The following changes since commit eeb78df4063c0b162324a9408ef573b24791871f: inet: Add getsockopt support for IP_ROUTER_ALERT and IPV6_ROUTER_ALERT (2024-03-06 12:37:06 +0000) are available in the Git repository at: git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git tags/for-net-next-2024-03-08 for you to fetch changes up to 3d1c16e920c88eb5e583e1b4a10b95a5dc97ec22: Bluetooth: hci_sync: Fix UAF in hci_acl_create_conn_sync (2024-03-08 11:06:14 -0500) ---------------------------------------------------------------- bluetooth-next pull request for net-next: - hci_conn: Only do ACL connections sequentially - hci_core: Cancel request on command timeout - Remove CONFIG_BT_HS - btrtl: Add the support for RTL8852BT/RTL8852BE-VT - btusb: Add support Mediatek MT7920 - btusb: Add new VID/PID 13d3/3602 for MT7925 - Add new quirk for broken read key length on ATS2851 ---------------------------------------------------------------- Andrey Skvortsov (2): Bluetooth: hci_h5: Add ability to allocate memory for private data Bluetooth: btrtl: fix out of bounds memory access Bartosz Golaszewski (1): Bluetooth: hci_qca: don't use IS_ERR_OR_NULL() with gpiod_get_optional() Christophe JAILLET (3): Bluetooth: Remove usage of the deprecated ida_simple_xx() API Bluetooth: btbcm: Use strreplace() Bluetooth: btbcm: Use devm_kstrdup() Dan Carpenter (1): Bluetooth: ISO: Clean up returns values in iso_connect_ind() Edward Adam Davis (1): Bluetooth: btintel: Fix null ptr deref in btintel_read_version Frédéric Danis (1): Bluetooth: Fix eir name length Iulia Tanasescu (2): Bluetooth: ISO: Add hcon for listening bis sk Bluetooth: ISO: Reassemble PA data for bcast sink Jonas Dreßler (8): Bluetooth: Remove HCI_POWER_OFF_TIMEOUT Bluetooth: mgmt: Remove leftover queuing of power_off work Bluetooth: Add new state HCI_POWERING_DOWN Bluetooth: Disconnect connected devices before rfkilling adapter Bluetooth: Remove superfluous call to hci_conn_check_pending() Bluetooth: hci_event: Use HCI error defines instead of magic values Bluetooth: hci_conn: Only do ACL connections sequentially Bluetooth: Remove pending ACL connection attempts Kiran K (1): Bluetooth: btintel: Print Firmware Sequencer information Luiz Augusto von Dentz (20): Bluetooth: hci_core: Cancel request on command timeout Bluetooth: Remove BT_HS Bluetooth: hci_event: Fix not indicating new connection for BIG Sync Bluetooth: hci_conn: Always use sk_timeo as conn_timeout Bluetooth: hci_conn: Fix UAF Write in __hci_acl_create_connection_sync Bluetooth: hci_sync: Add helper functions to manipulate cmd_sync queue Bluetooth: hci_sync: Attempt to dequeue connection attempt Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync Bluetooth: hci_sync: Fix UAF on create_le_conn_complete Bluetooth: btintel: Fixe build regression Bluetooth: hci_sync: Use address filtering when HCI_PA_SYNC is set Bluetooth: hci_sync: Use QoS to determine which PHY to scan Bluetooth: hci_sync: Fix overwriting request callback Bluetooth: hci_core: Fix possible buffer overflow Bluetooth: msft: Fix memory leak Bluetooth: btusb: Fix memory leak Bluetooth: bnep: Fix out-of-bound access Bluetooth: af_bluetooth: Fix deadlock Bluetooth: ISO: Align broadcast sync_timeout with connection timeout Bluetooth: hci_sync: Fix UAF in hci_acl_create_conn_sync Lukas Bulwahn (1): Bluetooth: hci_event: Remove code to removed CONFIG_BT_HS Marcel Ziswiler (1): Bluetooth: btnxpuart: Fix btnxpuart_close Max Chou (1): Bluetooth: btrtl: Add the support for RTL8852BT/RTL8852BE-VT Neeraj Sanjay Kale (1): Bluetooth: btnxpuart: Resolve TX timeout error in power save stress test Pauli Virtanen (1): Bluetooth: fix use-after-free in accessing skb after sending it Peter Tsao (1): Bluetooth: btusb: Add support Mediatek MT7920 Ricardo B. Marliere (1): Bluetooth: constify the struct device_type usage Roman Smirnov (2): Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() Bluetooth: mgmt: remove NULL check in add_ext_adv_params_complete() Takashi Iwai (1): Bluetooth: btmtk: Add MODULE_FIRMWARE() for MT7922 Ulrik Strid (1): Bluetooth: btusb: Add new VID/PID 13d3/3602 for MT7925 Vinicius Peixoto (1): Bluetooth: Add new quirk for broken read key length on ATS2851 drivers/bluetooth/btbcm.c | 12 +- drivers/bluetooth/btintel.c | 116 +++- drivers/bluetooth/btmtk.c | 5 +- drivers/bluetooth/btmtk.h | 1 + drivers/bluetooth/btnxpuart.c | 27 +- drivers/bluetooth/btrtl.c | 14 + drivers/bluetooth/btusb.c | 30 +- drivers/bluetooth/hci_h5.c | 5 +- drivers/bluetooth/hci_qca.c | 6 +- drivers/bluetooth/hci_serdev.c | 9 +- drivers/bluetooth/hci_uart.h | 12 +- include/net/bluetooth/bluetooth.h | 2 + include/net/bluetooth/hci.h | 19 +- include/net/bluetooth/hci_core.h | 37 +- include/net/bluetooth/hci_sync.h | 22 +- include/net/bluetooth/l2cap.h | 44 +- net/bluetooth/6lowpan.c | 4 +- net/bluetooth/Kconfig | 8 - net/bluetooth/Makefile | 1 - net/bluetooth/a2mp.c | 1054 ------------------------------------ net/bluetooth/a2mp.h | 154 ------ net/bluetooth/af_bluetooth.c | 10 +- net/bluetooth/amp.c | 590 -------------------- net/bluetooth/amp.h | 60 --- net/bluetooth/bnep/core.c | 5 +- net/bluetooth/eir.c | 29 +- net/bluetooth/hci_conn.c | 200 ++----- net/bluetooth/hci_core.c | 170 ++++-- net/bluetooth/hci_event.c | 236 ++------ net/bluetooth/hci_request.c | 2 +- net/bluetooth/hci_sock.c | 4 +- net/bluetooth/hci_sync.c | 433 +++++++++++++-- net/bluetooth/iso.c | 104 +++- net/bluetooth/l2cap_core.c | 1079 +------------------------------------ net/bluetooth/l2cap_sock.c | 21 +- net/bluetooth/mgmt.c | 120 +---- net/bluetooth/msft.c | 3 + net/bluetooth/sco.c | 3 +- 38 files changed, 1028 insertions(+), 3623 deletions(-) delete mode 100644 net/bluetooth/a2mp.c delete mode 100644 net/bluetooth/a2mp.h delete mode 100644 net/bluetooth/amp.c delete mode 100644 net/bluetooth/amp.h