There are two place to close the ISCSI ExitBootServiceEvent:
One is IScsiOnExitBootService callback function.
Another is ISCSI driver stop() function.

When OS loader triggers ExitBootServiceEvent, firstly, the exit boot service
callback function will close and free the ExitBootServiceEvent, then secondly
the system will call ISCSI driver stop() function, the ExitBootServiceEvent
will be closed and freed again, the use-after-free memory access happens.

This issue is recorded at https://bugzilla.tianocore.org/show_bug.cgi?id=742.
This patch is to resolve the issue.

Cc: Ye Ting <ting.ye@intel.com>
Cc: Fu Siyuan <siyuan.fu@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Wu Jiaxin <jiaxin.wu@intel.com>
---
 NetworkPkg/IScsiDxe/IScsiMisc.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/NetworkPkg/IScsiDxe/IScsiMisc.c b/NetworkPkg/IScsiDxe/IScsiMisc.c
index 9e4164c..9b26147 100644
--- a/NetworkPkg/IScsiDxe/IScsiMisc.c
+++ b/NetworkPkg/IScsiDxe/IScsiMisc.c
@@ -1,9 +1,9 @@
 /** @file
   Miscellaneous routines for iSCSI driver.
 
-Copyright (c) 2004 - 2017, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2004 - 2018, Intel Corporation. All rights reserved.<BR>
 This program and the accompanying materials
 are licensed and made available under the terms and conditions of the BSD License
 which accompanies this distribution.  The full text of the license may be found at
 http://opensource.org/licenses/bsd-license.php
 
@@ -1796,12 +1796,13 @@ IScsiCleanDriverData (
       mPrivate->OneSessionEstablished = FALSE;
     }
   }
 
 EXIT:
-
-  gBS->CloseEvent (Private->ExitBootServiceEvent);
+  if (Private->ExitBootServiceEvent != NULL) {
+    gBS->CloseEvent (Private->ExitBootServiceEvent); 
+  }
 
   mCallbackInfo->Current = NULL;
 
   FreePool (Private);
   return Status;
@@ -2483,12 +2484,15 @@ IScsiOnExitBootService (
   )
 {
   ISCSI_DRIVER_DATA *Private;
 
   Private = (ISCSI_DRIVER_DATA *) Context;
+  
   gBS->CloseEvent (Private->ExitBootServiceEvent);
-
+  
+  Private->ExitBootServiceEvent = NULL;
+  
   if (Private->Session != NULL) {
     IScsiSessionAbort (Private->Session);
   }
 }
 
-- 
1.9.5.msysgit.1

_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel