diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index 4574c5cb1..c3653b067 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -1527,9 +1527,6 @@ static void l2cap_sock_close_cb(struct l2cap_chan *chan)
 {
 	struct sock *sk = chan->data;
 
-	if (!sk)
-		return;
-
 	l2cap_sock_kill(sk);
 }
 
@@ -1538,9 +1535,6 @@ static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err)
 	struct sock *sk = chan->data;
 	struct sock *parent;
 
-	if (!sk)
-		return;
-
 	BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
 
 	/* This callback can be called both for server (BT_LISTEN)
@@ -1732,10 +1726,8 @@ static void l2cap_sock_destruct(struct sock *sk)
 {
 	BT_DBG("sk %p", sk);
 
-	if (l2cap_pi(sk)->chan) {
-		l2cap_pi(sk)->chan->data = NULL;
+	if (l2cap_pi(sk)->chan)
 		l2cap_chan_put(l2cap_pi(sk)->chan);
-	}
 
 	if (l2cap_pi(sk)->rx_busy_skb) {
 		kfree_skb(l2cap_pi(sk)->rx_busy_skb);
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index cf165b0d1..2a14519a8 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -93,10 +93,10 @@ static void sco_sock_timeout(struct work_struct *work)
 
 	BT_DBG("sock %p state %d", sk, sk->sk_state);
 
-	lock_sock(sk);
+	bh_lock_sock(sk);
 	sk->sk_err = ETIMEDOUT;
 	sk->sk_state_change(sk);
-	release_sock(sk);
+	bh_unlock_sock(sk);
 
 	sock_put(sk);
 }
@@ -193,10 +193,10 @@ static void sco_conn_del(struct hci_conn *hcon, int err)
 
 	if (sk) {
 		sock_hold(sk);
-		lock_sock(sk);
+		bh_lock_sock(sk);
 		sco_sock_clear_timer(sk);
 		sco_chan_del(sk, err);
-		release_sock(sk);
+		bh_unlock_sock(sk);
 		sock_put(sk);
 	}
 
@@ -280,8 +280,7 @@ static int sco_connect(struct hci_dev *hdev, struct sock *sk)
 	return err;
 }
 
-static int sco_send_frame(struct sock *sk, void *buf, int len,
-			  unsigned int msg_flags)
+static int sco_send_frame(struct sock *sk, struct msghdr *msg, int len)
 {
 	struct sco_conn *conn = sco_pi(sk)->conn;
 	struct sk_buff *skb;
@@ -293,11 +292,15 @@ static int sco_send_frame(struct sock *sk, void *buf, int len,
 
 	BT_DBG("sk %p len %d", sk, len);
 
-	skb = bt_skb_send_alloc(sk, len, msg_flags & MSG_DONTWAIT, &err);
+	skb = bt_skb_send_alloc(sk, len, msg->msg_flags & MSG_DONTWAIT, &err);
 	if (!skb)
 		return err;
 
-	memcpy(skb_put(skb, len), buf, len);
+	if (memcpy_from_msg(skb_put(skb, len), msg, len)) {
+		kfree_skb(skb);
+		return -EFAULT;
+	}
+
 	hci_send_sco(conn->hcon, skb);
 
 	return len;
@@ -722,7 +725,6 @@ static int sco_sock_sendmsg(struct socket *sock, struct msghdr *msg,
 			    size_t len)
 {
 	struct sock *sk = sock->sk;
-	void *buf;
 	int err;
 
 	BT_DBG("sock %p, sk %p", sock, sk);
@@ -734,24 +736,14 @@ static int sco_sock_sendmsg(struct socket *sock, struct msghdr *msg,
 	if (msg->msg_flags & MSG_OOB)
 		return -EOPNOTSUPP;
 
-	buf = kmalloc(len, GFP_KERNEL);
-	if (!buf)
-		return -ENOMEM;
-
-	if (memcpy_from_msg(buf, msg, len)) {
-		kfree(buf);
-		return -EFAULT;
-	}
-
 	lock_sock(sk);
 
 	if (sk->sk_state == BT_CONNECTED)
-		err = sco_send_frame(sk, buf, len, msg->msg_flags);
+		err = sco_send_frame(sk, msg, len);
 	else
 		err = -ENOTCONN;
 
 	release_sock(sk);
-	kfree(buf);
 	return err;
 }
 
@@ -1108,10 +1100,10 @@ static void sco_conn_ready(struct sco_conn *conn)
 
 	if (sk) {
 		sco_sock_clear_timer(sk);
-		lock_sock(sk);
+		bh_lock_sock(sk);
 		sk->sk_state = BT_CONNECTED;
 		sk->sk_state_change(sk);
-		release_sock(sk);
+		bh_unlock_sock(sk);
 	} else {
 		sco_conn_lock(conn);
 
@@ -1126,12 +1118,12 @@ static void sco_conn_ready(struct sco_conn *conn)
 			return;
 		}
 
-		lock_sock(parent);
+		bh_lock_sock(parent);
 
 		sk = sco_sock_alloc(sock_net(parent), NULL,
 				    BTPROTO_SCO, GFP_ATOMIC, 0);
 		if (!sk) {
-			release_sock(parent);
+			bh_unlock_sock(parent);
 			sco_conn_unlock(conn);
 			return;
 		}
@@ -1152,7 +1144,7 @@ static void sco_conn_ready(struct sco_conn *conn)
 		/* Wake up parent */
 		parent->sk_data_ready(parent);
 
-		release_sock(parent);
+		bh_unlock_sock(parent);
 
 		sco_conn_unlock(conn);
 	}
diff --git a/net/rfkill/Kconfig b/net/rfkill/Kconfig
index 83a7af898..33ab1f7a3 100644
--- a/net/rfkill/Kconfig
+++ b/net/rfkill/Kconfig
@@ -32,3 +32,12 @@ config RFKILL_GPIO
 	help
 	  If you say yes here you get support of a generic gpio RFKILL
 	  driver.
+
+config RFKILL_RK
+	tristate "Rockchip RFKILL driver"
+	depends on RFKILL
+	depends on MMC
+	depends on ARCH_ROCKCHIP
+	default y
+	help
+	  Rockchip rfkill driver for rk29/rk3X
diff --git a/net/rfkill/Makefile b/net/rfkill/Makefile
index dc47b6174..beed5b506 100644
--- a/net/rfkill/Makefile
+++ b/net/rfkill/Makefile
@@ -7,3 +7,5 @@ rfkill-y			+= core.o
 rfkill-$(CONFIG_RFKILL_INPUT)	+= input.o
 obj-$(CONFIG_RFKILL)		+= rfkill.o
 obj-$(CONFIG_RFKILL_GPIO)	+= rfkill-gpio.o
+rfkill-rk-y			+= rfkill-wlan.o rfkill-bt.o
+obj-$(CONFIG_RFKILL_RK)		+= rfkill-rk.o