--- x/net/bluetooth/rfcomm/core.c
+++ y/net/bluetooth/rfcomm/core.c
@@ -42,6 +42,7 @@ static int channel_mtu = -1;
 
 static struct task_struct *rfcomm_thread;
 
+static DEFINE_MUTEX(rfcomm_cb_mutex);
 static DEFINE_MUTEX(rfcomm_mutex);
 #define rfcomm_lock()	mutex_lock(&rfcomm_mutex)
 #define rfcomm_unlock()	mutex_unlock(&rfcomm_mutex)
@@ -701,7 +702,9 @@ static struct rfcomm_session *rfcomm_ses
 			return NULL;
 		}
 
+	mutex_lock(&rfcomm_cb_mutex);
 	list_add(&s->list, &session_list);
+	mutex_unlock(&rfcomm_cb_mutex);
 
 	return s;
 }
@@ -743,6 +746,7 @@ static struct rfcomm_session *rfcomm_ses
 {
 	struct rfcomm_dlc *d, *n;
 
+	mutex_lock(&rfcomm_cb_mutex);
 	s->state = BT_CLOSED;
 
 	BT_DBG("session %p state %ld err %d", s, s->state, err);
@@ -754,7 +758,9 @@ static struct rfcomm_session *rfcomm_ses
 	}
 
 	rfcomm_session_clear_timer(s);
-	return rfcomm_session_del(s);
+	s = rfcomm_session_del(s);
+	mutex_unlock(&rfcomm_cb_mutex);
+	return s;
 }
 
 static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src,
@@ -2220,11 +2226,11 @@ static void rfcomm_security_cfm(struct h
 
 	BT_DBG("conn %p status 0x%02x encrypt 0x%02x", conn, status, encrypt);
 
-	rfcomm_lock();
+	mutex_lock(&rfcomm_cb_mutex);
 
 	s = rfcomm_session_get(&conn->hdev->bdaddr, &conn->dst);
 	if (!s) {
-		rfcomm_unlock();
+		mutex_unlock(&rfcomm_cb_mutex);
 		return;
 	}
 
@@ -2258,7 +2264,7 @@ static void rfcomm_security_cfm(struct h
 			set_bit(RFCOMM_AUTH_REJECT, &d->flags);
 	}
 
-	rfcomm_unlock();
+	mutex_unlock(&rfcomm_cb_mutex);
 
 	rfcomm_schedule();
 }