From: Luiz Augusto von Dentz <luiz.dentz@gmail.com>
To: davem@davemloft.net, kuba@kernel.org
Cc: linux-bluetooth@vger.kernel.org, netdev@vger.kernel.org
Subject: [GIT PULL] bluetooth 2026-03-12
Date: Thu, 12 Mar 2026 16:06:54 -0400 [thread overview]
Message-ID: <20260312200655.1215688-1-luiz.dentz@gmail.com> (raw)
The following changes since commit c38b8f5f791ecce13ab77e2257f8fd2444ba80f6:
net: prevent NULL deref in ip[6]tunnel_xmit() (2026-03-12 16:03:41 +0100)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth.git tags/for-net-2026-03-12
for you to fetch changes up to 99b2c531e0e797119ae1b9195a8764ee98b00e65:
Bluetooth: qca: fix ROM version reading on WCN3998 chips (2026-03-12 15:29:29 -0400)
----------------------------------------------------------------
bluetooth pull request for net:
- hci_sync: Fix hci_le_create_conn_sync
- MGMT: Fix list corruption and UAF in command complete handlers
- L2CAP: Disconnect if received packet's SDU exceeds IMTU
- L2CAP: Disconnect if sum of payload sizes exceed SDU
- L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ
- L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp()
- L2CAP: Validate L2CAP_INFO_RSP payload length before access
- L2CAP: Fix use-after-free in l2cap_unregister_user
- ISO: Fix defer tests being unstable
- HIDP: Fix possible UAF
- SMP: make SM/PER/KDU/BI-04-C happy
- qca: fix ROM version reading on WCN3998 chips
----------------------------------------------------------------
Christian Eggers (3):
Bluetooth: LE L2CAP: Disconnect if received packet's SDU exceeds IMTU
Bluetooth: LE L2CAP: Disconnect if sum of payload sizes exceed SDU
Bluetooth: SMP: make SM/PER/KDU/BI-04-C happy
Dmitry Baryshkov (1):
Bluetooth: qca: fix ROM version reading on WCN3998 chips
Luiz Augusto von Dentz (3):
Bluetooth: ISO: Fix defer tests being unstable
Bluetooth: HIDP: Fix possible UAF
Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ
Lukas Johannes Möller (2):
Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp()
Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access
Michael Grzeschik (1):
Bluetooth: hci_sync: Fix hci_le_create_conn_sync
Shaurya Rane (1):
Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user
Wang Tao (1):
Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers
drivers/bluetooth/btqca.c | 2 ++
net/bluetooth/hci_conn.c | 4 ++--
net/bluetooth/hci_sync.c | 2 +-
net/bluetooth/hidp/core.c | 16 +++++++++++++--
net/bluetooth/l2cap_core.c | 51 ++++++++++++++++++++++++++++------------------
net/bluetooth/mgmt.c | 7 ++-----
net/bluetooth/smp.c | 2 +-
7 files changed, 53 insertions(+), 31 deletions(-)
next reply other threads:[~2026-03-12 20:07 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-03-12 20:06 Luiz Augusto von Dentz [this message]
2026-03-14 16:47 ` [GIT PULL] bluetooth 2026-03-12 Jakub Kicinski
2026-03-16 13:58 ` Luiz Augusto von Dentz
2026-03-16 23:26 ` Jakub Kicinski
2026-03-17 20:45 ` Luiz Augusto von Dentz
2026-03-14 17:44 ` Jakub Kicinski
2026-03-15 15:04 ` Konstantin Ryabitsev
2026-03-15 20:20 ` Jakub Kicinski
2026-03-19 2:48 ` Jakub Kicinski
2026-03-19 13:21 ` Konstantin Ryabitsev
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260312200655.1215688-1-luiz.dentz@gmail.com \
--to=luiz.dentz@gmail.com \
--cc=davem@davemloft.net \
--cc=kuba@kernel.org \
--cc=linux-bluetooth@vger.kernel.org \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox