diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c
index 85a30fb9177b..0b2f6be7b820 100644
--- a/drivers/bluetooth/hci_ldisc.c
+++ b/drivers/bluetooth/hci_ldisc.c
@@ -541,9 +541,10 @@ static void hci_uart_tty_close(struct tty_struct *tty)
 		cancel_work_sync(&hu->write_work);
 
 		if (hdev) {
-			if (test_bit(HCI_UART_REGISTERED, &hu->flags))
+			if (test_bit(HCI_UART_REGISTERED, &hu->flags)) {
 				hci_unregister_dev(hdev);
-			hci_free_dev(hdev);
+				hci_free_dev(hdev);
+			}
 		}
 		hu->proto->close(hu);
 	}
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index dcc0dc6e2624..01aa53c02c06
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -1023,13 +1023,16 @@ static inline void hci_conn_drop(struct hci_conn *conn)
 				   &conn->disc_work, timeo);
 	}
 }
-
+extern void show_stack(struct task_struct *task, unsigned long *sp);
 /* ----- HCI Devices ----- */
 static inline void hci_dev_put(struct hci_dev *d)
 {
 	BT_DBG("%s orig refcnt %d", d->name,
 	       kref_read(&d->dev.kobj.kref));
 
+	if (kref_read(&d->dev.kobj.kref) == 1)
+		show_stack(NULL, NULL);
+
 	put_device(&d->dev);
 }
 
@@ -1037,7 +1040,7 @@ static inline struct hci_dev *hci_dev_hold(struct hci_dev *d)
 {
 	BT_DBG("%s orig refcnt %d", d->name,
 	       kref_read(&d->dev.kobj.kref));
-
+	
 	get_device(&d->dev);
 	return d;
 }
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index cbbc34a006d1..119f23a6bc4e
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -3342,6 +3342,10 @@ EXPORT_SYMBOL(hci_alloc_dev);
 void hci_free_dev(struct hci_dev *hdev)
 {
 	/* will free via device release */
+	if (kref_read(&hdev->dev.kobj.kref) > 1) {
+		printk("catch: %#llx, %#llx\n", hdev, &hdev->promisc);
+		show_stack(NULL, NULL);
+	}
 	put_device(&hdev->dev);
 }
 EXPORT_SYMBOL(hci_free_dev);
diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c