[GIT PULL] bluetooth 2026-05-28

[GIT PULL] bluetooth 2026-05-28

[Luiz Augusto von Dentz]

The following changes since commit ab1513597c6cf17cd1ad2a21e3b045421b48e022:

  Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (2026-05-20 16:35:47 -0400)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth.git tags/for-net-2026-05-28

for you to fetch changes up to cdf88b35e06f1b385f7f6228060ae541d44fbb72:

  Bluetooth: hci_sync: Reset device counters in hci_dev_close_sync() (2026-05-28 08:52:21 -0400)

----------------------------------------------------------------
bluetooth pull request for net:

 - hci_core: Rework hci_dev_do_reset() to use hci_sync functions
 - hci_conn: Fix memory leak in hci_le_big_terminate()
 - hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close
 - hci_sync: Reset device counters in hci_dev_close_sync()
 - hci_sync: fix UAF in hci_le_create_cis_sync
 - L2CAP: Fix possible crash on l2cap_ecred_conn_rsp
 - L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn
 - L2CAP: use chan timer to close channels in cleanup_listen()
 - L2CAP: clear chan->ident on ECRED reconfiguration success
 - ISO: fix UAF in iso_recv_frame
 - ISO: serialize iso_sock_clear_timer with socket lock
 - HIDP: fix missing length checks in hidp_input_report()
 - 6lowpan: check skb_clone() return value in send_mcast_pkt()
 - btusb: Allow firmware re-download when version matches
 - hci_qca: Use 100 ms SSR delay for rampatch and NVM loading

----------------------------------------------------------------
Doruk Tan Ozturk (1):
      Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync

Heitor Alves de Siqueira (3):
      Bluetooth: hci_core: Rework hci_dev_do_reset() to use hci_sync functions
      Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close
      Bluetooth: hci_sync: Reset device counters in hci_dev_close_sync()

Luiz Augusto von Dentz (1):
      Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp

Muhammad Bilal (3):
      Bluetooth: HIDP: fix missing length checks in hidp_input_report()
      Bluetooth: ISO: fix UAF in iso_recv_frame
      Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock

Pavitra Jha (1):
      Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate()

Shuai Zhang (2):
      Bluetooth: btusb: Allow firmware re-download when version matches
      Bluetooth: hci_qca: Use 100 ms SSR delay for rampatch and NVM loading

Siwei Zhang (2):
      Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn
      Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen()

Zhao Dongdong (1):
      Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt()

Zhenghang Xiao (1):
      Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success

 drivers/bluetooth/btusb.c   |  8 +++++++-
 drivers/bluetooth/hci_qca.c |  4 ++--
 net/bluetooth/6lowpan.c     |  2 ++
 net/bluetooth/hci_conn.c    |  4 +++-
 net/bluetooth/hci_core.c    | 43 +++----------------------------------------
 net/bluetooth/hci_sync.c    | 16 +++++++++++++++-
 net/bluetooth/hidp/core.c   | 23 ++++++++++++++++++-----
 net/bluetooth/iso.c         | 12 ++++++++----
 net/bluetooth/l2cap_core.c  | 41 +++++++++++++++++++++++++++++++++--------
 net/bluetooth/l2cap_sock.c  | 16 +++++++++-------
 10 files changed, 100 insertions(+), 69 deletions(-)

Re: [GIT PULL] bluetooth 2026-05-28

[Paolo Abeni]

On 5/28/26 3:18 PM, Luiz Augusto von Dentz wrote:
> The following changes since commit ab1513597c6cf17cd1ad2a21e3b045421b48e022:
> 
>   Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (2026-05-20 16:35:47 -0400)
> 
> are available in the Git repository at:
> 
>   git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth.git tags/for-net-2026-05-28
> 
> for you to fetch changes up to cdf88b35e06f1b385f7f6228060ae541d44fbb72:
> 
>   Bluetooth: hci_sync: Reset device counters in hci_dev_close_sync() (2026-05-28 08:52:21 -0400)
> 
> ----------------------------------------------------------------
> bluetooth pull request for net:
> 
>  - hci_core: Rework hci_dev_do_reset() to use hci_sync functions
>  - hci_conn: Fix memory leak in hci_le_big_terminate()
>  - hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close
>  - hci_sync: Reset device counters in hci_dev_close_sync()
>  - hci_sync: fix UAF in hci_le_create_cis_sync
>  - L2CAP: Fix possible crash on l2cap_ecred_conn_rsp
>  - L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn
>  - L2CAP: use chan timer to close channels in cleanup_listen()
>  - L2CAP: clear chan->ident on ECRED reconfiguration success
>  - ISO: fix UAF in iso_recv_frame
>  - ISO: serialize iso_sock_clear_timer with socket lock
>  - HIDP: fix missing length checks in hidp_input_report()
>  - 6lowpan: check skb_clone() return value in send_mcast_pkt()
>  - btusb: Allow firmware re-download when version matches
>  - hci_qca: Use 100 ms SSR delay for rampatch and NVM loading

