[PATCH] misc: ibmvmc: fix use-after-free in ibmvmc_close

[Junrui Luo]

The ibmvmc_close() function frees the session structure but doesn't
clear the hmc->file_session pointer. When the hypervisor later responds
with a close response message, ibmvmc_return_hmc() dereferences this
freed pointer causing a use-after-free.

Fix by clearing hmc->file_session under the hmc->lock before freeing
the session.

Reported-by: Yuhao Jiang <danisjiang@xxxxxxxxx>
Reported-by: Junrui Luo <moonafterrain@xxxxxxxxxxx>
Fixes: 0eca353e7ae7 ("misc: IBM Virtual Management Channel Driver (VMC)")
Signed-off-by: Junrui Luo <moonafterrain@xxxxxxxxxxx>
---
 drivers/misc/ibmvmc.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/misc/ibmvmc.c b/drivers/misc/ibmvmc.c
index e5f935b5249d..85da3ced2b79 100644
--- a/drivers/misc/ibmvmc.c
+++ b/drivers/misc/ibmvmc.c
@@ -880,6 +880,7 @@ static int ibmvmc_close(struct inode *inode, struct file *file)
 			if (rc)
 				dev_warn(hmc->adapter->dev, "close: send_close failed.\n");
 		}
+		hmc->file_session = NULL;
 		spin_unlock_irqrestore(&hmc->lock, flags);
 	}
 

---
base-commit: ea1013c1539270e372fc99854bc6e4d94eaeff66
change-id: 20251218-fixes-1089b79a8fba

Best regards,
-- 
Junrui Luo <moonafterrain@xxxxxxxxxxx>