diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 4ecc9d5..7815826 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -1295,7 +1295,8 @@
 	if (!chan)
 		return NULL;
 
-	chan->conn = conn;
+	chan->conn = hci_conn_get(conn);
+	hci_conn_hold(conn);
 	skb_queue_head_init(&chan->data_q);
 	chan->state = BT_CONNECTED;
 
@@ -1316,6 +1317,7 @@
 	synchronize_rcu();
 
 	hci_conn_drop(conn);
+	hci_conn_put(conn);
 
 	skb_queue_purge(&chan->data_q);
 	kfree(chan);