Re: [PATCH stable 5.10.y] can: isotp: stop timeout monitoring when no first frame was sent

[Greg KH <gregkh@linuxfoundation.org>]

On Mon, Apr 25, 2022 at 01:57:01PM +0200, Oliver Hartkopp wrote:
> [ Upstream commit d73497081710c876c3c61444445512989e102152 ]
> 
> The first attempt to fix a the 'impossible' WARN_ON_ONCE(1) in
> isotp_tx_timer_handler() focussed on the identical CAN IDs created by
> the syzbot reproducer and lead to upstream fix/commit 3ea566422cbd
> ("can: isotp: sanitize CAN ID checks in isotp_bind()"). But this did
> not catch the root cause of the wrong tx.state in the tx_timer handler.
> 
> In the isotp 'first frame' case a timeout monitoring needs to be started
> before the 'first frame' is send. But when this sending failed the timeout
> monitoring for this specific frame has to be disabled too.
> 
> Otherwise the tx_timer is fired with the 'warn me' tx.state of ISOTP_IDLE.
> 
> Fixes: e057dd3fc20f ("can: add ISO 15765-2:2016 transport protocol")
> Link: https://lore.kernel.org/all/20220405175112.2682-1-socketcan@hartkopp.net
> Reported-by: syzbot+2339c27f5c66c652843e@syzkaller.appspotmail.com
> Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
> Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
> ---
>  net/can/isotp.c | 10 +++++++++-
>  1 file changed, 9 insertions(+), 1 deletion(-)

Now queued up, thanks.

greg k-h