[v1] MdeModulePkg: Free NET_BUF data after it is sent out to avoid memory leak

[edk2] [Patch] MdeModulePkg: Free NET_BUF data after it is sent out to avoid memory leak

Posted by fanwang2 7 years, 1 month ago

When build a DHCP message in function DhcpSendMessage() or DhcpRetransmit(),
a new NET_BUF is created by the library of NetbufFromExt, but it's not freed
after it is sent out. This patch is to fix this memory leak issue.

Cc: Jiaxin Wu <jiaxin.wu@intel.com>
Cc: Ye Ting <ting.ye@intel.com>
Cc: Fu Siyuan <siyuan.fu@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Wang Fan <fan.wang@intel.com>
---
 MdeModulePkg/Universal/Network/Dhcp4Dxe/Dhcp4Io.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/MdeModulePkg/Universal/Network/Dhcp4Dxe/Dhcp4Io.c b/MdeModulePkg/Universal/Network/Dhcp4Dxe/Dhcp4Io.c
index 3898223..d90dc34 100644
--- a/MdeModulePkg/Universal/Network/Dhcp4Dxe/Dhcp4Io.c
+++ b/MdeModulePkg/Universal/Network/Dhcp4Dxe/Dhcp4Io.c
@@ -1397,23 +1397,22 @@ DhcpSendMessage (
     EndPoint.LocalAddr.Addr[0]  = DhcpSb->ClientAddr;
     UdpIo                       = DhcpSb->LeaseIoPort;
   }
 
   ASSERT (UdpIo != NULL);
-  NET_GET_REF (Wrap);
-  
+
   Status = UdpIoSendDatagram (
              UdpIo, 
              Wrap, 
              &EndPoint, 
              NULL, 
              DhcpOnPacketSent, 
              DhcpSb
              );
 
   if (EFI_ERROR (Status)) {
-    NET_PUT_REF (Wrap);
+    NetbufFree (Wrap);
     return EFI_ACCESS_DENIED;
   }
 
   return EFI_SUCCESS;
 }
@@ -1475,22 +1474,21 @@ DhcpRetransmit (
     UdpIo                       = DhcpSb->LeaseIoPort;
   }
 
   ASSERT (UdpIo != NULL);
 
-  NET_GET_REF (Wrap);
   Status = UdpIoSendDatagram (
              UdpIo,
              Wrap,
              &EndPoint,
              NULL,
              DhcpOnPacketSent,
              DhcpSb
              );
 
   if (EFI_ERROR (Status)) {
-    NET_PUT_REF (Wrap);
+    NetbufFree (Wrap);
     return EFI_ACCESS_DENIED;
   }
 
   return EFI_SUCCESS;
 }
-- 
1.9.5.msysgit.1

_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel

Re: [edk2] [Patch] MdeModulePkg: Free NET_BUF data after it is sent out to avoid memory leak

Posted by Fu, Siyuan 7 years, 1 month ago

Reviewed-by: Fu Siyuan <siyuan.fu@intel.com>



> -----Original Message-----
> From: Wang, Fan
> Sent: Wednesday, November 22, 2017 2:56 PM
> To: edk2-devel@lists.01.org
> Cc: Wu, Jiaxin <jiaxin.wu@intel.com>; Ye, Ting <ting.ye@intel.com>; Fu,
> Siyuan <siyuan.fu@intel.com>; Wang, Fan <fan.wang@intel.com>
> Subject: [Patch] MdeModulePkg: Free NET_BUF data after it is sent out to
> avoid memory leak
> 
> When build a DHCP message in function DhcpSendMessage() or
> DhcpRetransmit(),
> a new NET_BUF is created by the library of NetbufFromExt, but it's not
> freed
> after it is sent out. This patch is to fix this memory leak issue.
> 
> Cc: Jiaxin Wu <jiaxin.wu@intel.com>
> Cc: Ye Ting <ting.ye@intel.com>
> Cc: Fu Siyuan <siyuan.fu@intel.com>
> Contributed-under: TianoCore Contribution Agreement 1.0
> Signed-off-by: Wang Fan <fan.wang@intel.com>
> ---
>  MdeModulePkg/Universal/Network/Dhcp4Dxe/Dhcp4Io.c | 8 +++-----
>  1 file changed, 3 insertions(+), 5 deletions(-)
> 
> diff --git a/MdeModulePkg/Universal/Network/Dhcp4Dxe/Dhcp4Io.c
> b/MdeModulePkg/Universal/Network/Dhcp4Dxe/Dhcp4Io.c
> index 3898223..d90dc34 100644
> --- a/MdeModulePkg/Universal/Network/Dhcp4Dxe/Dhcp4Io.c
> +++ b/MdeModulePkg/Universal/Network/Dhcp4Dxe/Dhcp4Io.c
> @@ -1397,23 +1397,22 @@ DhcpSendMessage (
>      EndPoint.LocalAddr.Addr[0]  = DhcpSb->ClientAddr;
>      UdpIo                       = DhcpSb->LeaseIoPort;
>    }
> 
>    ASSERT (UdpIo != NULL);
> -  NET_GET_REF (Wrap);
> -
> +
>    Status = UdpIoSendDatagram (
>               UdpIo,
>               Wrap,
>               &EndPoint,
>               NULL,
>               DhcpOnPacketSent,
>               DhcpSb
>               );
> 
>    if (EFI_ERROR (Status)) {
> -    NET_PUT_REF (Wrap);
> +    NetbufFree (Wrap);
>      return EFI_ACCESS_DENIED;
>    }
> 
>    return EFI_SUCCESS;
>  }
> @@ -1475,22 +1474,21 @@ DhcpRetransmit (
>      UdpIo                       = DhcpSb->LeaseIoPort;
>    }
> 
>    ASSERT (UdpIo != NULL);
> 
> -  NET_GET_REF (Wrap);
>    Status = UdpIoSendDatagram (
>               UdpIo,
>               Wrap,
>               &EndPoint,
>               NULL,
>               DhcpOnPacketSent,
>               DhcpSb
>               );
> 
>    if (EFI_ERROR (Status)) {
> -    NET_PUT_REF (Wrap);
> +    NetbufFree (Wrap);
>      return EFI_ACCESS_DENIED;
>    }
> 
>    return EFI_SUCCESS;
>  }
> --
> 1.9.5.msysgit.1

