linux-stable/net/bluetooth
Pavel Shpakovskiy 4bd2866db0 Bluetooth: hci_sync: fix set_local_name race condition
[ Upstream commit 6bbd0d3f0c ]

Function set_name_sync() uses hdev->dev_name field to send
HCI_OP_WRITE_LOCAL_NAME command, but copying from data to hdev->dev_name
is called after mgmt cmd was queued, so it is possible that function
set_name_sync() will read old name value.

This change adds name as a parameter for function hci_update_name_sync()
to avoid race condition.

Fixes: 6f6ff38a1e ("Bluetooth: hci_sync: Convert MGMT_OP_SET_LOCAL_NAME")
Signed-off-by: Pavel Shpakovskiy <pashpakovskii@salutedevices.com>
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2025-09-04 15:30:21 +02:00
..
bnep
cmtp
hidp
rfcomm Revert "Bluetooth: hci_core: Fix sleeping function called from invalid context" 2025-03-22 12:50:38 -07:00
6lowpan.c Bluetooth: Fix error code in chan_alloc_skb_cb() 2025-03-28 21:59:53 +01:00
af_bluetooth.c
aosp.c
aosp.h
coredump.c
ecdh_helper.c
ecdh_helper.h
eir.c Bluetooth: Fix NULL pointer deference on eir_get_service_data 2025-06-19 15:28:42 +02:00
eir.h
hci_codec.c
hci_codec.h
hci_conn.c Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync() 2025-08-28 16:28:48 +02:00
hci_core.c Bluetooth: hci_core: Fix use-after-free in vhci_flush() 2025-07-10 16:03:13 +02:00
hci_debugfs.c
hci_debugfs.h
hci_event.c Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced 2025-09-04 15:30:21 +02:00
hci_request.c
hci_request.h
hci_sock.c Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie() 2025-08-28 16:28:19 +02:00
hci_sync.c Bluetooth: hci_sync: fix set_local_name race condition 2025-09-04 15:30:21 +02:00
hci_sysfs.c
iso.c Revert "Bluetooth: hci_core: Fix sleeping function called from invalid context" 2025-03-22 12:50:38 -07:00
Kconfig
l2cap_core.c Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU 2025-07-24 08:53:19 +02:00
l2cap_sock.c Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() 2025-07-24 08:53:18 +02:00
leds.c
leds.h
lib.c
Makefile
mgmt_config.c
mgmt_config.h
mgmt_util.c Bluetooth: MGMT: Protect mgmt_pending list with its own lock 2025-06-19 15:28:38 +02:00
mgmt_util.h Bluetooth: MGMT: Protect mgmt_pending list with its own lock 2025-06-19 15:28:38 +02:00
mgmt.c Bluetooth: hci_sync: fix set_local_name race condition 2025-09-04 15:30:21 +02:00
msft.c
msft.h
sco.c Revert "Bluetooth: hci_core: Fix sleeping function called from invalid context" 2025-03-22 12:50:38 -07:00
selftest.c
selftest.h
smp.c Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout 2025-07-24 08:53:18 +02:00
smp.h Bluetooth: SMP: If an unallowed command is received consider it a failure 2025-07-24 08:53:18 +02:00