Patch "xhci: Cleanup current_cmd in xhci_cleanup_command_queue()" has been added to the 4.13-stable tree

This is a note to let you know that I've just added the patch titled

xhci: Cleanup current_cmd in xhci_cleanup_command_queue()

to the 4.13-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
xhci-cleanup-current_cmd-in-xhci_cleanup_command_queue.patch
and it can be found in the queue-4.13 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Jeffy Chen <[email protected]>
Date: Fri, 6 Oct 2017 17:45:28 +0300
Subject: xhci: Cleanup current_cmd in xhci_cleanup_command_queue()

From: Jeffy Chen <[email protected]>

commit d1aad52cf8b3f95dfe9b5b64da66343306ddf73b upstream.

KASAN reported use-after-free bug when xhci host controller died:

[  176.952537] BUG: KASAN: use-after-free in xhci_handle_command_timeout+0x68/0x224
[  176.960846] Write of size 4 at addr ffffffc0cbb01608 by task kworker/3:3/1680
...
[  177.180644] Freed by task 0:
[  177.183882]  kasan_slab_free+0x90/0x15c
[  177.188194]  kfree+0x114/0x28c
[  177.191630]  xhci_cleanup_command_queue+0xc8/0xf8
[  177.196916]  xhci_hc_died+0x84/0x358

Problem here is that when the cmd_timer fired, it would try to access current_cmd while the command queue is already freed by xhci_hc_died().

Cleanup current_cmd in xhci_cleanup_command_queue() to avoid that.

---
 drivers/usb/host/xhci-ring.c |    1 +
 1 file changed, 1 insertion(+)

@@ -1309,6 +1309,7 @@ static void xhci_complete_del_and_free_c
 void xhci_cleanup_command_queue(struct xhci_hcd *xhci)
 {
 	struct xhci_command *cur_cmd, *tmp_cmd;
+	xhci->current_cmd = NULL;
 	list_for_each_entry_safe(cur_cmd, tmp_cmd, &xhci->cmd_list, cmd_list)
 		xhci_complete_del_and_free_cmd(cur_cmd, COMP_COMMAND_ABORTED);
 }

Patches currently in stable-queue which might be from [email protected] are

queue-4.13/xhci-cleanup-current_cmd-in-xhci_cleanup_command_queue.patch