kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-20 19:23:40 +00:00
Code Issues Releases Packages Activity

bluetooth pull request for net:

Browse source 
- hci_conn: fix potential UAF in create_big_sync
  - hci_event: fix memset typo
  - hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt
  - L2CAP: fix MPS check in l2cap_ecred_reconf_req
  - L2CAP: defer conn param update to avoid conn->lock/hdev->lock inversion
  - L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb()
  - L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb()
  - L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb()
  - RFCOMM: pull credit byte with skb_pull_data()
  - SCO: fix sleeping under spinlock in sco_conn_ready
  - SCO: hold sk properly in sco_conn_ready
  - ISO: Fix data-race on dst in iso_sock_connect()
  - ISO: Fix data-race on iso_pi(sk) in socket and HCI event paths
  - bnep: fix incorrect length parsing in bnep_rx_frame() extension handling
  - hci_uart: Fix NULL deref in recv callbacks when priv is uninitialized
  - virtio_bt: clamp rx length before skb_put
  - virtio_bt: validate rx pkt_type header length
  - HIDP: serialise l2cap_unregister_user via hidp_session_sem
  - btintel_pcie: treat boot stage bit 12 as warning
  - btmtk: validate WMT event SKB length before struct access
 -----BEGIN PGP SIGNATURE-----
 
 iQJNBAABCgA3FiEE7E6oRXp8w05ovYr/9JCA4xAyCykFAmn7qCwZHGx1aXoudm9u
 LmRlbnR6QGludGVsLmNvbQAKCRD0kIDjEDILKdbuD/wIj4GwiCd/vWz6qEdbK3Xl
 naw2i1HH4W3cLSDbEREQ7pJos+Uti6VqdzgW3yldzpKG3rZRjCx5hh3HxqmpuWmI
 LbCv4cI13ZfPgjfRqyjmX2AhpY8zkeOVy5wFiIVQsqsRm6s30g7lqxPkMPYG0K2G
 FDjS06iZsoRGXRFp2+lqpSk1H/90Bcz78yDyEr0qoHxpxUace2lx5gVmoZQxWasx
 Y5dcuNSVUvnftHMd4Lv2pehllpJDbmuyll1aVrhqEueRqdmyocjINXZRyYTdrECz
 8WR4tiax1zvl/eYgJ6zdVLJ1Iva1HyiTVN5tY0uSM03+u1P/OxSInkoo2VSZoIIK
 bQUFQ92Xml1J0qL6g0rwEHESEYzaJXz9Ai+XdAFzHv1RkziiYRkDqvPFjivqh/JG
 QeOuNosSKGfG9V5m02Ym/GVTdE59xonukNr+RaIdpt6djsybv4go+E8RpnxVyQvy
 5CMKchOvE6TnW3JRcaaXtC9cdMfOAjgBiebnWTguFBLutpPf1z8EhiKNFyYlt1yb
 r8tNhci6jimoD9hKzemEuKwyP07HnBo8B361kHByFYfhBHs+XZANtcVyMo6HtbqE
 94eRdWvKBvG3ixAP5/ujqrmp9HFyMBhZPc3XimZxkBx71/JCqcSpsQHGtQRvAiXy
 4FKJXqDINoOtpkggRQfkyQ==
 =KbxG
 -----END PGP SIGNATURE-----

Merge tag 'for-net-2026-05-06' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth

Luiz Augusto von Dentz says:

====================
bluetooth pull request for net:

 - hci_conn: fix potential UAF in create_big_sync
 - hci_event: fix memset typo
 - hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt
 - L2CAP: fix MPS check in l2cap_ecred_reconf_req
 - L2CAP: defer conn param update to avoid conn->lock/hdev->lock inversion
 - L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb()
 - L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb()
 - L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb()
 - RFCOMM: pull credit byte with skb_pull_data()
 - SCO: fix sleeping under spinlock in sco_conn_ready
 - SCO: hold sk properly in sco_conn_ready
 - ISO: Fix data-race on dst in iso_sock_connect()
 - ISO: Fix data-race on iso_pi(sk) in socket and HCI event paths
 - bnep: fix incorrect length parsing in bnep_rx_frame() extension handling
 - hci_uart: Fix NULL deref in recv callbacks when priv is uninitialized
 - virtio_bt: clamp rx length before skb_put
 - virtio_bt: validate rx pkt_type header length
 - HIDP: serialise l2cap_unregister_user via hidp_session_sem
 - btintel_pcie: treat boot stage bit 12 as warning
 - btmtk: validate WMT event SKB length before struct access

* tag 'for-net-2026-05-06' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth:
  Bluetooth: HIDP: serialise l2cap_unregister_user via hidp_session_sem
  Bluetooth: hci_event: fix memset typo
  Bluetooth: RFCOMM: pull credit byte with skb_pull_data()
  Bluetooth: virtio_bt: validate rx pkt_type header length
  Bluetooth: virtio_bt: clamp rx length before skb_put
  Bluetooth: btmtk: validate WMT event SKB length before struct access
  Bluetooth: ISO: Fix data-race on iso_pi(sk) in socket and HCI event paths
  Bluetooth: ISO: Fix data-race on dst in iso_sock_connect()
  Bluetooth: hci_uart: Fix NULL deref in recv callbacks when priv is uninitialized
  Bluetooth: btintel_pcie: treat boot stage bit 12 as warning
  Bluetooth: SCO: hold sk properly in sco_conn_ready
  Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb()
  Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb()
  Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb()
  Bluetooth: l2cap: defer conn param update to avoid conn->lock/hdev->lock inversion
  Bluetooth: l2cap: fix MPS check in l2cap_ecred_reconf_req
  Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling
  Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt
  Bluetooth: hci_conn: fix potential UAF in create_big_sync
  Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready
====================

Link: https://patch.msgid.link/20260506204553.58686-1-luiz.dentz@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Jakub Kicinski 2026-05-06 15:43:33 -07:00
commit bd75e1003d
18 changed files with 320 additions and 102 deletions
Download patch file Download diff file Expand all files Collapse all files