IScsiDxe: Set ExitBootServiceEvent to NULL after close it.

[edk2] [Patch 0/2] IScsiDxe: Set ExitBootServiceEvent to NULL after close it.

Posted by Jiaxin Wu 6 years, 11 months ago

There are two place to close the ISCSI ExitBootServiceEvent:
One is IScsiOnExitBootService callback function.
Another is ISCSI driver stop() function.

When OS loader triggers ExitBootServiceEvent, firstly, the exit boot service
callback function will close and free the ExitBootServiceEvent, then secondly
the system will call ISCSI driver stop() function, the ExitBootServiceEvent
will be closed and freed again, the use-after-free memory access happens.

This issue is recorded at https://bugzilla.tianocore.org/show_bug.cgi?id=742.
This patch is to resolve the issue.

Cc: Ye Ting <ting.ye@intel.com>
Cc: Fu Siyuan <siyuan.fu@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Wu Jiaxin <jiaxin.wu@intel.com>

*** BLURB HERE ***

Jiaxin Wu (2):
  MdeModulePkg/IScsiDxe: Set ExitBootServiceEvent to NULL after close
    it.
  NetworkPkg/IScsiDxe: Set ExitBootServiceEvent to NULL after close it.

 MdeModulePkg/Universal/Network/IScsiDxe/IScsiMisc.c | 12 ++++++++----
 NetworkPkg/IScsiDxe/IScsiMisc.c                     | 12 ++++++++----
 2 files changed, 16 insertions(+), 8 deletions(-)

-- 
1.9.5.msysgit.1

_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel

Re: [edk2] [Patch 0/2] IScsiDxe: Set ExitBootServiceEvent to NULL after close it.

Posted by Fu, Siyuan 6 years, 11 months ago

Hi, Jiaxin,

The patch is good to me.

Reviewed-by: Fu Siyuan <siyuan.fu@intel.com>

> -----Original Message-----
> From: Wu, Jiaxin
> Sent: Tuesday, January 9, 2018 10:56 AM
> To: edk2-devel@lists.01.org
> Cc: Ye, Ting <ting.ye@intel.com>; Fu, Siyuan <siyuan.fu@intel.com>; Wu,
> Jiaxin <jiaxin.wu@intel.com>
> Subject: [Patch 0/2] IScsiDxe: Set ExitBootServiceEvent to NULL after
> close it.
> 
> There are two place to close the ISCSI ExitBootServiceEvent:
> One is IScsiOnExitBootService callback function.
> Another is ISCSI driver stop() function.
> 
> When OS loader triggers ExitBootServiceEvent, firstly, the exit boot
> service
> callback function will close and free the ExitBootServiceEvent, then
> secondly
> the system will call ISCSI driver stop() function, the
> ExitBootServiceEvent
> will be closed and freed again, the use-after-free memory access happens.
> 
> This issue is recorded at
> https://bugzilla.tianocore.org/show_bug.cgi?id=742.
> This patch is to resolve the issue.
> 
> Cc: Ye Ting <ting.ye@intel.com>
> Cc: Fu Siyuan <siyuan.fu@intel.com>
> Contributed-under: TianoCore Contribution Agreement 1.0
> Signed-off-by: Wu Jiaxin <jiaxin.wu@intel.com>
> 
> *** BLURB HERE ***
> 
> Jiaxin Wu (2):
>   MdeModulePkg/IScsiDxe: Set ExitBootServiceEvent to NULL after close
>     it.
>   NetworkPkg/IScsiDxe: Set ExitBootServiceEvent to NULL after close it.
> 
>  MdeModulePkg/Universal/Network/IScsiDxe/IScsiMisc.c | 12 ++++++++----
>  NetworkPkg/IScsiDxe/IScsiMisc.c                     | 12 ++++++++----
>  2 files changed, 16 insertions(+), 8 deletions(-)
> 
> --
> 1.9.5.msysgit.1

_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel