[PATCH v2] can: usb: f81604: fix struct f81604_int_data size mismatch

[PATCH v2] can: usb: f81604: fix struct f81604_int_data size mismatch

[Ji-Ze Hong via B4 Relay]

From: "Ji-Ze Hong (Peter Hong)" <peter_hong@fintek.com.tw>

The struct f81604_int_data defines 9 bytes of interrupt data:
- Byte 0: Status register (sr)
- Byte 1: Interrupt register (isrc)
- Byte 2: Interrupt enable register (ier)
- Byte 3: Arbitration lost capture (alc)
- Byte 4: Error code capture (ecc)
- Byte 5: Error warning limit register (ewlr)
- Byte 6: RX error counter (rxerr)
- Byte 7: TX error counter (txerr)
- Byte 8: Reserved (val)

The hardware sends exactly 9 bytes for the interrupt endpoint.
However, the struct was defined with __aligned(4) attribute which
caused the compiler to pad the struct to 12 bytes.

This causes a problem in f81604_read_int_callback() where the short
URB check compares urb->actual_length against sizeof(*data). When
sizeof(struct f81604_int_data) is 12 but the hardware only sends 9
bytes, the check fails and valid interrupt messages are discarded.

This results in the driver only being able to transmit once because
the TX complete interrupt is never processed.

Fix this by removing the __aligned(4) attribute so the struct size
matches the actual hardware data size of 9 bytes.

Fixes: 7299b1b39a25 ("can: usb: f81604: handle short interrupt urb messages properly")
Cc: stable@vger.kernel.org
Reported-by: Dynetrex, Admin <admin@dynetrex.com>
Closes: https://lore.kernel.org/all/A3834A07-5639-4779-844F-C5843DFC3928@dynetrex.com/
Signed-off-by: Ji-Ze Hong (Peter Hong) <peter_hong@fintek.com.tw>
---
v2:
- Added Reported-by and Remove mismatched Fixes tags
---
 drivers/net/can/usb/f81604.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/can/usb/f81604.c b/drivers/net/can/usb/f81604.c
index f12318268e46..4c147b9d6d69 100644
--- a/drivers/net/can/usb/f81604.c
+++ b/drivers/net/can/usb/f81604.c
@@ -169,7 +169,7 @@ struct f81604_int_data {
 	u8 rxerr;
 	u8 txerr;
 	u8 val;
-} __packed __aligned(4);
+} __packed;
 
 struct f81604_sff {
 	__be16 id;

---
base-commit: a13c140cc289c0b7b3770bce5b3ad42ab35074aa
change-id: 20260824-f81604-fix-aaebd1f42e06

Best regards,
--  
Ji-Ze Hong (Peter Hong) <peter_hong@fintek.com.tw>

Re: [PATCH v2] can: usb: f81604: fix struct f81604_int_data size mismatch

[Greg Kroah-Hartman]

On Mon, Aug 24, 2026 at 09:18:14PM +0800, Ji-Ze Hong via B4 Relay wrote:
> From: "Ji-Ze Hong (Peter Hong)" <peter_hong@fintek.com.tw>
> 
> The struct f81604_int_data defines 9 bytes of interrupt data:
> - Byte 0: Status register (sr)
> - Byte 1: Interrupt register (isrc)
> - Byte 2: Interrupt enable register (ier)
> - Byte 3: Arbitration lost capture (alc)
> - Byte 4: Error code capture (ecc)
> - Byte 5: Error warning limit register (ewlr)
> - Byte 6: RX error counter (rxerr)
> - Byte 7: TX error counter (txerr)
> - Byte 8: Reserved (val)
> 
> The hardware sends exactly 9 bytes for the interrupt endpoint.
> However, the struct was defined with __aligned(4) attribute which
> caused the compiler to pad the struct to 12 bytes.
> 
> This causes a problem in f81604_read_int_callback() where the short
> URB check compares urb->actual_length against sizeof(*data). When
> sizeof(struct f81604_int_data) is 12 but the hardware only sends 9
> bytes, the check fails and valid interrupt messages are discarded.
> 
> This results in the driver only being able to transmit once because
> the TX complete interrupt is never processed.
> 
> Fix this by removing the __aligned(4) attribute so the struct size
> matches the actual hardware data size of 9 bytes.
> 
> Fixes: 7299b1b39a25 ("can: usb: f81604: handle short interrupt urb messages properly")
> Cc: stable@vger.kernel.org
> Reported-by: Dynetrex, Admin <admin@dynetrex.com>
> Closes: https://lore.kernel.org/all/A3834A07-5639-4779-844F-C5843DFC3928@dynetrex.com/
> Signed-off-by: Ji-Ze Hong (Peter Hong) <peter_hong@fintek.com.tw>
> ---
> v2:
> - Added Reported-by and Remove mismatched Fixes tags

Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Re: [PATCH v2] can: usb: f81604: fix struct f81604_int_data size mismatch

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Improper teardown order in `f81604_close()` allows asynchronous work to be scheduled after `cancel_work_sync`, leading to a Use-After-Free on device disconnect.
--

--- Patch [1]: [PATCH v2] can: usb: f81604: fix struct f81604_int_data size mismatch ---
commit 975e1f8f6c4a34bb9458d846d2ded822cbc82f04
Author: Ji-Ze Hong (Peter Hong) <peter_hong@fintek.com.tw>

can: usb: f81604: fix struct f81604_int_data size mismatch

This commit removes the __aligned(4) attribute from struct f81604_int_data
so its size matches the actual 9-byte hardware data size. This prevents
valid interrupt messages from being incorrectly discarded as short URBs.

Closes: https://lore.kernel.org/all/A3834A07-5639-4779-844F-C5843DFC3928@dynetrex.com/

> diff --git a/drivers/net/can/usb/f81604.c b/drivers/net/can/usb/f81604.c
> index f12318268e46b..4c147b9d6d690 100644
> --- a/drivers/net/can/usb/f81604.c
> +++ b/drivers/net/can/usb/f81604.c
> @@ -169,7 +169,7 @@ struct f81604_int_data {
>  	u8 rxerr;
>  	u8 txerr;
>  	u8 val;
> -} __packed __aligned(4);
> +} __packed;

[Severity: High]
This is a pre-existing issue, but by fixing the struct size and enabling
normal interrupt processing, this patch actively unmasks a use-after-free
on device disconnect.

Looking at f81604_close(), cancel_work_sync() is called before the URBs
are unregistered:

drivers/net/can/usb/f81604.c:f81604_close() {
    ...
    cancel_work_sync(&priv->clear_reg_work);
    close_candev(netdev);

    f81604_unregister_urbs(priv);
    ...
}

If an interrupt URB completes concurrently with a device disconnect,
could the URB completion handler schedule the work again after
cancel_work_sync() has already completed?

drivers/net/can/usb/f81604.c:f81604_handle_can_bus_errors() {
    ...
    if (priv->clear_flags)
        schedule_work(&priv->clear_reg_work);
    ...
}

If so, f81604_unregister_urbs() will wait for the URB callback to finish
but leave the newly scheduled work pending. 

When the disconnect path returns and frees the netdev and its embedded
priv struct, will the delayed work execute and dereference the freed
pointer in f81604_clear_reg_work()?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260824-f81604-fix-v2-1-fc9be5581394@fintek.com.tw?part=1

Re: [PATCH v2] can: usb: f81604: fix struct f81604_int_data size mismatch

[Marc Kleine-Budde]

[-- Attachment #1: Type: text/plain, Size: 666 bytes --]

On 24.08.2026 13:30:09, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
>
> Pre-existing issues:
> - [High] Improper teardown order in `f81604_close()` allows asynchronous work to be scheduled after `cancel_work_sync`, leading to a Use-After-Free on device disconnect.

Can you take care of this issue, too?

