--- x/include/net/bluetooth/hci_core.h
+++ y/include/net/bluetooth/hci_core.h
@@ -1701,9 +1701,13 @@ static inline struct hci_conn *hci_conn_
 
 static inline void hci_conn_drop(struct hci_conn *conn)
 {
+	int cnt;
+
 	BT_DBG("hcon %p orig refcnt %d", conn, atomic_read(&conn->refcnt));
 
-	if (atomic_dec_and_test(&conn->refcnt)) {
+	cnt = atomic_dec_return(&conn->refcnt);
+	WARN_ON(cnt < 0);
+	if (cnt == 0) {
 		unsigned long timeo;
 
 		switch (conn->type) {