* Re: [Patch] MdeModulePkg: Free NET_BUF data after it is sent out to avoid memory leak
2017-11-22 6:55 [Patch] MdeModulePkg: Free NET_BUF data after it is sent out to avoid memory leak fanwang2
@ 2017-11-22 7:41 ` Fu, Siyuan
2017-11-23 1:15 ` Wu, Jiaxin
1 sibling, 0 replies; 3+ messages in thread
From: Fu, Siyuan @ 2017-11-22 7:41 UTC (permalink / raw)
To: Wang, Fan, edk2-devel@lists.01.org; +Cc: Wu, Jiaxin, Ye, Ting
Reviewed-by: Fu Siyuan <siyuan.fu@intel.com>
> -----Original Message-----
> From: Wang, Fan
> Sent: Wednesday, November 22, 2017 2:56 PM
> To: edk2-devel@lists.01.org
> Cc: Wu, Jiaxin <jiaxin.wu@intel.com>; Ye, Ting <ting.ye@intel.com>; Fu,
> Siyuan <siyuan.fu@intel.com>; Wang, Fan <fan.wang@intel.com>
> Subject: [Patch] MdeModulePkg: Free NET_BUF data after it is sent out to
> avoid memory leak
>
> When build a DHCP message in function DhcpSendMessage() or
> DhcpRetransmit(),
> a new NET_BUF is created by the library of NetbufFromExt, but it's not
> freed
> after it is sent out. This patch is to fix this memory leak issue.
>
> Cc: Jiaxin Wu <jiaxin.wu@intel.com>
> Cc: Ye Ting <ting.ye@intel.com>
> Cc: Fu Siyuan <siyuan.fu@intel.com>
> Contributed-under: TianoCore Contribution Agreement 1.0
> Signed-off-by: Wang Fan <fan.wang@intel.com>
> ---
> MdeModulePkg/Universal/Network/Dhcp4Dxe/Dhcp4Io.c | 8 +++-----
> 1 file changed, 3 insertions(+), 5 deletions(-)
>
> diff --git a/MdeModulePkg/Universal/Network/Dhcp4Dxe/Dhcp4Io.c
> b/MdeModulePkg/Universal/Network/Dhcp4Dxe/Dhcp4Io.c
> index 3898223..d90dc34 100644
> --- a/MdeModulePkg/Universal/Network/Dhcp4Dxe/Dhcp4Io.c
> +++ b/MdeModulePkg/Universal/Network/Dhcp4Dxe/Dhcp4Io.c
> @@ -1397,23 +1397,22 @@ DhcpSendMessage (
> EndPoint.LocalAddr.Addr[0] = DhcpSb->ClientAddr;
> UdpIo = DhcpSb->LeaseIoPort;
> }
>
> ASSERT (UdpIo != NULL);
> - NET_GET_REF (Wrap);
> -
> +
> Status = UdpIoSendDatagram (
> UdpIo,
> Wrap,
> &EndPoint,
> NULL,
> DhcpOnPacketSent,
> DhcpSb
> );
>
> if (EFI_ERROR (Status)) {
> - NET_PUT_REF (Wrap);
> + NetbufFree (Wrap);
> return EFI_ACCESS_DENIED;
> }
>
> return EFI_SUCCESS;
> }
> @@ -1475,22 +1474,21 @@ DhcpRetransmit (
> UdpIo = DhcpSb->LeaseIoPort;
> }
>
> ASSERT (UdpIo != NULL);
>
> - NET_GET_REF (Wrap);
> Status = UdpIoSendDatagram (
> UdpIo,
> Wrap,
> &EndPoint,
> NULL,
> DhcpOnPacketSent,
> DhcpSb
> );
>
> if (EFI_ERROR (Status)) {
> - NET_PUT_REF (Wrap);
> + NetbufFree (Wrap);
> return EFI_ACCESS_DENIED;
> }
>
> return EFI_SUCCESS;
> }
> --
> 1.9.5.msysgit.1
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [Patch] MdeModulePkg: Free NET_BUF data after it is sent out to avoid memory leak
2017-11-22 6:55 [Patch] MdeModulePkg: Free NET_BUF data after it is sent out to avoid memory leak fanwang2
2017-11-22 7:41 ` Fu, Siyuan
@ 2017-11-23 1:15 ` Wu, Jiaxin
1 sibling, 0 replies; 3+ messages in thread
From: Wu, Jiaxin @ 2017-11-23 1:15 UTC (permalink / raw)
To: Wang, Fan, edk2-devel@lists.01.org; +Cc: Ye, Ting, Fu, Siyuan
Hi Fan,
Looks this patch will cause the null pointer dereference issue, see below analysis:
With this patch, the NET_BUF will be freed and the corresponding Arg (Packet) will also be freed in DhcpReleasePacket.
