linux-kernel - [PATCH] misc: ibmvmc: fix use-after-free in ibmvmc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID:
 <SYBPR01MB7881CA7547CF4DDF6A2E31B6AFA8A@SYBPR01MB7881.ausprd01.prod.outlook.com>
Date: Thu, 18 Dec 2025 21:14:19 +0800
From: Junrui Luo <moonafterrain@...look.com>
To: Brad Warrum <bwarrum@...ux.ibm.com>, 
 Ritu Agarwal <rituagar@...ux.ibm.com>, Arnd Bergmann <arnd@...db.de>, 
 Greg Kroah-Hartman <gregkh@...uxfoundation.org>, 
 "Bryant G. Ly" <bryantly@...ux.vnet.ibm.com>, 
 Adam Reznechek <adreznec@...ux.vnet.ibm.com>, 
 Steven Royer <seroyer@...ux.vnet.ibm.com>, 
 Randy Dunlap <rdunlap@...radead.org>
Cc: linux-kernel@...r.kernel.org, Yuhao Jiang <danisjiang@...il.com>, 
 Junrui Luo <moonafterrain@...look.com>
Subject: [PATCH] misc: ibmvmc: fix use-after-free in ibmvmc_close

The ibmvmc_close() function frees the session structure but doesn't
clear the hmc->file_session pointer. When the hypervisor later responds
with a close response message, ibmvmc_return_hmc() dereferences this
freed pointer causing a use-after-free.

Fix by clearing hmc->file_session under the hmc->lock before freeing
the session.

Reported-by: Yuhao Jiang <danisjiang@...il.com>
Reported-by: Junrui Luo <moonafterrain@...look.com>
Fixes: 0eca353e7ae7 ("misc: IBM Virtual Management Channel Driver (VMC)")
Signed-off-by: Junrui Luo <moonafterrain@...look.com>
---
 drivers/misc/ibmvmc.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/misc/ibmvmc.c b/drivers/misc/ibmvmc.c
index e5f935b5249d..85da3ced2b79 100644
--- a/drivers/misc/ibmvmc.c
+++ b/drivers/misc/ibmvmc.c
@@ -880,6 +880,7 @@ static int ibmvmc_close(struct inode *inode, struct file *file)
 			if (rc)
 				dev_warn(hmc->adapter->dev, "close: send_close failed.\n");
 		}
+		hmc->file_session = NULL;
 		spin_unlock_irqrestore(&hmc->lock, flags);
 	}

---
base-commit: ea1013c1539270e372fc99854bc6e4d94eaeff66
change-id: 20251218-fixes-1089b79a8fba

Best regards,
-- 
Junrui Luo <moonafterrain@...look.com>