Subject: linux-next: manual merge of the bluetooth tree with the net tree

From: Mark Brown <[email-masked]>
Date: Mon, 16 Mar 2026 17:13:22 +0000

Hi all,

Today's linux-next merge of the bluetooth tree got a conflict in:

  net/bluetooth/l2cap_core.c

between commit:

  e1d9a66889867 ("Bluetooth: LE L2CAP: Disconnect if received packet's SDU exceeds IMTU")

from the net tree and commits:

  b65e87418bb37 ("Bluetooth: LE L2CAP: Disconnect if received packet's SDU exceeds IMTU")
  cb75c9a0505b8 ("Bluetooth: L2CAP: CoC: Disconnect if received packet size exceeds MPS")

from the bluetooth tree.

I fixed it up (see below) and can carry the fix as necessary. This
is now fixed as far as linux-next is concerned, but any non trivial
conflicts should be mentioned to your upstream maintainer when your tree
is submitted for merging.  You may also want to consider cooperating
with the maintainer of the conflicting tree to minimise any particularly
complex conflicts.

I note that the bluetooth tree does not seem to have merged up v7.0-rcX
at all.

diff --combined net/bluetooth/l2cap_core.c
index 5deb6c4f1e41d,475fdf1908cb8..0000000000000
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@@ -442,7 -442,7 +442,7 @@@ struct l2cap_chan *l2cap_chan_create(vo
  {
  	struct l2cap_chan *chan;
  
 -	chan = kzalloc(sizeof(*chan), GFP_ATOMIC);
 +	chan = kzalloc_obj(*chan, GFP_ATOMIC);
  	if (!chan)
  		return NULL;
  
@@@ -6675,6 -6675,13 +6675,13 @@@ static int l2cap_ecred_data_rcv(struct 
  		return -ENOBUFS;
  	}
  
+ 	if (skb->len > chan->mps) {
+ 		BT_ERR("Too big LE L2CAP MPS: len %u > %u", skb->len,
+ 		       chan->mps);
+ 		l2cap_send_disconn_req(chan, ECONNRESET);
+ 		return -ENOBUFS;
+ 	}
+ 
  	chan->rx_credits--;
  	BT_DBG("chan %p: rx_credits %u -> %u",
  	       chan, chan->rx_credits + 1, chan->rx_credits);
@@@ -6958,7 -6965,7 +6965,7 @@@ static struct l2cap_conn *l2cap_conn_ad
  	if (!hchan)
  		return NULL;
  
 -	conn = kzalloc(sizeof(*conn), GFP_KERNEL);
 +	conn = kzalloc_obj(*conn);
  	if (!conn) {
  		hci_chan_del(hchan);
  		return NULL;