RFC [PATCH] hci: Fix race between hidp_session and hci code

index 90cf75a..47c9d30 100644
@@ -198,6 +198,7 @@ struct hci_dev {
 
 	unsigned long	quirks;
 
+	atomic_t	ref_cnt;
 	atomic_t	cmd_cnt;
 	unsigned int	acl_cnt;
 	unsigned int	sco_cnt;

@@ -646,19 +647,14 @@ static inline void hci_conn_put(struct hci_conn *conn)
 }
 
 /* ----- HCI Devices ----- */
-static inline void hci_dev_put(struct hci_dev *d)
-{
-	BT_DBG("%s orig refcnt %d", d->name,
-	       atomic_read(&d->dev.kobj.kref.refcount));
-
-	put_device(&d->dev);
-}
+void hci_dev_put(struct hci_dev *d);
 
 static inline struct hci_dev *hci_dev_hold(struct hci_dev *d)
 {
 	BT_DBG("%s orig refcnt %d", d->name,
 	       atomic_read(&d->dev.kobj.kref.refcount));
 
+	atomic_inc(&d->ref_cnt);
 	get_device(&d->dev);
 	return d;
 }

index 618ca1a..c187a84 100644
@@ -891,6 +891,19 @@ int hci_dev_close(__u16 dev)
 	return err;
 }
 
+void hci_dev_put(struct hci_dev *d)
+{
+	BT_DBG("%s orig refcnt %d", d->name,
+	       atomic_read(&d->dev.kobj.kref.refcount));
+
+	if(atomic_dec_and_test(&d->ref_cnt)) {
+		hci_del_sysfs(d);
+	}
+	put_device(&d->dev);
+}
+EXPORT_SYMBOL(hci_dev_put);
+
+
 int hci_dev_reset(__u16 dev)
 {
 	struct hci_dev *hdev;

@@ -1884,8 +1897,6 @@ void hci_unregister_dev(struct hci_dev *hdev)
 		rfkill_destroy(hdev->rfkill);
 	}
 
-	hci_del_sysfs(hdev);
-
 	destroy_workqueue(hdev->workqueue);
 	destroy_workqueue(hdev->req_workqueue);