[GIT PULL] bluetooth 2026-08-24

The following changes since commit 7cbfb180945ce529608e4d4e24a6d483699fab1e:

  net/sched: sch_cake: fix autorate reconfiguration throttling (2026-08-22 13:51:40 -0700)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth.git tags/for-net-2026-08-24

for you to fetch changes up to ebe6674292fda9a58e6f3adffd6d277560857169:

  Bluetooth: RFCOMM: serialize session teardown (2026-08-24 13:14:43 -0400)

----------------------------------------------------------------
bluetooth pull request for net:

Core:

 - hci_core: use skb_get() instead of skb_clone() for req_skb
 - hci_conn: re-enable advertising only for peripheral role
 - hci_event: clear HCI_LE_ADV only on a created connection
 - hci_sync: Clear HCI_CMD_PENDING when dropping the last request
 - hci_sync: add conditional locking annotations
 - hci_sync: do not leak an hci_conn when a second LE connect is rejected
 - eir: Fix OOB read in eir_get_service_data()
 - mgmt: fix 'hdev->discovery.uuids' NULL dereference
 - L2CAP: access chan->conn safely in get/setsockopt
 - L2CAP: reject accept queue add unless BT_LISTEN
 - L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan
 - RFCOMM: serialize security confirmation handling
 - RFCOMM: serialize session teardown
 - RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop
 - ISO: fix use-after-free of listener socket in iso_conn_ready

Drivers:

 - btnxpuart: Validate the FW dump header length
 - btnxpuart: Check remote M.2 connector availability before pwrseq
 - btmtksdio: Take exclusive ownership of the SKB before TX
 - btmtksdio: Fix out-of-bounds DMA read in the TX path
 - hci_uart: Fix false success return in hci_uart_setup()
 - hci_bcm: fix usage_count leak when autosuspend_delay is negative
 - hci_h5: fix usage_count leak when autosuspend_delay is negative
 - hci_intel: fix usage_count leak when autosuspend_delay is negative
 - btmtk: Do not report success when subsys reset fails
 - btmtk: Do not discard the subsystem reset timeout
 - btusb: limit RTL8761B BROKEN_EXT_SCAN quirk to 0bda:a728
 - hci_bcm4377: Ignore reserved PHY in ext adv reports on BCM4378

----------------------------------------------------------------
Ali Ahmet Memis (1):
      Bluetooth: btnxpuart: Validate the FW dump header length

Chengfeng Ye (2):
      Bluetooth: RFCOMM: serialize security confirmation handling
      Bluetooth: RFCOMM: serialize session teardown

Chris Lu (2):
      Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX
      Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path

Gongwei Li (1):
      Bluetooth: hci_uart: Fix false success return in hci_uart_setup()

Guangshuo Li (3):
      Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative
      Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative
      Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative

Hang Nan (1):
      Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready

HyeongJun An (1):
      Bluetooth: eir: Fix OOB read in eir_get_service_data()

Hyunwoo Kim (1):
      Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop

Ibrahim Abdelkader (1):
      Bluetooth: hci_sync: Clear HCI_CMD_PENDING when dropping the last request

Ismail Tarim (2):
      Bluetooth: btmtk: Do not report success when subsys reset fails
      Bluetooth: btmtk: Do not discard the subsystem reset timeout

Junjie Cao (1):
      Bluetooth: btusb: limit RTL8761B BROKEN_EXT_SCAN quirk to 0bda:a728

Lorenzo Stoakes (ARM) (1):
      Bluetooth: hci_bcm4377: Ignore reserved PHY in ext adv reports on BCM4378

Pauli Virtanen (4):
      Bluetooth: L2CAP: access chan->conn safely in get/setsockopt
      Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN
      Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan
      Bluetooth: hci_sync: add conditional locking annotations

Pavel Shpakovskiy (1):
      Bluetooth: mgmt: fix 'hdev->discovery.uuids' NULL dereference

Radek Podgorny (1):
      Bluetooth: do not leak an hci_conn when a second LE connect is rejected

Sherry Sun (1):
      Bluetooth: btnxpuart: Check remote M.2 connector availability before pwrseq

Valentin Kindschi (2):
      Bluetooth: hci_conn: re-enable advertising only for peripheral role
      Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection

Xin Chen (1):
      Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb

 drivers/bluetooth/btmtk.c        |  11 +++--
 drivers/bluetooth/btmtksdio.c    |  33 +++++++++----
 drivers/bluetooth/btnxpuart.c    |  39 +++++++++++++--
 drivers/bluetooth/btrtl.c        |  13 -----
 drivers/bluetooth/btusb.c        |   8 ++++
 drivers/bluetooth/hci_bcm.c      |   1 +
 drivers/bluetooth/hci_bcm4377.c  |   1 +
 drivers/bluetooth/hci_h5.c       |   4 +-
 drivers/bluetooth/hci_intel.c    |   1 +
 drivers/bluetooth/hci_ldisc.c    |   2 +-
 drivers/bluetooth/hci_serdev.c   |   2 +-
 include/net/bluetooth/hci_core.h |   2 +-
 include/net/bluetooth/l2cap.h    |   5 ++
 net/bluetooth/eir.c              |   3 +-
 net/bluetooth/hci_conn.c         |   3 +-
 net/bluetooth/hci_core.c         |   2 +-
 net/bluetooth/hci_event.c        |   7 +--
 net/bluetooth/hci_sync.c         |  16 ++++++-
 net/bluetooth/iso.c              |   8 ++++
 net/bluetooth/l2cap_sock.c       | 100 +++++++++++++++++++++++++++++----------
 net/bluetooth/mgmt.c             |  18 +++++--
 net/bluetooth/rfcomm/core.c      |  14 +++++-
 22 files changed, 220 insertions(+), 73 deletions(-)