linux/drivers/bluetooth
Linus Torvalds 2c7c88a412 Including fixes from netfilter, Bluetooth and batman-adv.
Current release - regressions:
 
   - bluetooth: fix using chan->conn as indication to no remote netdev
 
 Current release - new code bugs:
 
   - netfilter: cap to maximum number of expectation per master on updates
 
 Previous releases - regressions:
 
   - bluetooth:
     - fix UAF of hci_conn_params in add_device_complete
     - fix null ptr deref in hci_abort_conn()
 
   - igmp: remove multicast group from hash table on device destruction
 
   - batman-adv: prevent TVLV OOB check overflow
 
   - eth: mlx5/mlx5e:
     - fix off-by-one in single-FDB error rollback
     - skip peer flow cleanup when LAG seq is unavailable
     - fix crashes in dynamic per-channel stats and HV VHCA agent
 
   - eth: mana: Sync page pool RX frags for CPU
 
 Previous releases - always broken:
 
   - netfilter:
     - mark malformed IPv6 extension headers for hotdrop
     - terminate table name before find_table_lock()
     - ipvs: use parsed transport offset in TCP state lookup
 
   - sched: act_pedit: fix TOCTOU heap OOB write in tc offload
 
   - ethtool: rss: fix hfunc and input_xfrm parsing on big endian
 
   - ipv4/ipv6: fix UAF and memory leak in IGMP/MLD
 
   - tls: consume empty data records in tls_sw_read_sock()
 
   - eth: octeontx2-af: fix VF bringup affecting PF promiscuous state
 
   - eth: gue: validate REMCSUM private option length
 
 Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 -----BEGIN PGP SIGNATURE-----
 
 iQJGBAABCgAwFiEEg1AjqC77wbdLX2LbKSR5jcyPE6QFAmpPpEkSHHBhYmVuaUBy
 ZWRoYXQuY29tAAoJECkkeY3MjxOkMrkP/3BqkhllssjF+u4Nf7Z44Tkg0p2h4l5Y
 Bk97Ug1tMdMtexkO7TBz4nTLl26sfrQka4xpHcPdjWzDpYccwb4asxaXCn6oVk+9
 lhfSVsw1UGDUflmYLHb8xMss/8fp6rS/DkpLVxThs9U4FPys23QDlrsJFQqbziGT
 EJ4LhxcpjGZwUY0rBZ4DQxt3T1zUbCnihPOByts3SNLh43a6Km8Moqhpfq2+N3jP
 fKD48tVOPv9DrCCxGXP5m0CbmcBLe4MyAAdeVOP3D7fHKH9g9B6EPQT/oG1puXnr
 8ZtpkRtxLVtZHu6hEmjK8FgXLe/BQlkCZgWOt18/USoBRAvmJlhL265vzPEKgWWT
 ThTnBNao67McJeL6He1WyO4Tzyd4sNYRVNo+jfe397w1VGpYxzBQdwGnw5PP+Mdw
 g6s3zxdrDpCIlDhwtsxY1cMwCmHrcMdFMxbcxvAvY2sTJ7gop+0WajhKDN/XFBqS
 elP6YFsQ1HF7YUzFMxuX3X0KnXGGHsz9zH8WA7uJR/dh0Ew/zoozQ5PfAI/lbGGn
 5MIhGC5lRQeoYuUyY3Sk4xHCMewN5OUsIMu+u1fYkzstsL265vcFCSGdRBu0FH0/
 7xoq9xHwzAT+Zc5LUOugtAIePRRw7LVvvt4GF5HjfCYJ2mHvGQzGe7M2xVMnopt0
 vx3t7AqglbgC
 =cxid
 -----END PGP SIGNATURE-----

Merge tag 'net-7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Pull networking fixes from Paolo Abeni:
 "Including fixes from netfilter, Bluetooth and batman-adv.