Marc

-- 
Pengutronix e.K.                 | Marc Kleine-Budde          |
Embedded Linux                   | https://www.pengutronix.de |
Vertretung Nürnberg              | Phone: +49-5121-206917-129 |
Amtsgericht Hildesheim, HRA 2686 | Fax:   +49-5121-206917-9   |

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

Re: [PATCH v2] can: usb: f81604: fix struct f81604_int_data size mismatch

[Marc Kleine-Budde]

[-- Attachment #1: Type: text/plain, Size: 1909 bytes --]

On 24.08.2026 21:18:14, Ji-Ze Hong via B4 Relay wrote:
> From: "Ji-Ze Hong (Peter Hong)" <peter_hong@fintek.com.tw>
>
> The struct f81604_int_data defines 9 bytes of interrupt data:
> - Byte 0: Status register (sr)
> - Byte 1: Interrupt register (isrc)
> - Byte 2: Interrupt enable register (ier)
> - Byte 3: Arbitration lost capture (alc)
> - Byte 4: Error code capture (ecc)
> - Byte 5: Error warning limit register (ewlr)
> - Byte 6: RX error counter (rxerr)
> - Byte 7: TX error counter (txerr)
> - Byte 8: Reserved (val)
>
> The hardware sends exactly 9 bytes for the interrupt endpoint.
> However, the struct was defined with __aligned(4) attribute which
> caused the compiler to pad the struct to 12 bytes.
>
> This causes a problem in f81604_read_int_callback() where the short
> URB check compares urb->actual_length against sizeof(*data). When
> sizeof(struct f81604_int_data) is 12 but the hardware only sends 9
> bytes, the check fails and valid interrupt messages are discarded.
>
> This results in the driver only being able to transmit once because
> the TX complete interrupt is never processed.
>
> Fix this by removing the __aligned(4) attribute so the struct size
> matches the actual hardware data size of 9 bytes.
>
> Fixes: 7299b1b39a25 ("can: usb: f81604: handle short interrupt urb messages properly")
> Cc: stable@vger.kernel.org
> Reported-by: Dynetrex, Admin <admin@dynetrex.com>
> Closes: https://lore.kernel.org/all/A3834A07-5639-4779-844F-C5843DFC3928@dynetrex.com/
> Signed-off-by: Ji-Ze Hong (Peter Hong) <peter_hong@fintek.com.tw>

Applied to linux-can.

regards,
Marc

-- 
Pengutronix e.K.                 | Marc Kleine-Budde          |
Embedded Linux                   | https://www.pengutronix.de |
Vertretung Nürnberg              | Phone: +49-5121-206917-129 |
Amtsgericht Hildesheim, HRA 2686 | Fax:   +49-5121-206917-9   |

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

Re: [PATCH v2] can: usb: f81604: fix struct f81604_int_data size mismatch

[Drew Willey]

Tested running ChromeOS, kernel 6.12, rev facaadd, f81604 (2c42:1709), the driver hits "f81604_read_int_callback: short int URB: 9 < 12" on the first Tx attempt and stops the Tx queue. Subsequent frames queue up and are not transmitted.

Reloaded the f81604 module with this patch. Transmitted several frames over a minute and all succeed.

Tested-by: Drew Willey <dwilley@google.com>

Re: [PATCH v2] can: usb: f81604: fix struct f81604_int_data size mismatch

[PS10 PETER HONG 洪繼澤]

Hi Marc,

Marc Kleine-Budde 於 2026/8/24 下午 11:11 寫道:
> On 24.08.2026 13:30:09, sashiko-bot@kernel.org wrote:
>> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
>>
>> Pre-existing issues:
>> - [High] Improper teardown order in `f81604_close()` allows asynchronous work to be scheduled after `cancel_work_sync`, leading to a Use-After-Free on device disconnect.
> Can you take care of this issue, too?
>

OK, I'll try to fix it later.


-- 

*洪繼澤 **Peter Hong*

精拓科技股份有限公司

Feature Integration Technology

Address: 302新竹縣竹北市台元二街10號7樓

TEL: 03-5600168 #813

FAX: 03-5600166

E-Mail﹕peter_hong@fintek.com.tw