_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel

Re: [edk2] [Patch] MdeModulePkg: Free NET_BUF data after it is sent out to avoid memory leak

Posted by Wu, Jiaxin 7 years, 1 month ago

Hi Fan,

Looks this patch will cause the null pointer dereference issue, see below analysis:

With this patch, the NET_BUF will be freed and the corresponding Arg (Packet) will also be freed in DhcpReleasePacket.

	Wrap      = NetbufFromExt (&Frag, 1, 0, 0, DhcpReleasePacket, Packet);

That's incorrect since the Packet will be retransmit later.

Please take a look.

Thanks,
Jiaxin


> -----Original Message-----
> From: Wang, Fan
> Sent: Wednesday, November 22, 2017 2:56 PM
> To: edk2-devel@lists.01.org
> Cc: Wu, Jiaxin <jiaxin.wu@intel.com>; Ye, Ting <ting.ye@intel.com>; Fu,
> Siyuan <siyuan.fu@intel.com>; Wang, Fan <fan.wang@intel.com>
> Subject: [Patch] MdeModulePkg: Free NET_BUF data after it is sent out to
> avoid memory leak
> 
> When build a DHCP message in function DhcpSendMessage() or
> DhcpRetransmit(),
> a new NET_BUF is created by the library of NetbufFromExt, but it's not freed
> after it is sent out. This patch is to fix this memory leak issue.
> 
> Cc: Jiaxin Wu <jiaxin.wu@intel.com>
> Cc: Ye Ting <ting.ye@intel.com>
> Cc: Fu Siyuan <siyuan.fu@intel.com>
> Contributed-under: TianoCore Contribution Agreement 1.0
> Signed-off-by: Wang Fan <fan.wang@intel.com>
> ---
>  MdeModulePkg/Universal/Network/Dhcp4Dxe/Dhcp4Io.c | 8 +++-----
>  1 file changed, 3 insertions(+), 5 deletions(-)
> 
> diff --git a/MdeModulePkg/Universal/Network/Dhcp4Dxe/Dhcp4Io.c
> b/MdeModulePkg/Universal/Network/Dhcp4Dxe/Dhcp4Io.c
> index 3898223..d90dc34 100644
> --- a/MdeModulePkg/Universal/Network/Dhcp4Dxe/Dhcp4Io.c
> +++ b/MdeModulePkg/Universal/Network/Dhcp4Dxe/Dhcp4Io.c
> @@ -1397,23 +1397,22 @@ DhcpSendMessage (
>      EndPoint.LocalAddr.Addr[0]  = DhcpSb->ClientAddr;
>      UdpIo                       = DhcpSb->LeaseIoPort;
>    }
> 
>    ASSERT (UdpIo != NULL);
> -  NET_GET_REF (Wrap);
> -
> +
>    Status = UdpIoSendDatagram (
>               UdpIo,
>               Wrap,
>               &EndPoint,
>               NULL,
>               DhcpOnPacketSent,
>               DhcpSb
>               );
> 
>    if (EFI_ERROR (Status)) {
> -    NET_PUT_REF (Wrap);
> +    NetbufFree (Wrap);
>      return EFI_ACCESS_DENIED;
>    }
> 
>    return EFI_SUCCESS;
>  }
> @@ -1475,22 +1474,21 @@ DhcpRetransmit (
>      UdpIo                       = DhcpSb->LeaseIoPort;
>    }
> 
>    ASSERT (UdpIo != NULL);
> 
> -  NET_GET_REF (Wrap);
>    Status = UdpIoSendDatagram (
>               UdpIo,
>               Wrap,
>               &EndPoint,
>               NULL,
>               DhcpOnPacketSent,
>               DhcpSb
>               );
> 
>    if (EFI_ERROR (Status)) {
> -    NET_PUT_REF (Wrap);
> +    NetbufFree (Wrap);
>      return EFI_ACCESS_DENIED;
>    }
> 
>    return EFI_SUCCESS;
>  }
> --
> 1.9.5.msysgit.1

_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel