* [GIT PULL] bluetooth 2026-07-28
@ 2026-07-28 20:15 Luiz Augusto von Dentz
2026-07-29 0:40 ` patchwork-bot+netdevbpf
0 siblings, 1 reply; 2+ messages in thread
From: Luiz Augusto von Dentz @ 2026-07-28 20:15 UTC (permalink / raw)
To: davem, kuba; +Cc: linux-bluetooth, netdev
The following changes since commit e095f249e2209674f6366f6db0383a2b96e19239:
net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller (2026-07-28 15:53:49 +0200)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth.git tags/for-net-2026-07-28
for you to fetch changes up to abd93c85c8667add738ee82aeab95dd9fc8265a2:
Bluetooth: SCO: give the socket its own sco_conn reference (2026-07-28 16:13:48 -0400)
----------------------------------------------------------------
bluetooth pull request for net:
- hci_sync: Fix advertising data UAFs
- hci_conn: hold conn reference fixes
- L2CAP: fix UAF in l2cap_le_connect_rsp
- RFCOMM: validate skb length in rfcomm_recv_frame
- ISO: Locking fixes
- SCO: give the socket its own sco_conn reference
- MGMT: fix UAF in pair command cancellation
- MGMT: fix pending command UAF in EIR updates
- HIDP: reject frames without a transaction header
- HIDP: validate numbered report payloads
- btmtk: Fix short read errors in btmtk_usb_uhw_reg_read()
- btmtk: Fix short read errors in btmtk_usb_reg_read()
- btusb: Fix short read errors in btusb_qca_send_vendor_req()
- btintel: Validate length before parsing diagnostics TLV
----------------------------------------------------------------
Aldo Ariel Panzardo (1):
Bluetooth: SCO: give the socket its own sco_conn reference
Chengfeng Ye (1):
Bluetooth: hci_sync: Fix advertising data UAFs
Greg Kroah-Hartman (3):
Bluetooth: btmtk: Fix short read errors in btmtk_usb_uhw_reg_read()
Bluetooth: btmtk: Fix short read errors in btmtk_usb_reg_read()
Bluetooth: btusb: Fix short read errors in btusb_qca_send_vendor_req()
Jiale Yao (2):
Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp
Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame
Pauli Virtanen (19):
Bluetooth: ISO: clear iso_data always when detaching conn from hcon
Bluetooth: ISO: fix CONNECTED -> CLOSED transition on shutdown/release
Bluetooth: ISO: lock sk in iso_sock_getname
Bluetooth: ISO: lock sk in iso_connect_ind
Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos
Bluetooth: ISO: validate sockaddr_iso first in iso_sock_rebind_bis()
Bluetooth: ISO: hold sk properly in iso_conn_ready
Bluetooth: ISO: fix leaking sk after socket release
Bluetooth: ISO: avoid deadlocks in iso_sock_timeout
Bluetooth: ISO: ensure no dangling hcon references in iso_conn
Bluetooth: ISO: fix refcounting of iso_conn
Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero
Bluetooth: hci_conn: hold conn reference in abort_conn_sync()
Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks
Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback
Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback
Bluetooth: hci_sync: hold conn in hci_past_sync() callback
Bluetooth: hci_sync: fix hci_conn_del() use in hci_le_create_conn_sync
Bluetooth: hci_sync: remove unnecessary hci_conn_get in create_conn_sync
Sangho Lee (2):
Bluetooth: HIDP: reject frames without a transaction header
Bluetooth: HIDP: validate numbered report payloads
Zihan Xi (2):
Bluetooth: mgmt: fix UAF in pair command cancellation
Bluetooth: mgmt: fix pending command UAF in EIR updates
Zijun Hu (1):
Bluetooth: btintel: Validate length before parsing diagnostics TLV
drivers/bluetooth/btintel.c | 3 +
drivers/bluetooth/btmtk.c | 86 ++++++------
drivers/bluetooth/btusb.c | 30 ++---
include/net/bluetooth/hci_core.h | 4 +-
net/bluetooth/hci_conn.c | 14 +-
net/bluetooth/hci_sync.c | 216 +++++++++++++++++++++----------
net/bluetooth/hidp/core.c | 30 +++--
net/bluetooth/iso.c | 273 +++++++++++++++++++++++++++------------
net/bluetooth/l2cap_core.c | 5 +
net/bluetooth/mgmt.c | 84 +++++++++---
net/bluetooth/rfcomm/core.c | 5 +
net/bluetooth/sco.c | 22 ++--
12 files changed, 513 insertions(+), 259 deletions(-)
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-07-29 0:41 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-28 20:15 [GIT PULL] bluetooth 2026-07-28 Luiz Augusto von Dentz
2026-07-29 0:40 ` patchwork-bot+netdevbpf
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox