[GIT PULL] bluetooth 2026-11-02

[GIT PULL] bluetooth 2026-11-02

[Luiz Augusto von Dentz]

The following changes since commit c3e67bd82b9b9b1a5118f09a429ccefe2aab0741:

  ipv6: reject wrapped temporary address preferred lifetimes (2026-11-02 22:31:32 +0100)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth.git tags/for-net-2026-11-02

for you to fetch changes up to 60b10121db602a43ada3dbc39792bbf93d25991b:

  Bluetooth: MGMT: Fix discovery stuck after a failed Stop Discovery (2026-11-02 17:09:03 -0500)

----------------------------------------------------------------
bluetooth pull request for net:

Core:

 - hci_core: Initialize IRK before publication
 - hci_core: Initialize link key before publication
 - hci_core: Initialize LTK before publication
 - hci_core: Fix queuing rx_work while workqueue is drained
 - hci_core: Keep link-key filtering inside RCU
 - hci_core: Initialize advertising RPA work only once
 - hci_sync: Fix invalid Supervision_Timeout in LE Set Default Rate
 - hci_sync: re-enable legacy advertising on resume
 - hci_sync: pause advertising for the scan address update
 - hci_sync: Update the CIS host feature when enabling LE
 - hci_sync: Copy the LE accept list under hdev->lock
 - hci_sync: Protect resolving-list lookups
 - hci_sync: Copy the resolving-list IRK under RCU
 - hci_event: Clear explicit connect state on LE connection
 - L2CAP: Hold incoming data until encryption key size is known
 - L2CAP: Ignore connection responses with wrong ident
 - SMP: Protect link keys during LTK derivation
 - SMP: Protect LTK encryption with RCU
 - MGMT: Return RFKILLED for Set Powered on a blocked controller
 - MGMT: Clear disabled connection parameters when loading none
 - MGMT: Fix discovery stuck after a failed Stop Discovery
 - validate retained LE Create CIS command length
 - validate retained LE Set CIG Parameters command length

Drivers:

 - btintel: fix buffer over-read in fw payload
 - btmtk: drop zero-length ISO packets from endpoint padding
 - btmtk: bound the ISO payload length by the controller's MTU
 - btmtk: derive the firmware ISO setting from MTK_ISO_THRESHOLD
 - btmtk: fix error handling in btmtk_usb_isointf_init()
 - qca: Fix the WCN3950 NVM baud rate offset

----------------------------------------------------------------
Akhil Arul (1):
      Bluetooth: hci_core: Fix queuing rx_work while workqueue is drained

Binbin Deng (3):
      Bluetooth: hci_core: Initialize IRK before publication
      Bluetooth: hci_core: Initialize link key before publication
      Bluetooth: hci_core: Initialize LTK before publication

Catherine L (1):
      Bluetooth: btintel: fix buffer over-read in fw payload

Cen Zhang (7):
      Bluetooth: hci_sync: Copy the LE accept list under hdev->lock
      Bluetooth: hci_sync: Protect resolving-list lookups
      Bluetooth: hci_core: Keep link-key filtering inside RCU
      Bluetooth: SMP: Protect link keys during LTK derivation
      Bluetooth: SMP: Protect LTK encryption with RCU
      Bluetooth: hci_sync: Copy the resolving-list IRK under RCU
      Bluetooth: hci_core: Initialize advertising RPA work only once

Chris Lu (3):
      Bluetooth: btmtk: drop zero-length ISO packets from endpoint padding
      Bluetooth: btmtk: bound the ISO payload length by the controller's MTU
      Bluetooth: btmtk: derive the firmware ISO setting from MTK_ISO_THRESHOLD

Ismail Tarim (1):
      Bluetooth: btmtk: fix error handling in btmtk_usb_isointf_init()

Jinwang Li (1):
      Bluetooth: L2CAP: Ignore connection responses with wrong ident

Kevin Dewald (3):
      Bluetooth: hci_event: Clear explicit connect state on LE connection
      Bluetooth: MGMT: Clear disabled connection parameters when loading none
      Bluetooth: MGMT: Fix discovery stuck after a failed Stop Discovery

Luiz Augusto von Dentz (4):
      Bluetooth: hci_sync: Fix invalid Supervision_Timeout in LE Set Default Rate
      Bluetooth: hci_core: Convert hci_conn flags to a bitmap
      Bluetooth: L2CAP: Hold incoming data until encryption key size is known
      Bluetooth: hci_sync: Update the CIS host feature when enabling LE

Michael McAllister (1):
      Bluetooth: qca: Fix the WCN3950 NVM baud rate offset

Tobias Wilken (1):
      Bluetooth: MGMT: Return RFKILLED for Set Powered on a blocked controller

Valentin Kindschi (2):
      Bluetooth: hci_sync: re-enable legacy advertising on resume
      Bluetooth: hci_sync: pause advertising for the scan address update

Yifan Zhang (2):
      Bluetooth: validate retained LE Create CIS command length
      Bluetooth: validate retained LE Set CIG Parameters command length

 drivers/bluetooth/btintel.c      |  24 ++++-
 drivers/bluetooth/btmtk.c        |  49 +++++++--
 drivers/bluetooth/btqca.c        |   3 +-
 include/net/bluetooth/hci_core.h | 104 +++++++++---------
 net/bluetooth/hci_conn.c         |  92 ++++++++--------
 net/bluetooth/hci_core.c         |  54 +++++++---
 net/bluetooth/hci_event.c        | 212 +++++++++++++++++++++++--------------
 net/bluetooth/hci_sync.c         | 223 ++++++++++++++++++++++++++++++---------
 net/bluetooth/iso.c              |  20 ++--
 net/bluetooth/l2cap_core.c       |  26 +++--
 net/bluetooth/mgmt.c             |  51 ++++++---
 net/bluetooth/smp.c              |  53 ++++++----
 12 files changed, 609 insertions(+), 302 deletions(-)

Re: [GIT PULL] bluetooth 2026-11-02

[Paolo Abeni]

