.diff

diff --git a/include/net/bluetooth/hci_sync.h b/include/net/bluetooth/hci_sync.h
index bf45133ee82c..98fed713ecf5 100644
--- a/include/net/bluetooth/hci_sync.h
+++ b/include/net/bluetooth/hci_sync.h
@@ -110,6 +110,8 @@ int hci_resume_sync(struct hci_dev *hdev);
 
 struct hci_conn;
 
+int hci_abort_conn_sync(struct hci_dev *hdev, struct hci_conn *conn, u8 reason);
+
 int hci_le_create_conn_sync(struct hci_dev *hdev, struct hci_conn *conn);
 
 int hci_le_remove_cig_sync(struct hci_dev *hdev, u8 handle);
diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
index d0c51eebf3e5..99fe6ad9b735 100644
--- a/net/bluetooth/hci_sync.c
+++ b/net/bluetooth/hci_sync.c
@@ -4747,8 +4747,7 @@ static int hci_reject_conn_sync(struct hci_dev *hdev, struct hci_conn *conn,
                                     sizeof(cp), &cp, HCI_CMD_TIMEOUT);
 }
 
-static int hci_abort_conn_sync(struct hci_dev *hdev, struct hci_conn *conn,
-                              u8 reason)
+int hci_abort_conn_sync(struct hci_dev *hdev, struct hci_conn *conn, u8 reason)
 {
        int err;
 
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 8cca1eb574c0..58f9e731fc88 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -2528,6 +2528,37 @@ static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
                          skip_sk);
 }
 
+static void unpair_device_complete(struct hci_dev *hdev, void *data, int err)
+{
+       struct mgmt_pending_cmd *cmd = data;
+       struct mgmt_cp_unpair_device *cp = cmd->param;
+
+       if (!err)
+               device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
+
+       cmd->cmd_complete(cmd, err);
+       mgmt_pending_free(cmd);
+}
+
+static int unpair_device_sync(struct hci_dev *hdev, void *data)
+{
+       struct mgmt_pending_cmd *cmd = data;
+       struct mgmt_cp_unpair_device *cp = cmd->param;
+       struct hci_conn *conn;
+
+       if (cp->addr.type == BDADDR_BREDR)
+               conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
+                                              &cp->addr.bdaddr);
+       else
+               conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
+                                              le_addr_type(cp->addr.type));
+
+       if (!conn)
+               return 0;
+
+       return hci_abort_conn_sync(hdev, conn, HCI_ERROR_REMOTE_USER_TERM);
+}
+
 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
                         u16 len)
 {
@@ -2638,7 +2669,7 @@ static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
                goto unlock;
        }
 
-       cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
+       cmd = mgmt_pending_new(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
                               sizeof(*cp));
        if (!cmd) {
                err = -ENOMEM;
@@ -2647,9 +2678,10 @@ static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
 
        cmd->cmd_complete = addr_cmd_complete;
 
-       err = hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
+       err = hci_cmd_sync_queue(hdev, unpair_device_sync, cmd,
+                                unpair_device_complete);
        if (err < 0)
-               mgmt_pending_remove(cmd);
+               mgmt_pending_free(cmd);
 
 unlock:
        hci_dev_unlock(hdev);