I'm sorry, it did not fit today's net PR; I started cooking it quite a
bit earlier than this one, and I looked back at the ML only after
completion.

/P

Re: [GIT PULL] bluetooth 2026-05-28

[Luiz Augusto von Dentz]

Hi Paolo,

On Thu, May 28, 2026 at 11:52 AM Paolo Abeni <pabeni@redhat.com> wrote:
>
> On 5/28/26 3:18 PM, Luiz Augusto von Dentz wrote:
> > The following changes since commit ab1513597c6cf17cd1ad2a21e3b045421b48e022:
> >
> >   Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (2026-05-20 16:35:47 -0400)
> >
> > are available in the Git repository at:
> >
> >   git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth.git tags/for-net-2026-05-28
> >
> > for you to fetch changes up to cdf88b35e06f1b385f7f6228060ae541d44fbb72:
> >
> >   Bluetooth: hci_sync: Reset device counters in hci_dev_close_sync() (2026-05-28 08:52:21 -0400)
> >
> > ----------------------------------------------------------------
> > bluetooth pull request for net:
> >
> >  - hci_core: Rework hci_dev_do_reset() to use hci_sync functions
> >  - hci_conn: Fix memory leak in hci_le_big_terminate()
> >  - hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close
> >  - hci_sync: Reset device counters in hci_dev_close_sync()
> >  - hci_sync: fix UAF in hci_le_create_cis_sync
> >  - L2CAP: Fix possible crash on l2cap_ecred_conn_rsp
> >  - L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn
> >  - L2CAP: use chan timer to close channels in cleanup_listen()
> >  - L2CAP: clear chan->ident on ECRED reconfiguration success
> >  - ISO: fix UAF in iso_recv_frame
> >  - ISO: serialize iso_sock_clear_timer with socket lock
> >  - HIDP: fix missing length checks in hidp_input_report()
> >  - 6lowpan: check skb_clone() return value in send_mcast_pkt()
> >  - btusb: Allow firmware re-download when version matches
> >  - hci_qca: Use 100 ms SSR delay for rampatch and NVM loading
>
> I'm sorry, it did not fit today's net PR; I started cooking it quite a
> bit earlier than this one, and I looked back at the ML only after
> completion.

Well I guess it will need to be merged for the next PR. That said, I
wonder if I need to submit it one day earlier since there is a risk it
doesn't get merged immediately, causing us to miss a week of the RC
cycle. Maybe due to high influx of AI/Security patches we will need to
submit it twice a week or something.

-- 
Luiz Augusto von Dentz

Re: [GIT PULL] bluetooth 2026-05-28

[patchwork-bot+netdevbpf]

Hello:

This pull request was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Thu, 28 May 2026 09:18:39 -0400 you wrote:
> The following changes since commit ab1513597c6cf17cd1ad2a21e3b045421b48e022:
> 
>   Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (2026-05-20 16:35:47 -0400)
> 
> are available in the Git repository at:
> 
>   git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth.git tags/for-net-2026-05-28
> 
> [...]

Here is the summary with links:
  - [GIT,PULL] bluetooth 2026-05-28
    https://git.kernel.org/netdev/net/c/2412591cfe66

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html

Re: [GIT PULL] bluetooth 2026-05-28

[Paolo Abeni]

