[GIT PULL] bluetooth 2026-05-27

[GIT PULL] bluetooth 2026-05-27

[Luiz Augusto von Dentz]

The following changes since commit ab1513597c6cf17cd1ad2a21e3b045421b48e022:

  Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (2026-05-20 16:35:47 -0400)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth.git tags/for-net-2026-05-27

for you to fetch changes up to df35e8e0c8c4160c881bb673e3c7ee010824fbd5:

  Bluetooth: hci_sync: Reset device counters in hci_dev_close_sync() (2026-05-27 16:44:02 -0400)

----------------------------------------------------------------
bluetooth pull request for net:

 - hci_core: Rework hci_dev_do_reset() to use hci_sync functions
 - hci_conn: Fix memory leak in hci_le_big_terminate()
 - hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close
 - hci_sync: Reset device counters in hci_dev_close_sync()
 - hci_sync: fix UAF in hci_le_create_cis_sync
 - L2CAP: Fix possible crash on l2cap_ecred_conn_rsp
 - L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn
 - L2CAP: use chan timer to close channels in cleanup_listen()
 - L2CAP: clear chan->ident on ECRED reconfiguration success
 - ISO: fix UAF in iso_recv_frame
 - ISO: serialize iso_sock_clear_timer with socket lock
 - HIDP: fix missing length checks in hidp_input_report()
 - 6lowpan: check skb_clone() return value in send_mcast_pkt()
 - btusb: Allow firmware re-download when version matches
 - hci_qca: Use 100 ms SSR delay for rampatch and NVM loading

----------------------------------------------------------------
Doruk Tan Ozturk (1):
      Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync

Heitor Alves de Siqueira (3):
      Bluetooth: hci_core: Rework hci_dev_do_reset() to use hci_sync functions
      Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close
      Bluetooth: hci_sync: Reset device counters in hci_dev_close_sync()

Luiz Augusto von Dentz (1):
      Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp

Muhammad Bilal (3):
      Bluetooth: HIDP: fix missing length checks in hidp_input_report()
      Bluetooth: ISO: fix UAF in iso_recv_frame
      Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock

Pavitra Jha (1):
      Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate()

Shuai Zhang (2):
      Bluetooth: btusb: Allow firmware re-download when version matches
      Bluetooth: hci_qca: Use 100 ms SSR delay for rampatch and NVM loading

Siwei Zhang (2):
      Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn
      Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen()

Zhao Dongdong (1):
      Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt()

Zhenghang Xiao (1):
      Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success

 drivers/bluetooth/btusb.c   |  8 +++++++-
 drivers/bluetooth/hci_qca.c |  4 ++--
 net/bluetooth/6lowpan.c     |  2 ++
 net/bluetooth/hci_conn.c    |  4 +++-
 net/bluetooth/hci_core.c    | 43 +++----------------------------------------
 net/bluetooth/hci_sync.c    | 16 +++++++++++++++-
 net/bluetooth/hidp/core.c   | 23 ++++++++++++++++++-----
 net/bluetooth/iso.c         | 12 ++++++++----
 net/bluetooth/l2cap_core.c  | 41 +++++++++++++++++++++++++++++++++--------
 net/bluetooth/l2cap_sock.c  | 16 +++++++++-------
 10 files changed, 100 insertions(+), 69 deletions(-)

Re: [GIT PULL] bluetooth 2026-05-27

[Jakub Kicinski]

On Wed, 27 May 2026 17:12:46 -0400 Luiz Augusto von Dentz wrote:
> The following changes since commit ab1513597c6cf17cd1ad2a21e3b045421b48e022:
> 
>   Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (2026-05-20 16:35:47 -0400)
> 
> are available in the Git repository at:
> 
>   git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth.git tags/for-net-2026-05-27
> 
> for you to fetch changes up to df35e8e0c8c4160c881bb673e3c7ee010824fbd5:
> 
>   Bluetooth: hci_sync: Reset device counters in hci_dev_close_sync() (2026-05-27 16:44:02 -0400)

Are you still rebasing? Or did Linus convince you not to? :)
Looks like we are missing your sign-off on:

Commit c3d01980c64a ("Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success")
	committer Signed-off-by missing
	author email:    kipreyyy@gmail.com
	committer email: luiz.von.dentz@intel.com
	Signed-off-by: Zhenghang Xiao <kipreyyy@gmail.com>

If you're planning to no longer rebase your tress - don't worry about
it. It's not a deal breaker. If you are rebasing anyway - could you
amend?