On Mon, Apr 25, 2022 at 01:57:01PM +0200, Oliver Hartkopp wrote: > [ Upstream commit d73497081710c876c3c61444445512989e102152 ] > > The first attempt to fix a the 'impossible' WARN_ON_ONCE(1) in > isotp_tx_timer_handler() focussed on the identical CAN IDs created by > the syzbot reproducer and lead to upstream fix/commit 3ea566422cbd > ("can: isotp: sanitize CAN ID checks in isotp_bind()"). But this did > not catch the root cause of the wrong tx.state in the tx_timer handler. > > In the isotp 'first frame' case a timeout monitoring needs to be started > before the 'first frame' is send. But when this sending failed the timeout > monitoring for this specific frame has to be disabled too. > > Otherwise the tx_timer is fired with the 'warn me' tx.state of ISOTP_IDLE. > > Fixes: e057dd3fc20f ("can: add ISO 15765-2:2016 transport protocol") > Link: https://lore.kernel.org/all/20220405175112.2682-1-socketcan@xxxxxxxxxxxx > Reported-by: syzbot+2339c27f5c66c652843e@xxxxxxxxxxxxxxxxxxxxxxxxx > Signed-off-by: Oliver Hartkopp <socketcan@xxxxxxxxxxxx> > Signed-off-by: Marc Kleine-Budde <mkl@xxxxxxxxxxxxxx> > --- > net/can/isotp.c | 10 +++++++++- > 1 file changed, 9 insertions(+), 1 deletion(-) Now queued up, thanks. greg k-h