  Current release - regressions:

   - bluetooth: fix using chan->conn as indication to no remote netdev

  Current release - new code bugs:

   - netfilter: cap to maximum number of expectation per master on
     updates

  Previous releases - regressions:

   - bluetooth:
      - fix UAF of hci_conn_params in add_device_complete
      - fix null ptr deref in hci_abort_conn()

   - igmp: remove multicast group from hash table on device destruction

   - batman-adv: prevent TVLV OOB check overflow

   - eth: mlx5/mlx5e:
      - fix off-by-one in single-FDB error rollback
      - skip peer flow cleanup when LAG seq is unavailable
      - fix crashes in dynamic per-channel stats and HV VHCA agent

   - eth: mana: Sync page pool RX frags for CPU

  Previous releases - always broken:

   - netfilter:
      - mark malformed IPv6 extension headers for hotdrop
      - terminate table name before find_table_lock()
      - ipvs: use parsed transport offset in TCP state lookup

   - sched: act_pedit: fix TOCTOU heap OOB write in tc offload

   - ethtool: rss: fix hfunc and input_xfrm parsing on big endian

   - ipv4/ipv6: fix UAF and memory leak in IGMP/MLD

   - tls: consume empty data records in tls_sw_read_sock()

   - eth:
      - octeontx2-af: fix VF bringup affecting PF promiscuous state
      - gue: validate REMCSUM private option length"

