diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 8562ac1..338d8c3 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -160,6 +160,11 @@
 	return chan;
 }
 
+void l2cap_chan_free(struct l2cap_chan *chan)
+{
+	kfree(chan);
+}
+
 static void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
 {
 	struct sock *sk = chan->sk;
@@ -236,7 +241,7 @@
 
 	if (!(chan->conf_state & L2CAP_CONF_OUTPUT_DONE &&
 			chan->conf_state & L2CAP_CONF_INPUT_DONE))
-		goto free;
+		return;
 
 	skb_queue_purge(&chan->tx_q);
 
@@ -255,9 +260,6 @@
 			kfree(l);
 		}
 	}
-
-free:
-	kfree(chan);
 }
 
 static inline u8 l2cap_get_auth_type(struct l2cap_chan *chan)
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index 61d93f6..0e23ebd 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -849,6 +849,8 @@
 	BT_DBG("sk %p state %d", sk, sk->sk_state);
 
 	/* Kill poor orphan */
+
+	l2cap_chan_free(l2cap_pi(sk)->chan);
 	bt_sock_unlink(&l2cap_sk_list, sk);
 	sock_set_flag(sk, SOCK_DEAD);
 	sock_put(sk);