--- x/net/bluetooth/l2cap_core.c
+++ y/net/bluetooth/l2cap_core.c
@@ -1890,6 +1890,7 @@ static void l2cap_conn_del(struct hci_co
 {
 	struct l2cap_conn *conn = hcon->l2cap_data;
 	struct l2cap_chan *chan, *l;
+	LIST_HEAD(head);
 
 	if (!conn)
 		return;
@@ -1931,13 +1932,12 @@ static void l2cap_conn_del(struct hci_co
 
 	mutex_unlock(&conn->chan_lock);
 
+	cancel_delayed_work_sync(&conn->info_timer);
+	list_add(&conn->hchan->list, &head);
 	hci_chan_del(conn->hchan);
 
-	if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
-		cancel_delayed_work_sync(&conn->info_timer);
-
-	hcon->l2cap_data = NULL;
 	conn->hchan = NULL;
+	hcon->l2cap_data = NULL;
 	l2cap_conn_put(conn);
 }
 
@@ -7893,6 +7893,7 @@ static struct l2cap_conn *l2cap_conn_add
 	INIT_DELAYED_WORK(&conn->id_addr_timer, l2cap_conn_update_id_addr);
 
 	conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM;
+	list_del(&hchan->list);
 
 	return conn;
 }