
@@ -2371,7 +2376,7 @@ static struct pending_op *pending_write_new(struct bt_att *att,
        op->data.iov_base = (uint8_t *) value;
        op->data.iov_len = len;
 
-       op->device = att_get_device(att);
+       op->att = bt_att_ref(att);
        op->owner_queue = owner_queue;
        op->attrib = attrib;
        op->id = id;