Wrap = NetbufFromExt (&Frag, 1, 0, 0, DhcpReleasePacket, Packet);
That's incorrect since the Packet will be retransmit later.
Please take a look.
Thanks,
Jiaxin
> -----Original Message-----
> From: Wang, Fan
> Sent: Wednesday, November 22, 2017 2:56 PM
> To: edk2-devel@lists.01.org
> Cc: Wu, Jiaxin <jiaxin.wu@intel.com>; Ye, Ting <ting.ye@intel.com>; Fu,
> Siyuan <siyuan.fu@intel.com>; Wang, Fan <fan.wang@intel.com>
> Subject: [Patch] MdeModulePkg: Free NET_BUF data after it is sent out to
> avoid memory leak
>
> When build a DHCP message in function DhcpSendMessage() or
> DhcpRetransmit(),
> a new NET_BUF is created by the library of NetbufFromExt, but it's not freed
> after it is sent out. This patch is to fix this memory leak issue.
>
> Cc: Jiaxin Wu <jiaxin.wu@intel.com>
> Cc: Ye Ting <ting.ye@intel.com>
> Cc: Fu Siyuan <siyuan.fu@intel.com>
> Contributed-under: TianoCore Contribution Agreement 1.0
> Signed-off-by: Wang Fan <fan.wang@intel.com>
> ---
> MdeModulePkg/Universal/Network/Dhcp4Dxe/Dhcp4Io.c | 8 +++-----
> 1 file changed, 3 insertions(+), 5 deletions(-)
>
> diff --git a/MdeModulePkg/Universal/Network/Dhcp4Dxe/Dhcp4Io.c
> b/MdeModulePkg/Universal/Network/Dhcp4Dxe/Dhcp4Io.c
> index 3898223..d90dc34 100644
> --- a/MdeModulePkg/Universal/Network/Dhcp4Dxe/Dhcp4Io.c
> +++ b/MdeModulePkg/Universal/Network/Dhcp4Dxe/Dhcp4Io.c
> @@ -1397,23 +1397,22 @@ DhcpSendMessage (
> EndPoint.LocalAddr.Addr[0] = DhcpSb->ClientAddr;
> UdpIo = DhcpSb->LeaseIoPort;
> }
>
> ASSERT (UdpIo != NULL);
> - NET_GET_REF (Wrap);
> -
> +
> Status = UdpIoSendDatagram (
> UdpIo,
> Wrap,
> &EndPoint,
> NULL,
> DhcpOnPacketSent,
> DhcpSb
> );
>
> if (EFI_ERROR (Status)) {
> - NET_PUT_REF (Wrap);
> + NetbufFree (Wrap);
> return EFI_ACCESS_DENIED;
> }
>
> return EFI_SUCCESS;
> }
> @@ -1475,22 +1474,21 @@ DhcpRetransmit (
> UdpIo = DhcpSb->LeaseIoPort;
> }
>
> ASSERT (UdpIo != NULL);
>
> - NET_GET_REF (Wrap);
> Status = UdpIoSendDatagram (
> UdpIo,
> Wrap,
> &EndPoint,
> NULL,
> DhcpOnPacketSent,
> DhcpSb
> );
>
> if (EFI_ERROR (Status)) {
> - NET_PUT_REF (Wrap);
> + NetbufFree (Wrap);
> return EFI_ACCESS_DENIED;
> }
>
> return EFI_SUCCESS;
> }
> --
> 1.9.5.msysgit.1
^ permalink raw reply [flat|nested] 3+ messages in thread