Re: [PATCH net v7 2/4] can: j1939: validate the EDPO packet number

[Chaosheng Qu <quchaosheng000406@163.com>]

Hi,

The Medium is right. j1939_session_cancel() only touches the rxtimer, so the
txtimer stayed armed on the aborting session. On the transmitter the
-ENOBUFS retries ran up to J1939_XTP_TX_RETRY_LIMIT and replaced session->err
with -ENETUNREACH; on the receiver they sent a CTS or an EOMA, and each of
those ends in j1939_tp_set_rxtimeout(session, 1250), which replaces the abort
timeout. v8 adds j1939_session_timers_cancel() before the abort, and v9 has
it.

Fixes: 9d71dd0c7009 and Cc: stable are in since v8.

Two things I got wrong in this patch, from your review of it on v9. Once
j1939_xtp_rx_cts_one() bounds the CTS, an out-of-range EDPO on the
transmitter side can only come from a frame this host did not build, since
J1939_ECU_LOCAL_SRC is set from the source address alone. ECTS_TOO_BIG blames
a responder CTS that was valid in that case, so the next version uses
BAD_EDPO_OFFSET for both roles. And the comment refers to "4/4", which means
nothing after merge; it will name j1939_xtp_rx_cts_one() instead.

Thanks,
Chaosheng