--- x/net/bluetooth/l2cap_core.c
+++ y/net/bluetooth/l2cap_core.c
@@ -1714,6 +1714,7 @@ int l2cap_register_user(struct l2cap_con
 
 	list_add(&user->list, &conn->users);
 	ret = 0;
+	hci_dev_hold(hdev);
 
 out_unlock:
 	hci_dev_unlock(hdev);
@@ -1735,6 +1736,7 @@ void l2cap_unregister_user(struct l2cap_
 
 out_unlock:
 	hci_dev_unlock(hdev);
+	hci_dev_put(hdev);
 }
 EXPORT_SYMBOL(l2cap_unregister_user);