diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 8943510..aea2447 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -437,6 +437,7 @@
 		BT_DBG("smp_send_cmd: SMP_CMD_PAIRING_FAIL");
 		smp_send_cmd(conn, SMP_CMD_PAIRING_FAIL, sizeof(reason),
 								&reason);
+		del_timer(&hcon->smp_timer);
 		hci_conn_put(hcon);
 	} else if (hcon->cfm_pending) {
 		BT_DBG("send_pairing_confirm");
@@ -490,8 +491,7 @@
 
 	smp_send_cmd(conn, SMP_CMD_PAIRING_RSP, sizeof(rsp), &rsp);
 
-	mod_timer(&conn->security_timer, jiffies +
-					msecs_to_jiffies(SMP_TIMEOUT));
+	mod_timer(&hcon->smp_timer, jiffies + msecs_to_jiffies(SMP_TIMEOUT));
 
 	return 0;
 }
@@ -569,8 +569,7 @@
 		hcon->cfm_pending = TRUE;
 
 
-	mod_timer(&conn->security_timer, jiffies +
-					msecs_to_jiffies(SMP_TIMEOUT));
+	mod_timer(&hcon->smp_timer, jiffies + msecs_to_jiffies(SMP_TIMEOUT));
 
 	return 0;
 }
@@ -682,8 +681,7 @@
 
 	smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
 
-	mod_timer(&conn->security_timer, jiffies +
-			msecs_to_jiffies(SMP_TIMEOUT));
+	mod_timer(&hcon->smp_timer, jiffies + msecs_to_jiffies(SMP_TIMEOUT));
 
 	set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->pend);
 
@@ -750,7 +748,7 @@
 		hcon->preq[0] = SMP_CMD_PAIRING_REQ;
 		memcpy(&hcon->preq[1], &cp, sizeof(cp));
 
-		mod_timer(&conn->security_timer, jiffies +
+		mod_timer(&hcon->smp_timer, jiffies +
 					msecs_to_jiffies(SMP_TIMEOUT));
 
 		smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
@@ -846,6 +844,7 @@
 	case SMP_CMD_PAIRING_FAIL:
 		reason = 0;
 		err = -EPERM;
+		del_timer(&hcon->smp_timer);
 		hci_conn_put(hcon);
 		break;
 
@@ -893,6 +892,7 @@
 		BT_ERR("SMP_CMD_PAIRING_FAIL: %d", reason);
 		smp_send_cmd(conn, SMP_CMD_PAIRING_FAIL, sizeof(reason),
 								&reason);
+		del_timer(&hcon->smp_timer);
 		hci_conn_put(hcon);
 	}
 
@@ -984,6 +984,8 @@
 	if (hcon->out || rsp->resp_key_dist) {
 		if (hcon->disconn_cfm_cb)
 			hcon->disconn_cfm_cb(hcon, 0);
+
+		del_timer(&hcon->smp_timer);
 		hci_conn_put(hcon);
 	}
 
@@ -1005,3 +1007,14 @@
 
 	return 0;
 }
+
+void smp_timeout(unsigned long arg)
+{
+	struct l2cap_conn *conn = (void *) arg;
+	u8 reason = SMP_UNSPECIFIED;
+
+	BT_DBG("%p", conn);
+
+	smp_send_cmd(conn, SMP_CMD_PAIRING_FAIL, sizeof(reason), &reason);
+	hci_conn_put(conn->hcon);
+}