On 11/2/26 23:20, Luiz Augusto von Dentz wrote:
> The following changes since commit c3e67bd82b9b9b1a5118f09a429ccefe2aab0741:
> 
>    ipv6: reject wrapped temporary address preferred lifetimes (2026-11-02 22:31:32 +0100)
> 
> are available in the Git repository at:
> 
>    git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth.git tags/for-net-2026-11-02
> 
> for you to fetch changes up to 60b10121db602a43ada3dbc39792bbf93d25991b:
> 
>    Bluetooth: MGMT: Fix discovery stuck after a failed Stop Discovery (2026-11-02 17:09:03 -0500)
> 
> ----------------------------------------------------------------
> bluetooth pull request for net:
> 
> Core:
> 
>   - hci_core: Initialize IRK before publication
>   - hci_core: Initialize link key before publication
>   - hci_core: Initialize LTK before publication
>   - hci_core: Fix queuing rx_work while workqueue is drained
>   - hci_core: Keep link-key filtering inside RCU
>   - hci_core: Initialize advertising RPA work only once
>   - hci_sync: Fix invalid Supervision_Timeout in LE Set Default Rate
>   - hci_sync: re-enable legacy advertising on resume
>   - hci_sync: pause advertising for the scan address update
>   - hci_sync: Update the CIS host feature when enabling LE
>   - hci_sync: Copy the LE accept list under hdev->lock
>   - hci_sync: Protect resolving-list lookups
>   - hci_sync: Copy the resolving-list IRK under RCU
>   - hci_event: Clear explicit connect state on LE connection
>   - L2CAP: Hold incoming data until encryption key size is known
>   - L2CAP: Ignore connection responses with wrong ident
>   - SMP: Protect link keys during LTK derivation
>   - SMP: Protect LTK encryption with RCU
>   - MGMT: Return RFKILLED for Set Powered on a blocked controller
>   - MGMT: Clear disabled connection parameters when loading none
>   - MGMT: Fix discovery stuck after a failed Stop Discovery
>   - validate retained LE Create CIS command length
>   - validate retained LE Set CIG Parameters command length
> 
> Drivers:
> 
>   - btintel: fix buffer over-read in fw payload
>   - btmtk: drop zero-length ISO packets from endpoint padding
>   - btmtk: bound the ISO payload length by the controller's MTU
>   - btmtk: derive the firmware ISO setting from MTK_ISO_THRESHOLD
>   - btmtk: fix error handling in btmtk_usb_isointf_init()
>   - qca: Fix the WCN3950 NVM baud rate offset
> 
> ----------------------------------------------------------------
> Akhil Arul (1):
>        Bluetooth: hci_core: Fix queuing rx_work while workqueue is drained
> 
> Binbin Deng (3):
>        Bluetooth: hci_core: Initialize IRK before publication
>        Bluetooth: hci_core: Initialize link key before publication
>        Bluetooth: hci_core: Initialize LTK before publication
> 
> Catherine L (1):
>        Bluetooth: btintel: fix buffer over-read in fw payload
> 
> Cen Zhang (7):
>        Bluetooth: hci_sync: Copy the LE accept list under hdev->lock
>        Bluetooth: hci_sync: Protect resolving-list lookups
>        Bluetooth: hci_core: Keep link-key filtering inside RCU
>        Bluetooth: SMP: Protect link keys during LTK derivation
>        Bluetooth: SMP: Protect LTK encryption with RCU
>        Bluetooth: hci_sync: Copy the resolving-list IRK under RCU
>        Bluetooth: hci_core: Initialize advertising RPA work only once
> 
> Chris Lu (3):
>        Bluetooth: btmtk: drop zero-length ISO packets from endpoint padding
>        Bluetooth: btmtk: bound the ISO payload length by the controller's MTU
>        Bluetooth: btmtk: derive the firmware ISO setting from MTK_ISO_THRESHOLD
> 
> Ismail Tarim (1):
>        Bluetooth: btmtk: fix error handling in btmtk_usb_isointf_init()
> 
> Jinwang Li (1):
>        Bluetooth: L2CAP: Ignore connection responses with wrong ident
> 
> Kevin Dewald (3):
>        Bluetooth: hci_event: Clear explicit connect state on LE connection
>        Bluetooth: MGMT: Clear disabled connection parameters when loading none
>        Bluetooth: MGMT: Fix discovery stuck after a failed Stop Discovery
> 
> Luiz Augusto von Dentz (4):
>        Bluetooth: hci_sync: Fix invalid Supervision_Timeout in LE Set Default Rate
>        Bluetooth: hci_core: Convert hci_conn flags to a bitmap
>        Bluetooth: L2CAP: Hold incoming data until encryption key size is known
>        Bluetooth: hci_sync: Update the CIS host feature when enabling LE
> 
> Michael McAllister (1):
>        Bluetooth: qca: Fix the WCN3950 NVM baud rate offset
> 
> Tobias Wilken (1):
>        Bluetooth: MGMT: Return RFKILLED for Set Powered on a blocked controller
> 
> Valentin Kindschi (2):
>        Bluetooth: hci_sync: re-enable legacy advertising on resume
>        Bluetooth: hci_sync: pause advertising for the scan address update
> 
> Yifan Zhang (2):
>        Bluetooth: validate retained LE Create CIS command length
>        Bluetooth: validate retained LE Set CIG Parameters command length
Not intended to block this PR, but it feels quite large.
My understanding is that Linus is still actively pushing for smaller/
not ever increasing RC releases, and we should keep trying to redirect
to next non urgent fixes (i.e. the coccinelle ones fell like candidates
for postponing).

Please try to keep 'net' PR as slim as possible.

Also I guess you are already aware, but the `Assisted-by: LLM` tag is
now actively discouraged/should not be included anymore.

Thanks,

Paolo

Re: [GIT PULL] bluetooth 2026-11-02

[patchwork-bot+netdevbpf]

Hello:

This pull request was applied to netdev/net.git (main)
by Paolo Abeni <pabeni@redhat.com>:

On Mon,  2 Nov 2026 17:20:18 -0500 you wrote:
> The following changes since commit c3e67bd82b9b9b1a5118f09a429ccefe2aab0741:
> 
>   ipv6: reject wrapped temporary address preferred lifetimes (2026-11-02 22:31:32 +0100)
> 
> are available in the Git repository at:
> 
>   git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth.git tags/for-net-2026-11-02
> 
> [...]

Here is the summary with links:
  - [GIT,PULL] bluetooth 2026-11-02
    https://git.kernel.org/netdev/net/c/03d36763291e

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html