diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c
index 85a30fb9177b..0b2f6be7b820 100644
--- a/drivers/bluetooth/hci_ldisc.c
+++ b/drivers/bluetooth/hci_ldisc.c
@@ -541,9 +541,10 @@ static void hci_uart_tty_close(struct tty_struct *tty)
 		cancel_work_sync(&hu->write_work);
 
 		if (hdev) {
-			if (test_bit(HCI_UART_REGISTERED, &hu->flags))
+			if (test_bit(HCI_UART_REGISTERED, &hu->flags)) {
 				hci_unregister_dev(hdev);
-			hci_free_dev(hdev);
+				hci_free_dev(hdev);
+			}
 		}
 		hu->proto->close(hu);
 	}
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index cbbc34a006d1..119f23a6bc4e
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -3342,6 +3342,10 @@ EXPORT_SYMBOL(hci_alloc_dev);
 void hci_free_dev(struct hci_dev *hdev)
 {
 	/* will free via device release */
+	if (kref_read(&hdev->dev.kobj.kref) > 1) {
+		printk("catch: %#llx, %#llx\n", hdev, &hdev->promisc);
+		show_stack(NULL, NULL);
+	}
 	put_device(&hdev->dev);
 }
 EXPORT_SYMBOL(hci_free_dev);
diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c