Merge tag 'for-net-2026-08-24' of git://git.kernel.org/pub/scm/linux/kernel/git/bluet...

Luiz Augusto von Dentz says:

====================
bluetooth pull request for net:

Core:

 - hci_core: use skb_get() instead of skb_clone() for req_skb
 - hci_conn: re-enable advertising only for peripheral role
 - hci_event: clear HCI_LE_ADV only on a created connection
 - hci_sync: Clear HCI_CMD_PENDING when dropping the last request
 - hci_sync: add conditional locking annotations
 - hci_sync: do not leak an hci_conn when a second LE connect is rejected
 - eir: Fix OOB read in eir_get_service_data()
 - mgmt: fix 'hdev->discovery.uuids' NULL dereference
 - L2CAP: access chan->conn safely in get/setsockopt
 - L2CAP: reject accept queue add unless BT_LISTEN
 - L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan
 - RFCOMM: serialize security confirmation handling
 - RFCOMM: serialize session teardown
 - RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop
 - ISO: fix use-after-free of listener socket in iso_conn_ready

Drivers:

 - btnxpuart: Validate the FW dump header length
 - btnxpuart: Check remote M.2 connector availability before pwrseq
 - btmtksdio: Take exclusive ownership of the SKB before TX
 - btmtksdio: Fix out-of-bounds DMA read in the TX path
 - hci_uart: Fix false success return in hci_uart_setup()
 - hci_bcm: fix usage_count leak when autosuspend_delay is negative
 - hci_h5: fix usage_count leak when autosuspend_delay is negative
 - hci_intel: fix usage_count leak when autosuspend_delay is negative
 - btmtk: Do not report success when subsys reset fails
 - btmtk: Do not discard the subsystem reset timeout
 - btusb: limit RTL8761B BROKEN_EXT_SCAN quirk to 0bda:a728
 - hci_bcm4377: Ignore reserved PHY in ext adv reports on BCM4378

* tag 'for-net-2026-08-24' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth: (27 commits)
  Bluetooth: RFCOMM: serialize session teardown
  Bluetooth: do not leak an hci_conn when a second LE connect is rejected
  Bluetooth: RFCOMM: serialize security confirmation handling
  Bluetooth: btusb: limit RTL8761B BROKEN_EXT_SCAN quirk to 0bda:a728
  Bluetooth: hci_uart: Fix false success return in hci_uart_setup()
  Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop
  Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready
  Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb
  Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection
  Bluetooth: hci_conn: re-enable advertising only for peripheral role
  Bluetooth: hci_bcm4377: Ignore reserved PHY in ext adv reports on BCM4378
  Bluetooth: eir: Fix OOB read in eir_get_service_data()
  Bluetooth: btnxpuart: Validate the FW dump header length
  Bluetooth: hci_sync: add conditional locking annotations
  Bluetooth: btnxpuart: Check remote M.2 connector availability before pwrseq
  Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path
  Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX
  Bluetooth: btmtk: Do not discard the subsystem reset timeout
  Bluetooth: btmtk: Do not report success when subsys reset fails
  Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan
  ...
====================

Link: https://patch.msgid.link/20260824180639.3570348-1-luiz.dentz@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>