On Mon, Apr 25, 2022 at 01:57:01PM +0200, Oliver Hartkopp wrote:
> [ Upstream commit d73497081710c876c3c61444445512989e102152 ]
>
> The first attempt to fix a the 'impossible' WARN_ON_ONCE(1) in
> isotp_tx_timer_handler() focussed on the identical CAN IDs created by
> the syzbot reproducer and lead to upstream fix/commit 3ea566422cbd
> ("can: isotp: sanitize CAN ID checks in isotp_bind()"). But this did
> not catch the root cause of the wrong tx.state in the tx_timer handler.
>
> In the isotp 'first frame' case a timeout monitoring needs to be started
> before the 'first frame' is send. But when this sending failed the timeout
> monitoring for this specific frame has to be disabled too.
>
> Otherwise the tx_timer is fired with the 'warn me' tx.state of ISOTP_IDLE.
>
> Fixes: e057dd3fc20f ("can: add ISO 15765-2:2016 transport protocol")
> Link: https://lore.kernel.org/all/20220405175112.2682-1-socketcan@xxxxxxxxxxxx
> Reported-by: syzbot+2339c27f5c66c652843e@xxxxxxxxxxxxxxxxxxxxxxxxx
> Signed-off-by: Oliver Hartkopp <socketcan@xxxxxxxxxxxx>
> Signed-off-by: Marc Kleine-Budde <mkl@xxxxxxxxxxxxxx>
> ---
> net/can/isotp.c | 10 +++++++++-
> 1 file changed, 9 insertions(+), 1 deletion(-)
Now queued up, thanks.
greg k-h
