linux/drivers/net/can/usb
Ji-Ze Hong (Peter Hong) 7f85d11705 usb: f81604: fix struct f81604_int_data size mismatch
The struct f81604_int_data defines 9 bytes of interrupt data:
- Byte 0: Status register (sr)
- Byte 1: Interrupt register (isrc)
- Byte 2: Interrupt enable register (ier)
- Byte 3: Arbitration lost capture (alc)
- Byte 4: Error code capture (ecc)
- Byte 5: Error warning limit register (ewlr)
- Byte 6: RX error counter (rxerr)
- Byte 7: TX error counter (txerr)
- Byte 8: Reserved (val)

The hardware sends exactly 9 bytes for the interrupt endpoint.
However, the struct was defined with __aligned(4) attribute which
caused the compiler to pad the struct to 12 bytes.

This causes a problem in f81604_read_int_callback() where the short
URB check compares urb->actual_length against sizeof(*data). When
sizeof(struct f81604_int_data) is 12 but the hardware only sends 9
bytes, the check fails and valid interrupt messages are discarded.

This results in the driver only being able to transmit once because
the TX complete interrupt is never processed.

Fix this by removing the __aligned(4) attribute so the struct size
matches the actual hardware data size of 9 bytes.

Fixes: 7299b1b39a ("can: usb: f81604: handle short interrupt urb messages properly")
Cc: stable@vger.kernel.org
Reported-by: Dynetrex, Admin <admin@dynetrex.com>
Closes: https://lore.kernel.org/all/A3834A07-5639-4779-844F-C5843DFC3928@dynetrex.com/
Signed-off-by: Ji-Ze Hong (Peter Hong) <peter_hong@fintek.com.tw>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Tested-by: Drew Willey <dwilley@google.com>
Link: https://patch.msgid.link/20260824-f81604-fix-v2-1-fc9be5581394@fintek.com.tw
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2026-10-01 17:13:12 +02:00
..
etas_es58x can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure 2026-07-29 12:00:00 +02:00
kvaser_usb can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents 2026-07-29 12:00:00 +02:00
peak_usb can: peak_usb: validate uCAN receive record lengths 2026-07-29 11:59:01 +02:00
ems_usb.c can: ems_usb: validate CPC message lengths 2026-07-29 12:00:18 +02:00
esd_usb.c can: esd_usb: kill anchored URBs before freeing netdevs 2026-07-14 10:59:53 +02:00
f81604.c usb: f81604: fix struct f81604_int_data size mismatch 2026-10-01 17:13:12 +02:00
gs_usb.c drivers: gs_usb: gs_usb_probe(): fix typo in error message 2026-08-17 19:20:38 +02:00
Kconfig can: Add Nuvoton NCT6694 CANFD support 2025-09-16 14:41:57 +01:00
Makefile can: Add Nuvoton NCT6694 CANFD support 2025-09-16 14:41:57 +01:00
mcba_usb.c can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak 2026-01-16 20:40:46 +01:00
nct6694_canfd.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
ucan.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-04-14 12:04:00 -07:00
usb_8dev.c can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak 2026-01-16 20:40:52 +01:00