On 5/28/26 6:10 PM, Luiz Augusto von Dentz wrote:
> On Thu, May 28, 2026 at 11:52 AM Paolo Abeni <pabeni@redhat.com> wrote:
>> On 5/28/26 3:18 PM, Luiz Augusto von Dentz wrote:
>>> The following changes since commit ab1513597c6cf17cd1ad2a21e3b045421b48e022:
>>>
>>>   Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (2026-05-20 16:35:47 -0400)
>>>
>>> are available in the Git repository at:
>>>
>>>   git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth.git tags/for-net-2026-05-28
>>>
>>> for you to fetch changes up to cdf88b35e06f1b385f7f6228060ae541d44fbb72:
>>>
>>>   Bluetooth: hci_sync: Reset device counters in hci_dev_close_sync() (2026-05-28 08:52:21 -0400)
>>>
>>> ----------------------------------------------------------------
>>> bluetooth pull request for net:
>>>
>>>  - hci_core: Rework hci_dev_do_reset() to use hci_sync functions
>>>  - hci_conn: Fix memory leak in hci_le_big_terminate()
>>>  - hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close
>>>  - hci_sync: Reset device counters in hci_dev_close_sync()
>>>  - hci_sync: fix UAF in hci_le_create_cis_sync
>>>  - L2CAP: Fix possible crash on l2cap_ecred_conn_rsp
>>>  - L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn
>>>  - L2CAP: use chan timer to close channels in cleanup_listen()
>>>  - L2CAP: clear chan->ident on ECRED reconfiguration success
>>>  - ISO: fix UAF in iso_recv_frame
>>>  - ISO: serialize iso_sock_clear_timer with socket lock
>>>  - HIDP: fix missing length checks in hidp_input_report()
>>>  - 6lowpan: check skb_clone() return value in send_mcast_pkt()
>>>  - btusb: Allow firmware re-download when version matches
>>>  - hci_qca: Use 100 ms SSR delay for rampatch and NVM loading
>>
>> I'm sorry, it did not fit today's net PR; I started cooking it quite a
>> bit earlier than this one, and I looked back at the ML only after
>> completion.
> 
> Well I guess it will need to be merged for the next PR. That said, I
> wonder if I need to submit it one day earlier since there is a risk it
> doesn't get merged immediately, causing us to miss a week of the RC
> cycle. Maybe due to high influx of AI/Security patches we will need to
> submit it twice a week or something.

Indeed the AI generated load is impacting our workflow in many ways.
Among other things, our patch processing latency is roughly doubled
according to my complete wild guess. I agree posting the BT PR 1 day
earlier would be better.

Even multiple PRs per week makes sense to me, if the average size is
still significant. I'm not sure about others maintainers opinion, please
don't take my last statement as "a please go ahead with this" before
more acks.

Thanks,

Paolo

Re: [GIT PULL] bluetooth 2026-05-28

[Jakub Kicinski]

On Fri, 29 May 2026 09:35:20 +0200 Paolo Abeni wrote:
> Even multiple PRs per week makes sense to me, if the average size is
> still significant. I'm not sure about others maintainers opinion, please
> don't take my last statement as "a please go ahead with this" before
> more acks.

That's a pretty costly fix. It takes me ~3h to generate the PR I suspect
it takes you similar amount of time. So it's not going to help the
patch review queue if we waste time generating multiple PRs.

Luiz, simply run this bash script before you send the PR:

github.com/linux-netdev/nipa/blob/master/tests/patch/verify_signedoff/verify_signedoff.sh

it's not the first time you're missing SoBs

Re: [GIT PULL] bluetooth 2026-05-28

[Luiz Augusto von Dentz]

Hi Jakub,

On Fri, May 29, 2026 at 2:20 PM Jakub Kicinski <kuba@kernel.org> wrote:
>
> On Fri, 29 May 2026 09:35:20 +0200 Paolo Abeni wrote:
> > Even multiple PRs per week makes sense to me, if the average size is
> > still significant. I'm not sure about others maintainers opinion, please
> > don't take my last statement as "a please go ahead with this" before
> > more acks.
>
> That's a pretty costly fix. It takes me ~3h to generate the PR I suspect
> it takes you similar amount of time. So it's not going to help the
> patch review queue if we waste time generating multiple PRs.
>
> Luiz, simply run this bash script before you send the PR:
>
> github.com/linux-netdev/nipa/blob/master/tests/patch/verify_signedoff/verify_signedoff.sh
>
> it's not the first time you're missing SoBs

Ive already integrated it our CI:

https://github.com/bluez/action-ci/commit/c1b86bca7cacc936bea82b3ca8b2ee4b4fcb6e74
https://github.com/bluez/bluetooth-next/pull/257/checks?check_run_id=78559358818

I might be missing a local hook though, in this case it seems my SoB
was missing, maybe I could configure git am to always adds SoBs, that
said we don't use that on userspace portion of the stack.

-- 
Luiz Augusto von Dentz