--- y/net/bluetooth/l2cap_core.c
+++ x/net/bluetooth/l2cap_core.c
@@ -458,10 +458,6 @@ struct l2cap_chan *l2cap_chan_create(voi
 	/* Set default lock nesting level */
 	atomic_set(&chan->nesting, L2CAP_NESTING_NORMAL);
 
-	write_lock(&chan_list_lock);
-	list_add(&chan->global_l, &chan_list);
-	write_unlock(&chan_list_lock);
-
 	INIT_DELAYED_WORK(&chan->chan_timer, l2cap_chan_timeout);
 
 	chan->state = BT_OPEN;
@@ -473,6 +469,10 @@ struct l2cap_chan *l2cap_chan_create(voi
 
 	BT_DBG("chan %p", chan);
 
+	write_lock(&chan_list_lock);
+	list_add(&chan->global_l, &chan_list);
+	write_unlock(&chan_list_lock);
+
 	return chan;
 }
 EXPORT_SYMBOL_GPL(l2cap_chan_create);