From: "Ji-Ze Hong (Peter Hong)" <peter_hong@fintek.com.tw>
Unregister the URBs before cancelling clear_reg_work to prevent an URB
completion handler from scheduling work after cancel_work_sync() has
returned.
Otherwise the pending work may run after the netdev and private data are
freed, resulting in a use-after-free.
Suggested-by: Marc Kleine-Budde <mkl@pengutronix.de>
Closes: https://lore.kernel.org/all/20260824133009.CF85A1F00A3A@smtp.kernel.org/
Cc: stable@vger.kernel.org
Signed-off-by: Ji-Ze Hong (Peter Hong) <peter_hong@fintek.com.tw>
---
drivers/net/can/usb/f81604.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/can/usb/f81604.c b/drivers/net/can/usb/f81604.c
index 4c147b9d6d69..bb155b876924 100644
--- a/drivers/net/can/usb/f81604.c
+++ b/drivers/net/can/usb/f81604.c
@@ -1075,10 +1075,10 @@ static int f81604_close(struct net_device *netdev)
f81604_set_reset_mode(priv);
netif_stop_queue(netdev);
- cancel_work_sync(&priv->clear_reg_work);
close_candev(netdev);
f81604_unregister_urbs(priv);
+ cancel_work_sync(&priv->clear_reg_work);
return 0;
}
---
base-commit: 475cb4ea138f4b0e7f43ff79220f4013a6a840b8
change-id: 20260901-f81604-fix-9400ea120256
Best regards,
--
Ji-Ze Hong (Peter Hong) <peter_hong@fintek.com.tw>