.diff

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 11a83e32e276..1a8aa1159ea3 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -3913,15 +3913,13 @@ static inline int l2cap_command_rej(struct l2cap_conn *conn,
        return 0;
 }
 
-static struct l2cap_chan *l2cap_connect(struct l2cap_conn *conn,
-                                       struct l2cap_cmd_hdr *cmd,
-                                       u8 *data, u8 rsp_code, u8 amp_id)
+static void l2cap_connect(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd,
+                         u8 *data, u8 rsp_code, u8 amp_id)
 {
        struct l2cap_conn_req *req = (struct l2cap_conn_req *) data;
        struct l2cap_conn_rsp rsp;
-       struct l2cap_chan *chan = NULL, *pchan;
+       struct l2cap_chan *chan = NULL, *pchan = NULL;
        int result, status = L2CAP_CS_NO_INFO;
-
        u16 dcid = 0, scid = __le16_to_cpu(req->scid);
        __le16 psm = req->psm;
 
@@ -3932,7 +3930,7 @@ static struct l2cap_chan *l2cap_connect(struct l2cap_conn *conn,
                                         &conn->hcon->dst, ACL_LINK);
        if (!pchan) {
                result = L2CAP_CR_BAD_PSM;
-               goto sendresp;
+               goto response;
        }
 
        mutex_lock(&conn->chan_lock);
@@ -4019,17 +4017,15 @@ static struct l2cap_chan *l2cap_connect(struct l2cap_conn *conn,
        }
 
 response:
-       l2cap_chan_unlock(pchan);
-       mutex_unlock(&conn->chan_lock);
-       l2cap_chan_put(pchan);
-
-sendresp:
        rsp.scid   = cpu_to_le16(scid);
        rsp.dcid   = cpu_to_le16(dcid);
        rsp.result = cpu_to_le16(result);
        rsp.status = cpu_to_le16(status);
        l2cap_send_cmd(conn, cmd->ident, rsp_code, sizeof(rsp), &rsp);
 
+       if (!pchan)
+               return;
+
        if (result == L2CAP_CR_PEND && status == L2CAP_CS_NO_INFO) {
                struct l2cap_info_req info;
-sendresp:
        rsp.scid   = cpu_to_le16(scid);
        rsp.dcid   = cpu_to_le16(dcid);
        rsp.result = cpu_to_le16(result);
        rsp.status = cpu_to_le16(status);
        l2cap_send_cmd(conn, cmd->ident, rsp_code, sizeof(rsp), &rsp);
 
+       if (!pchan)
+               return;
+
        if (result == L2CAP_CR_PEND && status == L2CAP_CS_NO_INFO) {
                struct l2cap_info_req info;
                info.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
@@ -4052,7 +4048,9 @@ static struct l2cap_chan *l2cap_connect(struct l2cap_conn *conn,
                chan->num_conf_req++;
        }
 
-       return chan;
+       l2cap_chan_unlock(pchan);
+       mutex_unlock(&conn->chan_lock);
+       l2cap_chan_put(pchan);
 }