.diff

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index b3a5a3cc9372..8ad8165bab9c 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -591,12 +591,13 @@ static int hci_dev_do_reset(struct hci_dev *hdev)
 
        hci_req_sync_lock(hdev);
 
+       hci_dev_set_flag(hdev, HCI_CMD_DRAIN_WORKQUEUE);
+
        /* Drop queues */
        skb_queue_purge(&hdev->rx_q);
        skb_queue_purge(&hdev->cmd_q);
 
        /* Cancel these to avoid queueing non-chained pending work */
-       hci_dev_set_flag(hdev, HCI_CMD_DRAIN_WORKQUEUE);
        cancel_delayed_work(&hdev->cmd_timer);
        cancel_delayed_work(&hdev->ncmd_timer);
 
@@ -4037,6 +4038,10 @@ static void hci_cmd_work(struct work_struct *work)
        BT_DBG("%s cmd_cnt %d cmd queued %d", hdev->name,
               atomic_read(&hdev->cmd_cnt), skb_queue_len(&hdev->cmd_q));
 
+       /* Don't queue while draining */
+       if (hci_dev_test_flag(hdev, HCI_CMD_DRAIN_WORKQUEUE))
+               return;
+
        /* Send queued commands */
        if (atomic_read(&hdev->cmd_cnt)) {
                skb = skb_dequeue(&hdev->cmd_q);
@@ -4056,8 +4061,7 @@ static void hci_cmd_work(struct work_struct *work)
                        if (res < 0)
                                __hci_cmd_sync_cancel(hdev, -res);
 
-                       if (test_bit(HCI_RESET, &hdev->flags) ||
-                           hci_dev_test_flag(hdev, HCI_CMD_DRAIN_WORKQUEUE))
+                       if (test_bit(HCI_RESET, &hdev->flags))
                                cancel_delayed_work(&hdev->cmd_timer);
                        else
                                schedule_delayed_work(&hdev->cmd_timer,