From: Luiz Augusto von Dentz <luiz.dentz@gmail.com>
To: davem@davemloft.net, kuba@kernel.org
Cc: linux-bluetooth@vger.kernel.org, netdev@vger.kernel.org
Subject: [GIT PULL] bluetooth 2026-05-06
Date: Wed, 6 May 2026 16:45:53 -0400 [thread overview]
Message-ID: <20260506204553.58686-1-luiz.dentz@gmail.com> (raw)
The following changes since commit b89e0100a5f6885f9748bbacc3f4e3bcff654e4c:
Merge tag 'wireless-2026-05-06' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless (2026-05-06 07:29:31 -0700)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth.git tags/for-net-2026-05-06
for you to fetch changes up to c5d415596cb6fbdf6334b06cc87a1a5a268d8725:
Bluetooth: HIDP: serialise l2cap_unregister_user via hidp_session_sem (2026-05-06 16:27:53 -0400)
----------------------------------------------------------------
bluetooth pull request for net:
- hci_conn: fix potential UAF in create_big_sync
- hci_event: fix memset typo
- hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt
- L2CAP: fix MPS check in l2cap_ecred_reconf_req
- L2CAP: defer conn param update to avoid conn->lock/hdev->lock inversion
- L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb()
- L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb()
- L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb()
- RFCOMM: pull credit byte with skb_pull_data()
- SCO: fix sleeping under spinlock in sco_conn_ready
- SCO: hold sk properly in sco_conn_ready
- ISO: Fix data-race on dst in iso_sock_connect()
- ISO: Fix data-race on iso_pi(sk) in socket and HCI event paths
- bnep: fix incorrect length parsing in bnep_rx_frame() extension handling
- hci_uart: Fix NULL deref in recv callbacks when priv is uninitialized
- virtio_bt: clamp rx length before skb_put
- virtio_bt: validate rx pkt_type header length
- HIDP: serialise l2cap_unregister_user via hidp_session_sem
- btintel_pcie: treat boot stage bit 12 as warning
- btmtk: validate WMT event SKB length before struct access
----------------------------------------------------------------
Aurelien DESBRIERES (1):
Bluetooth: hci_uart: Fix NULL deref in recv callbacks when priv is uninitialized
David Carlier (1):
Bluetooth: hci_conn: fix potential UAF in create_big_sync
Dudu Lu (2):
Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling
Bluetooth: l2cap: fix MPS check in l2cap_ecred_reconf_req
Jann Horn (1):
Bluetooth: hci_event: fix memset typo
Luiz Augusto von Dentz (1):
Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt
Michael Bommarito (3):
Bluetooth: virtio_bt: clamp rx length before skb_put
Bluetooth: virtio_bt: validate rx pkt_type header length
Bluetooth: HIDP: serialise l2cap_unregister_user via hidp_session_sem
Mikhail Gavrilov (1):
Bluetooth: l2cap: defer conn param update to avoid conn->lock/hdev->lock inversion
Pauli Virtanen (2):
Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready
Bluetooth: SCO: hold sk properly in sco_conn_ready
Pengpeng Hou (1):
Bluetooth: RFCOMM: pull credit byte with skb_pull_data()
Sai Teja Aluvala (1):
Bluetooth: btintel_pcie: treat boot stage bit 12 as warning
SeungJu Cheon (2):
Bluetooth: ISO: Fix data-race on dst in iso_sock_connect()
Bluetooth: ISO: Fix data-race on iso_pi(sk) in socket and HCI event paths
Siwei Zhang (3):
Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb()
Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb()
Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb()
Tristan Madani (1):
Bluetooth: btmtk: validate WMT event SKB length before struct access
drivers/bluetooth/btintel_pcie.c | 13 +++-
drivers/bluetooth/btintel_pcie.h | 2 +-
drivers/bluetooth/btmtk.c | 15 ++++-
drivers/bluetooth/hci_ath.c | 3 +
drivers/bluetooth/hci_bcsp.c | 3 +
drivers/bluetooth/hci_h4.c | 3 +
drivers/bluetooth/hci_h5.c | 3 +
drivers/bluetooth/virtio_bt.c | 39 +++++++++---
include/net/bluetooth/hci_core.h | 2 +-
net/bluetooth/bnep/core.c | 13 +++-
net/bluetooth/hci_conn.c | 124 ++++++++++++++++++++++++++++++++-------
net/bluetooth/hci_event.c | 29 ++++++++-
net/bluetooth/hidp/core.c | 27 ++++++++-
net/bluetooth/iso.c | 56 ++++++++++--------
net/bluetooth/l2cap_core.c | 14 +----
net/bluetooth/l2cap_sock.c | 9 +++
net/bluetooth/rfcomm/core.c | 7 ++-
net/bluetooth/sco.c | 60 ++++++++++++-------
18 files changed, 320 insertions(+), 102 deletions(-)
next reply other threads:[~2026-05-06 20:46 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-05-06 20:45 Luiz Augusto von Dentz [this message]
2026-05-06 22:50 ` [GIT PULL] bluetooth 2026-05-06 patchwork-bot+netdevbpf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260506204553.58686-1-luiz.dentz@gmail.com \
--to=luiz.dentz@gmail.com \
--cc=davem@davemloft.net \
--cc=kuba@kernel.org \
--cc=linux-bluetooth@vger.kernel.org \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox