Received: by 2002:a05:6602:2086:0:0:0:0 with SMTP id a6csp3683022ioa; Tue, 26 Apr 2022 08:10:20 -0700 (PDT) X-Google-Smtp-Source: ABdhPJwsb0cxOQbX8W/YNSltjv9dfkreMd+/Yu1w2V8Q6no7xtL/ujKtHxRb6QiGD43a40yFWaAL X-Received: by 2002:a17:902:6b0b:b0:158:f889:edd9 with SMTP id o11-20020a1709026b0b00b00158f889edd9mr23685953plk.122.1650985820514; Tue, 26 Apr 2022 08:10:20 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1650985820; cv=none; d=google.com; s=arc-20160816; b=oDwvB2NEOWLow331Izt138ywhNRRSQhc3fPdWiXObCuEvfWKv9h27hc0FoXtkTLR0b IlNLrSf1yO4tZAJvPaxsVB+9TKvfyo4hkowy1/wNXPAwz3ZeUAqIg00EJbbPao89TXY1 kAol8bjx/fjYsnu7YELteGEspMYhnHSf3HWxmt5E/+/JH1YzGofopPv21Cf0ZNUd2kVH +taCrXD8FsWnxZev+NVcLBAcdlLhd3y+a8CF+L/UatA1rd+gkYfriMSHh6N6v/7N9AZ/ 5y5uV0IxQ3h3S+IJ12GfCKc3Olnis2Nd/3Ty5iH1f04X67JCKkrzitfrX1Jt+XEm9qKj UyMw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=jYIim8zR6S925qdyJOvOeeFaBhf7hdr3UNvELvuFORY=; b=Q6iAYPim7erW0zPYs8ta4yH/rSr50ttIrEjpqRyXYUkeBaC8+uCiVX7Qf0eL36a7ck UOr8/AlXSD2sUpHulH6INBaJwm51RMnnqC/NkR3603cvxpe9VvAEItNlPNYlzdNtU15i XP8645RIwDMM6ETqzSeY06Q4QOPSYwVOzK2XIu08sZFa1yU5iFy/niY/SuCujuGmWIYT G/YKFeOV7kAP5W0XWef0unwatBi5PB8WRlT703/rKIyqGjvODMbO/IWguesdu5ArBje4 OYAl7BO0MaHtszlUV/Qwpq6zbj6fZIGcARC3dGDgW7omEoWseOUtnoZKHfkGZtaKZgKz +k3Q== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=PDHReWnl; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id i4-20020a170902c94400b0015d1f1c9235si5231383pla.561.2022.04.26.08.10.03; Tue, 26 Apr 2022 08:10:20 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=PDHReWnl; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238616AbiDZJQt (ORCPT + 99 others); Tue, 26 Apr 2022 05:16:49 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55676 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1347236AbiDZIvO (ORCPT ); Tue, 26 Apr 2022 04:51:14 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8FC13158F45; Tue, 26 Apr 2022 01:39:57 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 0C46E60C35; Tue, 26 Apr 2022 08:39:57 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 16355C385A0; Tue, 26 Apr 2022 08:39:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650962396; bh=EOw5hbKDTnYGfUcDibtjJA+xhAnCFPcdHRjqYVUw9Hc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=PDHReWnlzL5qY0lyPxdbsRYQFSqZBa/UMQ6ThLlssWlILesVO6I6ZuMqOkfsRSyJJ 5hZwAvekon9Le0CjUcFIbiHyxd59EYr0ijsMb33c2RLp1mlvfnNAZrWoZyIhK8DRMs h6ymvxRifmVbx+kB0VS0A9i60S9usc7ILgIYgk38= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+2339c27f5c66c652843e@syzkaller.appspotmail.com, Oliver Hartkopp , Marc Kleine-Budde , Sasha Levin Subject: [PATCH 5.15 042/124] can: isotp: stop timeout monitoring when no first frame was sent Date: Tue, 26 Apr 2022 10:20:43 +0200 Message-Id: <20220426081748.498664094@linuxfoundation.org> X-Mailer: git-send-email 2.36.0 In-Reply-To: <20220426081747.286685339@linuxfoundation.org> References: <20220426081747.286685339@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-7.7 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Oliver Hartkopp [ Upstream commit d73497081710c876c3c61444445512989e102152 ] The first attempt to fix a the 'impossible' WARN_ON_ONCE(1) in isotp_tx_timer_handler() focussed on the identical CAN IDs created by the syzbot reproducer and lead to upstream fix/commit 3ea566422cbd ("can: isotp: sanitize CAN ID checks in isotp_bind()"). But this did not catch the root cause of the wrong tx.state in the tx_timer handler. In the isotp 'first frame' case a timeout monitoring needs to be started before the 'first frame' is send. But when this sending failed the timeout monitoring for this specific frame has to be disabled too. Otherwise the tx_timer is fired with the 'warn me' tx.state of ISOTP_IDLE. Fixes: e057dd3fc20f ("can: add ISO 15765-2:2016 transport protocol") Link: https://lore.kernel.org/all/20220405175112.2682-1-socketcan@hartkopp.net Reported-by: syzbot+2339c27f5c66c652843e@syzkaller.appspotmail.com Signed-off-by: Oliver Hartkopp Signed-off-by: Marc Kleine-Budde Signed-off-by: Sasha Levin --- net/can/isotp.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/net/can/isotp.c b/net/can/isotp.c index 5bce7c66c121..8c753dcefe7f 100644 --- a/net/can/isotp.c +++ b/net/can/isotp.c @@ -866,6 +866,7 @@ static int isotp_sendmsg(struct socket *sock, struct msghdr *msg, size_t size) struct canfd_frame *cf; int ae = (so->opt.flags & CAN_ISOTP_EXTEND_ADDR) ? 1 : 0; int wait_tx_done = (so->opt.flags & CAN_ISOTP_WAIT_TX_DONE) ? 1 : 0; + s64 hrtimer_sec = 0; int off; int err; @@ -964,7 +965,9 @@ static int isotp_sendmsg(struct socket *sock, struct msghdr *msg, size_t size) isotp_create_fframe(cf, so, ae); /* start timeout for FC */ - hrtimer_start(&so->txtimer, ktime_set(1, 0), HRTIMER_MODE_REL_SOFT); + hrtimer_sec = 1; + hrtimer_start(&so->txtimer, ktime_set(hrtimer_sec, 0), + HRTIMER_MODE_REL_SOFT); } /* send the first or only CAN frame */ @@ -977,6 +980,11 @@ static int isotp_sendmsg(struct socket *sock, struct msghdr *msg, size_t size) if (err) { pr_notice_once("can-isotp: %s: can_send_ret %pe\n", __func__, ERR_PTR(err)); + + /* no transmission -> no timeout monitoring */ + if (hrtimer_sec) + hrtimer_cancel(&so->txtimer); + goto err_out_drop; } -- 2.35.1