Merge tag 'for-net-2026-11-02' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth

Luiz Augusto von Dentz says:

====================
bluetooth pull request for net:

Core:

 - hci_core: Initialize IRK before publication
 - hci_core: Initialize link key before publication
 - hci_core: Initialize LTK before publication
 - hci_core: Fix queuing rx_work while workqueue is drained
 - hci_core: Keep link-key filtering inside RCU
 - hci_core: Initialize advertising RPA work only once
 - hci_sync: Fix invalid Supervision_Timeout in LE Set Default Rate
 - hci_sync: re-enable legacy advertising on resume
 - hci_sync: pause advertising for the scan address update
 - hci_sync: Update the CIS host feature when enabling LE
 - hci_sync: Copy the LE accept list under hdev->lock
 - hci_sync: Protect resolving-list lookups
 - hci_sync: Copy the resolving-list IRK under RCU
 - hci_event: Clear explicit connect state on LE connection
 - L2CAP: Hold incoming data until encryption key size is known
 - L2CAP: Ignore connection responses with wrong ident
 - SMP: Protect link keys during LTK derivation
 - SMP: Protect LTK encryption with RCU
 - MGMT: Return RFKILLED for Set Powered on a blocked controller
 - MGMT: Clear disabled connection parameters when loading none
 - MGMT: Fix discovery stuck after a failed Stop Discovery
 - validate retained LE Create CIS command length
 - validate retained LE Set CIG Parameters command length

Drivers:

 - btintel: fix buffer over-read in fw payload
 - btmtk: drop zero-length ISO packets from endpoint padding
 - btmtk: bound the ISO payload length by the controller's MTU
 - btmtk: derive the firmware ISO setting from MTK_ISO_THRESHOLD
 - btmtk: fix error handling in btmtk_usb_isointf_init()
 - qca: Fix the WCN3950 NVM baud rate offset

* tag 'for-net-2026-11-02' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth: (30 commits)
  Bluetooth: MGMT: Fix discovery stuck after a failed Stop Discovery
  Bluetooth: validate retained LE Set CIG Parameters command length
  Bluetooth: validate retained LE Create CIS command length
  Bluetooth: hci_core: Initialize advertising RPA work only once
  Bluetooth: L2CAP: Ignore connection responses with wrong ident
  Bluetooth: MGMT: Clear disabled connection parameters when loading none
  Bluetooth: hci_sync: Copy the resolving-list IRK under RCU
  Bluetooth: SMP: Protect LTK encryption with RCU
  Bluetooth: SMP: Protect link keys during LTK derivation
  Bluetooth: hci_core: Keep link-key filtering inside RCU
  Bluetooth: btmtk: fix error handling in btmtk_usb_isointf_init()
  Bluetooth: qca: Fix the WCN3950 NVM baud rate offset
  Bluetooth: MGMT: Return RFKILLED for Set Powered on a blocked controller
  Bluetooth: hci_sync: Protect resolving-list lookups
  Bluetooth: hci_sync: Copy the LE accept list under hdev->lock
  Bluetooth: btmtk: derive the firmware ISO setting from MTK_ISO_THRESHOLD
  Bluetooth: btmtk: bound the ISO payload length by the controller's MTU
  Bluetooth: btmtk: drop zero-length ISO packets from endpoint padding
  Bluetooth: hci_sync: Update the CIS host feature when enabling LE
  Bluetooth: L2CAP: Hold incoming data until encryption key size is known
  ...
====================

Link: https://patch.msgid.link/20261102222018.2610820-1-luiz.dentz@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>