[PATCH] can: usb: f81604: fix use-after-free on disconnect

[Ji-Ze Hong via B4 Relay]

From: "Ji-Ze Hong (Peter Hong)" <peter_hong@xxxxxxxxxxxxx>

Unregister the URBs before cancelling clear_reg_work to prevent an URB
completion handler from scheduling work after cancel_work_sync() has
returned.

Otherwise the pending work may run after the netdev and private data are
freed, resulting in a use-after-free.

Suggested-by: Marc Kleine-Budde <mkl@xxxxxxxxxxxxxx>
Closes: https://lore.kernel.org/all/20260824133009.CF85A1F00A3A@xxxxxxxxxxxxxxx/
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Ji-Ze Hong (Peter Hong) <peter_hong@xxxxxxxxxxxxx>
---
 drivers/net/can/usb/f81604.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/can/usb/f81604.c b/drivers/net/can/usb/f81604.c
index 4c147b9d6d69..bb155b876924 100644
--- a/drivers/net/can/usb/f81604.c
+++ b/drivers/net/can/usb/f81604.c
@@ -1075,10 +1075,10 @@ static int f81604_close(struct net_device *netdev)
 	f81604_set_reset_mode(priv);
 
 	netif_stop_queue(netdev);
-	cancel_work_sync(&priv->clear_reg_work);
 	close_candev(netdev);
 
 	f81604_unregister_urbs(priv);
+	cancel_work_sync(&priv->clear_reg_work);
 
 	return 0;
 }

---
base-commit: 475cb4ea138f4b0e7f43ff79220f4013a6a840b8
change-id: 20260901-f81604-fix-9400ea120256

Best regards,
--  
Ji-Ze Hong (Peter Hong) <peter_hong@xxxxxxxxxxxxx>