xhci: Cleanup current_cmd in xhci_cleanup_command_queue()
authorJeffy Chen <jeffy.chen@rock-chips.com>
Fri, 6 Oct 2017 14:45:28 +0000 (17:45 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 17 Oct 2017 08:38:12 +0000 (10:38 +0200)
commitd1aad52cf8b3f95dfe9b5b64da66343306ddf73b
tree5b58416a4ea09bc8b1e1cf99d02d67bc159a6f10
parentea7d0d69426cab6747ed311c53f4142eb48b9454
xhci: Cleanup current_cmd in xhci_cleanup_command_queue()

KASAN reported use-after-free bug when xhci host controller died:
[  176.952537] BUG: KASAN: use-after-free in xhci_handle_command_timeout+0x68/0x224
[  176.960846] Write of size 4 at addr ffffffc0cbb01608 by task kworker/3:3/1680
...
[  177.180644] Freed by task 0:
[  177.183882]  kasan_slab_free+0x90/0x15c
[  177.188194]  kfree+0x114/0x28c
[  177.191630]  xhci_cleanup_command_queue+0xc8/0xf8
[  177.196916]  xhci_hc_died+0x84/0x358

Problem here is that when the cmd_timer fired, it would try to access
current_cmd while the command queue is already freed by xhci_hc_died().

Cleanup current_cmd in xhci_cleanup_command_queue() to avoid that.

Fixes: d9f11ba9f107 ("xhci: Rework how we handle unresponsive or hoptlug removed hosts")
Cc: <stable@vger.kernel.org> # v4.12+
Signed-off-by: Jeffy Chen <jeffy.chen@rock-chips.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/usb/host/xhci-ring.c