* tag 'net-7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (94 commits)
  macsec: don't read an unset MAC header in macsec_encrypt()
  dibs: loopback: validate offset and size in move_data()
  octeontx2-af: fix VF bringup affecting PF promiscuous state
  ethtool: rss: Fix hfunc and input_xfrm parsing on big endian
  net/mlx5: Fix L3 tunnel entropy refcount leak
  net: macb: drop in-flight Tx SKBs on close
  net: mana: Sync page pool RX frags for CPU
  net: mana: Validate the packet length reported by the NIC
  selftests/net: fix EVP_MD_CTX leak in tcp_mmap
  ipvs: ensure inner headers in ICMP errors are in headroom
  ipvs: use parsed transport offset in SCTP state lookup
  ipvs: use parsed transport offset in TCP state lookup
  ipvs: pass parsed transport offset to state handlers
  netfilter: handle unreadable frags
  netfilter: flowtable: support IPIP tunnel with direct xmit
  netfilter: flowtable: IPIP tunnel hardware offload is not yet support
  netfilter: flowtable: use dst in this direction when pushing IPIP header
  netfilter: ipset: allocate the proper memory for the generic hash structure
  netfilter: ipset: cleanup the add/del backlog when resize failed
  netfilter: ipset: exclude gc when resize is in progress
  ...
2026-07-09 08:26:51 -07:00
..
ath3k.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
bcm203x.c Bluetooth: bcm203x: remove superfluous header files 2022-03-18 17:12:09 +01:00
bfusb.c Bluetooth: hci_dev: replace 'quirks' integer by 'quirk_flags' bitmap 2025-07-16 15:37:53 -04:00
bpa10x.c Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() 2026-07-06 10:46:58 -04:00
btbcm.c Bluetooth: btbcm: Add entry for BCM4343A2 UART Bluetooth 2026-04-10 10:22:21 -04:00
btbcm.h Bluetooth: hci_bcm: Add support for FW loading in autobaud mode 2022-07-21 17:04:38 -07:00
btintel_pcie.c Bluetooth: btintel_pcie: Refactor FLR to use device_reprobe() 2026-07-06 10:46:58 -04:00
btintel_pcie.h Bluetooth: btintel_pcie: Separate coredump work from RX work 2026-06-11 14:24:42 -04:00
btintel.c Bluetooth: btintel_pcie: Support Product level reset 2026-06-11 14:24:37 -04:00
btintel.h Bluetooth: btintel_pcie: Load IOSF debug regs by controller variant 2026-06-11 14:24:41 -04:00
btmrvl_debugfs.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
btmrvl_drv.h treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_390.RULE 2022-06-10 14:51:36 +02:00
btmrvl_main.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
btmrvl_sdio.c Bluetooth: btmrvl_sdio: Fix wakeup source leaks on device unbind 2025-05-21 10:27:20 -04:00
btmrvl_sdio.h treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_390.RULE 2022-06-10 14:51:36 +02:00
btmtk.c Bluetooth: btmtk: fix URB leak in alloc_mtk_intr_urb error path 2026-06-11 14:24:40 -04:00
btmtk.h Bluetooth: btmtk: add event filter to filter specific event 2026-06-11 14:24:37 -04:00
btmtksdio.c Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() 2026-06-11 14:24:42 -04:00
btmtkuart.c Bluetooth: fix corruption in h4_recv_buf() after cleanup 2025-10-24 10:31:24 -04:00
btnxpuart.c Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3() 2026-07-06 10:46:57 -04:00
btqca.c Bluetooth: qca: Add BT FW build version to kernel log 2026-06-11 14:24:41 -04:00
btqca.h Bluetooth: qca: add WCN3950 support 2025-03-25 12:42:35 -04:00
btqcomsmd.c Bluetooth: hci_dev: replace 'quirks' integer by 'quirk_flags' bitmap 2025-07-16 15:37:53 -04:00
btrsi.c Bluetooth: Add SPDX id lines to some source files 2026-06-11 14:24:41 -04:00
btrtl.c Bluetooth: btrtl: fix RTL8761B/BU broken LE extended scan 2026-06-11 14:24:38 -04:00
btrtl.h Bluetooth: btrtl: Add Realtek devcoredump support 2023-08-11 11:35:14 -07:00
btsdio.c Bluetooth: hci_dev: replace 'quirks' integer by 'quirk_flags' bitmap 2025-07-16 15:37:53 -04:00
btusb.c Bluetooth: btusb: clean up probe error handling 2026-06-11 14:24:40 -04:00
hci_ag6xx.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
hci_aml.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
hci_ath.c Bluetooth: hci_uart: Fix NULL deref in recv callbacks when priv is uninitialized 2026-05-06 16:21:43 -04:00
hci_bcm.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
hci_bcm4377.c Bluetooth: hci_bcm4377: Use generic power management 2026-01-29 13:22:42 -05:00
hci_bcsp.c Bluetooth: hci_uart: Fix NULL deref in recv callbacks when priv is uninitialized 2026-05-06 16:21:43 -04:00
hci_h4.c Bluetooth: hci_uart: Fix NULL deref in recv callbacks when priv is uninitialized 2026-05-06 16:21:43 -04:00
hci_h5.c Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
hci_intel.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
hci_ldisc.c Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled 2026-07-06 09:49:59 -04:00
hci_ll.c Bluetooth: hci_ll: Enable BROKEN_ENHANCED_SETUP_SYNC_CONN for WL183x 2026-04-13 09:19:42 -04:00
hci_mrvl.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
hci_nokia.c Bluetooth: fix corruption in h4_recv_buf() after cleanup 2025-10-24 10:31:24 -04:00
hci_qca.c Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
hci_serdev.c Bluetooth: hci_dev: replace 'quirks' integer by 'quirk_flags' bitmap 2025-07-16 15:37:53 -04:00
hci_uart.h Bluetooth: fix corruption in h4_recv_buf() after cleanup 2025-10-24 10:31:24 -04:00
hci_vhci.c Bluetooth: vhci: validate devcoredump state before side effects 2026-06-11 14:24:41 -04:00
Kconfig bluetooth: remove all PCMCIA drivers 2026-06-11 14:24:38 -04:00
Makefile bluetooth: remove all PCMCIA drivers 2026-06-11 14:24:38 -04:00
virtio_bt.c Bluetooth: virtio_bt: validate rx pkt_type header length 2026-05-06 16:22:33 -04:00