[GIT PULL] bluetooth 2026-04-01

[GIT PULL] bluetooth 2026-04-01

[Luiz Augusto von Dentz]

The following changes since commit 48b3cd69265f346f64b93064723492da46206e9b:

  net: stmmac: skip VLAN restore when VLAN hash ops are missing (2026-03-31 19:45:26 -0700)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth.git tags/for-net-2026-04-01

for you to fetch changes up to bc39a094730ce062fa034a529c93147c096cb488:

  Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (2026-04-01 16:48:28 -0400)

----------------------------------------------------------------
bluetooth pull request for net:

 - hci_sync: Fix UAF in le_read_features_complete
 - hci_sync: call destroy in hci_cmd_sync_run if immediate
 - hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists
 - hci_sync: fix leaks when hci_cmd_sync_queue_once fails
 - hci_sync: fix stack buffer overflow in hci_le_big_create_sync
 - hci_conn: fix potential UAF in set_cig_params_sync
 - hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt
 - hci_event: move wake reason storage into validated event handlers
 - SMP: force responder MITM requirements before building the pairing response
 - SMP: derive legacy responder STK authentication from MITM state
 - MGMT: validate LTK enc_size on load
 - MGMT: validate mesh send advertising payload length
 - SCO: fix race conditions in sco_sock_connect()
 - hci_h4: Fix race during initialization

----------------------------------------------------------------
Cen Zhang (1):
      Bluetooth: SCO: fix race conditions in sco_sock_connect()

Jonathan Rissanen (1):
      Bluetooth: hci_h4: Fix race during initialization

Keenan Dong (2):
      Bluetooth: MGMT: validate LTK enc_size on load
      Bluetooth: MGMT: validate mesh send advertising payload length

Luiz Augusto von Dentz (1):
      Bluetooth: hci_sync: Fix UAF in le_read_features_complete

Oleh Konko (3):
      Bluetooth: hci_event: move wake reason storage into validated event handlers
      Bluetooth: SMP: force responder MITM requirements before building the pairing response
      Bluetooth: SMP: derive legacy responder STK authentication from MITM state

Pauli Virtanen (5):
      Bluetooth: hci_sync: call destroy in hci_cmd_sync_run if immediate
      Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists
      Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails
      Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync
      Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt

hkbinbin (1):
      Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync

 drivers/bluetooth/hci_h4.c |   3 --
 net/bluetooth/hci_conn.c   |   8 ++-
 net/bluetooth/hci_event.c  | 127 ++++++++++++++++++++-------------------------
 net/bluetooth/hci_sync.c   |  88 +++++++++++++++++++++----------
 net/bluetooth/mgmt.c       |  17 ++++--
 net/bluetooth/sco.c        |  26 ++++++++--
 net/bluetooth/smp.c        |  11 ++--
 7 files changed, 165 insertions(+), 115 deletions(-)

Re: [GIT PULL] bluetooth 2026-04-01

[patchwork-bot+netdevbpf]

Hello:

This pull request was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Wed,  1 Apr 2026 16:58:34 -0400 you wrote:
> The following changes since commit 48b3cd69265f346f64b93064723492da46206e9b:
> 
>   net: stmmac: skip VLAN restore when VLAN hash ops are missing (2026-03-31 19:45:26 -0700)
> 
> are available in the Git repository at:
> 
>   git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth.git tags/for-net-2026-04-01
> 
> [...]

Here is the summary with links:
  - [GIT,PULL] bluetooth 2026-04-01
    https://git.kernel.org/netdev/net/c/6d6be7070e90

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html