Patch "can: isotp: stop timeout monitoring when no first frame was sent" has been added to the 5.17-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    can: isotp: stop timeout monitoring when no first frame was sent

to the 5.17-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     can-isotp-stop-timeout-monitoring-when-no-first-fram.patch
and it can be found in the queue-5.17 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 2ca2d970526104e451a4a68e546d09dd29a80837
Author: Oliver Hartkopp <socketcan@xxxxxxxxxxxx>
Date:   Tue Apr 5 19:51:12 2022 +0200

    can: isotp: stop timeout monitoring when no first frame was sent
    
    [ Upstream commit d73497081710c876c3c61444445512989e102152 ]
    
    The first attempt to fix a the 'impossible' WARN_ON_ONCE(1) in
    isotp_tx_timer_handler() focussed on the identical CAN IDs created by
    the syzbot reproducer and lead to upstream fix/commit 3ea566422cbd
    ("can: isotp: sanitize CAN ID checks in isotp_bind()"). But this did
    not catch the root cause of the wrong tx.state in the tx_timer handler.
    
    In the isotp 'first frame' case a timeout monitoring needs to be started
    before the 'first frame' is send. But when this sending failed the timeout
    monitoring for this specific frame has to be disabled too.
    
    Otherwise the tx_timer is fired with the 'warn me' tx.state of ISOTP_IDLE.
    
    Fixes: e057dd3fc20f ("can: add ISO 15765-2:2016 transport protocol")
    Link: https://lore.kernel.org/all/20220405175112.2682-1-socketcan@xxxxxxxxxxxx
    Reported-by: syzbot+2339c27f5c66c652843e@xxxxxxxxxxxxxxxxxxxxxxxxx
    Signed-off-by: Oliver Hartkopp <socketcan@xxxxxxxxxxxx>
    Signed-off-by: Marc Kleine-Budde <mkl@xxxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/can/isotp.c b/net/can/isotp.c
index 5bce7c66c121..8c753dcefe7f 100644
--- a/net/can/isotp.c
+++ b/net/can/isotp.c
@@ -866,6 +866,7 @@ static int isotp_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
 	struct canfd_frame *cf;
 	int ae = (so->opt.flags & CAN_ISOTP_EXTEND_ADDR) ? 1 : 0;
 	int wait_tx_done = (so->opt.flags & CAN_ISOTP_WAIT_TX_DONE) ? 1 : 0;
+	s64 hrtimer_sec = 0;
 	int off;
 	int err;
 
@@ -964,7 +965,9 @@ static int isotp_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
 		isotp_create_fframe(cf, so, ae);
 
 		/* start timeout for FC */
-		hrtimer_start(&so->txtimer, ktime_set(1, 0), HRTIMER_MODE_REL_SOFT);
+		hrtimer_sec = 1;
+		hrtimer_start(&so->txtimer, ktime_set(hrtimer_sec, 0),
+			      HRTIMER_MODE_REL_SOFT);
 	}
 
 	/* send the first or only CAN frame */
@@ -977,6 +980,11 @@ static int isotp_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
 	if (err) {
 		pr_notice_once("can-isotp: %s: can_send_ret %pe\n",
 			       __func__, ERR_PTR(err));
+
+		/* no transmission -> no timeout monitoring */
+		if (hrtimer_sec)
+			hrtimer_cancel(&so->txtimer);
+
 		goto err_out_drop;
 	}