From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=134.134.136.20; helo=mga02.intel.com; envelope-from=jiaxin.wu@intel.com; receiver=edk2-devel@lists.01.org Received: from mga02.intel.com (mga02.intel.com [134.134.136.20]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id ED377220C1603 for ; Wed, 22 Nov 2017 17:11:36 -0800 (PST) Received: from fmsmga003.fm.intel.com ([10.253.24.29]) by orsmga101.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 22 Nov 2017 17:15:53 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.44,438,1505804400"; d="scan'208";a="4838934" Received: from fmsmsx105.amr.corp.intel.com ([10.18.124.203]) by FMSMGA003.fm.intel.com with ESMTP; 22 Nov 2017 17:15:53 -0800 Received: from fmsmsx122.amr.corp.intel.com (10.18.125.37) by FMSMSX105.amr.corp.intel.com (10.18.124.203) with Microsoft SMTP Server (TLS) id 14.3.319.2; Wed, 22 Nov 2017 17:15:53 -0800 Received: from shsmsx152.ccr.corp.intel.com (10.239.6.52) by fmsmsx122.amr.corp.intel.com (10.18.125.37) with Microsoft SMTP Server (TLS) id 14.3.319.2; Wed, 22 Nov 2017 17:15:52 -0800 Received: from shsmsx103.ccr.corp.intel.com ([169.254.4.213]) by SHSMSX152.ccr.corp.intel.com ([169.254.6.93]) with mapi id 14.03.0319.002; Thu, 23 Nov 2017 09:15:51 +0800 From: "Wu, Jiaxin" To: "Wang, Fan" , "edk2-devel@lists.01.org" CC: "Ye, Ting" , "Fu, Siyuan" Thread-Topic: [Patch] MdeModulePkg: Free NET_BUF data after it is sent out to avoid memory leak Thread-Index: AQHTY1709O+AkmHc5UiHdOXZHmDrKKMhKMmw Date: Thu, 23 Nov 2017 01:15:50 +0000 Message-ID: <895558F6EA4E3B41AC93A00D163B72741634ABA1@SHSMSX103.ccr.corp.intel.com> References: <1511333741-7060-1-git-send-email-fan.wang@intel.com> In-Reply-To: <1511333741-7060-1-git-send-email-fan.wang@intel.com> Accept-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-titus-metadata-40: eyJDYXRlZ29yeUxhYmVscyI6IiIsIk1ldGFkYXRhIjp7Im5zIjoiaHR0cDpcL1wvd3d3LnRpdHVzLmNvbVwvbnNcL0ludGVsMyIsImlkIjoiZTNmZTIxYjMtNDFlMi00YjgzLTg1ZGEtOTk5YTg5Mjk3MmJmIiwicHJvcHMiOlt7Im4iOiJDVFBDbGFzc2lmaWNhdGlvbiIsInZhbHMiOlt7InZhbHVlIjoiQ1RQX1BVQkxJQyJ9XX1dfSwiU3ViamVjdExhYmVscyI6W10sIlRNQ1ZlcnNpb24iOiIxNi41LjkuMyIsIlRydXN0ZWRMYWJlbEhhc2giOiJNdXF2ajFHT285b1VSWEdZT0FSK2RMeURBVk1ZaldkOVZOazlHeUxYUTk4PSJ9 x-ctpclassification: CTP_PUBLIC dlp-product: dlpe-windows dlp-version: 11.0.0.116 dlp-reaction: no-action x-originating-ip: [10.239.127.40] MIME-Version: 1.0 Subject: Re: [Patch] MdeModulePkg: Free NET_BUF data after it is sent out to avoid memory leak X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Nov 2017 01:11:37 -0000 Content-Language: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi Fan, Looks this patch will cause the null pointer dereference issue, see below a= nalysis: With this patch, the NET_BUF will be freed and the corresponding Arg (Packe= t) will also be freed in DhcpReleasePacket. Wrap =3D NetbufFromExt (&Frag, 1, 0, 0, DhcpReleasePacket, Packet); That's incorrect since the Packet will be retransmit later. Please take a look. Thanks, Jiaxin > -----Original Message----- > From: Wang, Fan > Sent: Wednesday, November 22, 2017 2:56 PM > To: edk2-devel@lists.01.org > Cc: Wu, Jiaxin ; Ye, Ting ; Fu, > Siyuan ; Wang, Fan > Subject: [Patch] MdeModulePkg: Free NET_BUF data after it is sent out to > avoid memory leak >=20 > When build a DHCP message in function DhcpSendMessage() or > DhcpRetransmit(), > a new NET_BUF is created by the library of NetbufFromExt, but it's not fr= eed > after it is sent out. This patch is to fix this memory leak issue. >=20 > Cc: Jiaxin Wu > Cc: Ye Ting > Cc: Fu Siyuan > Contributed-under: TianoCore Contribution Agreement 1.0 > Signed-off-by: Wang Fan > --- > MdeModulePkg/Universal/Network/Dhcp4Dxe/Dhcp4Io.c | 8 +++----- > 1 file changed, 3 insertions(+), 5 deletions(-) >=20 > diff --git a/MdeModulePkg/Universal/Network/Dhcp4Dxe/Dhcp4Io.c > b/MdeModulePkg/Universal/Network/Dhcp4Dxe/Dhcp4Io.c > index 3898223..d90dc34 100644 > --- a/MdeModulePkg/Universal/Network/Dhcp4Dxe/Dhcp4Io.c > +++ b/MdeModulePkg/Universal/Network/Dhcp4Dxe/Dhcp4Io.c > @@ -1397,23 +1397,22 @@ DhcpSendMessage ( > EndPoint.LocalAddr.Addr[0] =3D DhcpSb->ClientAddr; > UdpIo =3D DhcpSb->LeaseIoPort; > } >=20 > ASSERT (UdpIo !=3D NULL); > - NET_GET_REF (Wrap); > - > + > Status =3D UdpIoSendDatagram ( > UdpIo, > Wrap, > &EndPoint, > NULL, > DhcpOnPacketSent, > DhcpSb > ); >=20 > if (EFI_ERROR (Status)) { > - NET_PUT_REF (Wrap); > + NetbufFree (Wrap); > return EFI_ACCESS_DENIED; > } >=20 > return EFI_SUCCESS; > } > @@ -1475,22 +1474,21 @@ DhcpRetransmit ( > UdpIo =3D DhcpSb->LeaseIoPort; > } >=20 > ASSERT (UdpIo !=3D NULL); >=20 > - NET_GET_REF (Wrap); > Status =3D UdpIoSendDatagram ( > UdpIo, > Wrap, > &EndPoint, > NULL, > DhcpOnPacketSent, > DhcpSb > ); >=20 > if (EFI_ERROR (Status)) { > - NET_PUT_REF (Wrap); > + NetbufFree (Wrap); > return EFI_ACCESS_DENIED; > } >=20 > return EFI_SUCCESS; > } > -- > 1.9.5.msysgit.1