[PATCH net 0/1] pull-request: can 2022-04-17

[PATCH net 0/1] pull-request: can 2022-04-17

[Marc Kleine-Budde]

Hello Jakub, hello David,

this is a pull request of 1 patch for net/master.

The patch is by Oliver Hartkopp and fixes a timeout monitoring problem
in the ISO TP protocol found by the syzbot.

regards,
Marc

---

The following changes since commit 49aefd131739df552f83c566d0665744c30b1d70:

  bonding: do not discard lowest hash bit for non layer3+4 hashing (2022-04-17 13:34:01 +0100)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can.git tags/linux-can-fixes-for-5.18-20220417

for you to fetch changes up to d73497081710c876c3c61444445512989e102152:

  can: isotp: stop timeout monitoring when no first frame was sent (2022-04-17 17:21:22 +0200)

----------------------------------------------------------------
linux-can-fixes-for-5.18-20220417

----------------------------------------------------------------
Oliver Hartkopp (1):
      can: isotp: stop timeout monitoring when no first frame was sent

 net/can/isotp.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

[PATCH net] can: isotp: stop timeout monitoring when no first frame was sent

[Marc Kleine-Budde]

From: Oliver Hartkopp <socketcan@hartkopp.net>

The first attempt to fix a the 'impossible' WARN_ON_ONCE(1) in
isotp_tx_timer_handler() focussed on the identical CAN IDs created by
the syzbot reproducer and lead to upstream fix/commit 3ea566422cbd
("can: isotp: sanitize CAN ID checks in isotp_bind()"). But this did
not catch the root cause of the wrong tx.state in the tx_timer handler.

In the isotp 'first frame' case a timeout monitoring needs to be started
before the 'first frame' is send. But when this sending failed the timeout
monitoring for this specific frame has to be disabled too.

Otherwise the tx_timer is fired with the 'warn me' tx.state of ISOTP_IDLE.

Fixes: e057dd3fc20f ("can: add ISO 15765-2:2016 transport protocol")
Link: https://lore.kernel.org/all/20220405175112.2682-1-socketcan@hartkopp.net
Reported-by: syzbot+2339c27f5c66c652843e@syzkaller.appspotmail.com
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
---
 net/can/isotp.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/net/can/isotp.c b/net/can/isotp.c
index bafb0fb5f0e0..ff5d7870294e 100644
--- a/net/can/isotp.c
+++ b/net/can/isotp.c
@@ -906,6 +906,7 @@ static int isotp_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
 	struct canfd_frame *cf;
 	int ae = (so->opt.flags & CAN_ISOTP_EXTEND_ADDR) ? 1 : 0;
 	int wait_tx_done = (so->opt.flags & CAN_ISOTP_WAIT_TX_DONE) ? 1 : 0;
+	s64 hrtimer_sec = 0;
 	int off;
 	int err;
 
@@ -1004,7 +1005,9 @@ static int isotp_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
 		isotp_create_fframe(cf, so, ae);
 
 		/* start timeout for FC */
-		hrtimer_start(&so->txtimer, ktime_set(1, 0), HRTIMER_MODE_REL_SOFT);
+		hrtimer_sec = 1;
+		hrtimer_start(&so->txtimer, ktime_set(hrtimer_sec, 0),
+			      HRTIMER_MODE_REL_SOFT);
 	}
 
 	/* send the first or only CAN frame */
@@ -1017,6 +1020,11 @@ static int isotp_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
 	if (err) {
 		pr_notice_once("can-isotp: %s: can_send_ret %pe\n",
 			       __func__, ERR_PTR(err));
+
+		/* no transmission -> no timeout monitoring */
+		if (hrtimer_sec)
+			hrtimer_cancel(&so->txtimer);
+
 		goto err_out_drop;
 	}
 

base-commit: 49aefd131739df552f83c566d0665744c30b1d70
-- 
2.35.1

Re: [PATCH net] can: isotp: stop timeout monitoring when no first frame was sent

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (master)
by Marc Kleine-Budde <mkl@pengutronix.de>:

On Sun, 17 Apr 2022 17:29:34 +0200 you wrote:
> From: Oliver Hartkopp <socketcan@hartkopp.net>
> 
> The first attempt to fix a the 'impossible' WARN_ON_ONCE(1) in
> isotp_tx_timer_handler() focussed on the identical CAN IDs created by
> the syzbot reproducer and lead to upstream fix/commit 3ea566422cbd
> ("can: isotp: sanitize CAN ID checks in isotp_bind()"). But this did
> not catch the root cause of the wrong tx.state in the tx_timer handler.
> 
> [...]

Here is the summary with links:
  - [net] can: isotp: stop timeout monitoring when no first frame was sent
    https://git.kernel.org/netdev/net/c/d73497081710

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html