--- l/net/bluetooth/hidp/core.c
+++ y/net/bluetooth/hidp/core.c
@@ -1302,6 +1302,7 @@ static int hidp_session_thread(void *arg
 	 * delete the session.
 	 */
 	l2cap_unregister_user(session->conn, &session->user);
+	hci_dev_put(session->conn->hcon->hdev);
 	hidp_session_put(session);
 
 	module_put_and_kthread_exit(0);
@@ -1378,6 +1379,7 @@ int hidp_connection_add(const struct hid
 	ret = l2cap_register_user(conn, &session->user);
 	if (ret)
 		goto out_session;
+	hci_dev_hold(conn->hcon->hdev);
 
 	ret = 0;
 
@@ -1405,8 +1407,10 @@ int hidp_connection_del(struct hidp_conn
 				       HIDP_TRANS_HID_CONTROL |
 				         HIDP_CTRL_VIRTUAL_CABLE_UNPLUG,
 				       NULL, 0);
-	else
+	else {
 		l2cap_unregister_user(session->conn, &session->user);
+		hci_dev_put(session->conn->hcon->hdev);
+	}
 
 	hidp_session_put(session);