bluetooth pull request for net:

Core:
 
  - hci_sysfs: Fix NULL pointer dereference in device_del()
  - hci_sync: Fix not setting CE length properly
  - btqcomsmd: destroy RPMsg endpoints before freeing hci_dev
 
 Drivers:
 
  - btmtk: Declare MT7920 (MT7961 1a) Bluetooth firmware
  - btusb: mediatek: Fix leaked runtime PM reference in reset
  - btusb: Fix leaked runtime PM reference in btusb_reset
  - btusb: Fix UAF of btusb_data by rx_work
  - btusb: Properly disable remote wakeup for MT7922/MT7925 on Ryzen platform
  - btintel_pcie: validate packet_len before skb_put_data
  - btintel_pcie: fix tx_handle bounds off-by-one
  - btrtl: Don't leak return code when parsing firmware format v2
 -----BEGIN PGP SIGNATURE-----
 
 iQJNBAABCgA3FiEE7E6oRXp8w05ovYr/9JCA4xAyCykFAmqge+cZHGx1aXoudm9u
 LmRlbnR6QGludGVsLmNvbQAKCRD0kIDjEDILKdY3EACTdTdiS8WX8MHynuHzdp/n
 QsB6nHnt9MFfFqNSngmP2GzHB3dS9fGBHu19by4fSM/5DPpjBNT9h2UB9jMKZ3Ps
 lg2sLYTBm/9y0HYVYKfsZKhTYWU790OlNfCHNzYze0qYgHG6JB3KY87Rfay/GAsK
 4t2PCnRJNSq3O3QHsGmg8USo2Vz7xH0ucKBoblHHHWH90n9ZgTPATq0Pt9/9MwPa
 WxOcKbsgsGZ4ZeDbi+Tu5I9froR1bwh18q+c+f+0DXV75k8csJUy2Ro2G9GXXbW2
 96K7BpVy9BWKNnoSxWMy+jFZZRd0WmWHy8IcunYV6c65LLRlDjyJJ9fjCCbhT+ej
 Rsu7Ows0iTaBs/eWBaMyDLU12eNh2Fr5uFKkZXzMCcTLkPJWYkvOdtRA502D3F4t
 /dnk6dME5btAvHS/47QSlQ3JmpHuM1VL5GynLhkeIw2td16gDh3l5VbtUsANNbMn
 w9jL+YGgGA7nMClfR8VwKueypHqIClLQohbz14uvlqaXbsM5vgP86IF6jmSLdX2q
 DUSXeuk+EhuD5keP5bDriMRJCEKNYNO4DKlcCAkMc6nZqGJRin9tix1r9q9fQf2t
 0IQOXaHE9WRyqK3wbxVuOI8UaYRGB+DtoSWTJ4T0Rf8wo3oduMbGGRv3R9lnPjKA
 1NNB9rCRO5PmHLHkGOihRA==
 =hxd3
 -----END PGP SIGNATURE-----

Merge tag 'for-net-2026-09-08' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth

Luiz Augusto von Dentz says:

====================
bluetooth pull request for net:

Core:

 - hci_sysfs: Fix NULL pointer dereference in device_del()
 - hci_sync: Fix not setting CE length properly
 - btqcomsmd: destroy RPMsg endpoints before freeing hci_dev

Drivers:

 - btmtk: Declare MT7920 (MT7961 1a) Bluetooth firmware
 - btusb: mediatek: Fix leaked runtime PM reference in reset
 - btusb: Fix leaked runtime PM reference in btusb_reset
 - btusb: Fix UAF of btusb_data by rx_work
 - btusb: Properly disable remote wakeup for MT7922/MT7925 on Ryzen platform
 - btintel_pcie: validate packet_len before skb_put_data
 - btintel_pcie: fix tx_handle bounds off-by-one
 - btrtl: Don't leak return code when parsing firmware format v2

* tag 'for-net-2026-09-08' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth:
  Bluetooth: btusb: Fix leaked runtime PM reference in btusb_reset
  Bluetooth: btusb: mediatek: Fix leaked runtime PM reference in reset
  Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev
  Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del()
  Bluetooth: btmtk: Declare MT7920 (MT7961 1a) Bluetooth firmware
  Bluetooth: hci_sync: Fix not setting CE length properly
  Bluetooth: btintel_pcie: fix tx_handle bounds off-by-one
  Bluetooth: btintel_pcie: validate packet_len before skb_put_data
  Bluetooth: btrtl: Don't leak return code when parsing firmware format v2
  Bluetooth: btusb: Fix UAF of btusb_data by rx_work
  Bluetooth: Properly disable remote wakeup for MT7922/MT7925 on Ryzen platform
====================

Link: https://patch.msgid.link/20260908212127.1022197-1-luiz.dentz@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Jakub Kicinski 2026-09-09 12:51:52 -07:00
commit bbee0759d3
8 changed files with 159 additions and 30 deletions