From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=134.134.136.31; helo=mga06.intel.com; envelope-from=jiaxin.wu@intel.com; receiver=edk2-devel@lists.01.org Received: from mga06.intel.com (mga06.intel.com [134.134.136.31]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id 761582035D321 for ; Mon, 8 Jan 2018 18:50:59 -0800 (PST) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga003.jf.intel.com ([10.7.209.27]) by orsmga104.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 08 Jan 2018 18:56:09 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.46,334,1511856000"; d="scan'208";a="18548743" Received: from jiaxinwu-mobl2.ccr.corp.intel.com ([10.239.196.147]) by orsmga003.jf.intel.com with ESMTP; 08 Jan 2018 18:56:07 -0800 From: Jiaxin Wu To: edk2-devel@lists.01.org Cc: Ye Ting , Fu Siyuan , Wu Jiaxin Date: Tue, 9 Jan 2018 10:56:04 +0800 Message-Id: <1515466566-13136-1-git-send-email-jiaxin.wu@intel.com> X-Mailer: git-send-email 1.9.5.msysgit.1 Subject: [Patch 0/2] IScsiDxe: Set ExitBootServiceEvent to NULL after close it. X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Jan 2018 02:50:59 -0000 There are two place to close the ISCSI ExitBootServiceEvent: One is IScsiOnExitBootService callback function. Another is ISCSI driver stop() function. When OS loader triggers ExitBootServiceEvent, firstly, the exit boot service callback function will close and free the ExitBootServiceEvent, then secondly the system will call ISCSI driver stop() function, the ExitBootServiceEvent will be closed and freed again, the use-after-free memory access happens. This issue is recorded at https://bugzilla.tianocore.org/show_bug.cgi?id=742. This patch is to resolve the issue. Cc: Ye Ting Cc: Fu Siyuan Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Wu Jiaxin *** BLURB HERE *** Jiaxin Wu (2): MdeModulePkg/IScsiDxe: Set ExitBootServiceEvent to NULL after close it. NetworkPkg/IScsiDxe: Set ExitBootServiceEvent to NULL after close it. MdeModulePkg/Universal/Network/IScsiDxe/IScsiMisc.c | 12 ++++++++---- NetworkPkg/IScsiDxe/IScsiMisc.c | 12 ++++++++---- 2 files changed, 16 insertions(+), 8 deletions(-) -- 1.9.5.msysgit.1