From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=134.134.136.100; helo=mga07.intel.com; envelope-from=siyuan.fu@intel.com; receiver=edk2-devel@lists.01.org Received: from mga07.intel.com (mga07.intel.com [134.134.136.100]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id 07CCD2218E923 for ; Wed, 6 Dec 2017 18:43:10 -0800 (PST) Received: from orsmga008.jf.intel.com ([10.7.209.65]) by orsmga105.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 06 Dec 2017 18:47:43 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.45,370,1508828400"; d="scan'208";a="738269" Received: from fmsmsx105.amr.corp.intel.com ([10.18.124.203]) by orsmga008.jf.intel.com with ESMTP; 06 Dec 2017 18:47:43 -0800 Received: from FMSMSX109.amr.corp.intel.com (10.18.116.9) by FMSMSX105.amr.corp.intel.com (10.18.124.203) with Microsoft SMTP Server (TLS) id 14.3.319.2; Wed, 6 Dec 2017 18:47:42 -0800 Received: from shsmsx101.ccr.corp.intel.com (10.239.4.153) by fmsmsx109.amr.corp.intel.com (10.18.116.9) with Microsoft SMTP Server (TLS) id 14.3.319.2; Wed, 6 Dec 2017 18:47:42 -0800 Received: from shsmsx103.ccr.corp.intel.com ([169.254.4.213]) by SHSMSX101.ccr.corp.intel.com ([169.254.1.159]) with mapi id 14.03.0319.002; Thu, 7 Dec 2017 10:47:40 +0800 From: "Fu, Siyuan" To: Heyi Guo , "linaro-uefi@lists.linaro.org" , "edk2-devel@lists.01.org" CC: Junbiao Hong , "Zeng, Star" , "Dong, Eric" , "Ni, Ruiyu" , "Wu, Jiaxin" Thread-Topic: [RFC] MdeModulePkg/Ip4Dxe: fix ICMP echo reply memory leak Thread-Index: AQHTbwI7wr6aZjZLuEien+zh44Nw9KM3LXFg Date: Thu, 7 Dec 2017 02:47:40 +0000 Message-ID: References: <1512613307-62879-1-git-send-email-heyi.guo@linaro.org> In-Reply-To: <1512613307-62879-1-git-send-email-heyi.guo@linaro.org> Accept-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ctpclassification: CTP_IC x-titus-metadata-40: eyJDYXRlZ29yeUxhYmVscyI6IiIsIk1ldGFkYXRhIjp7Im5zIjoiaHR0cDpcL1wvd3d3LnRpdHVzLmNvbVwvbnNcL0ludGVsMyIsImlkIjoiNjIwMGE2M2EtYzk1YS00NmE3LWIxNjQtOWM5YTU0NDQ5ZmI0IiwicHJvcHMiOlt7Im4iOiJDVFBDbGFzc2lmaWNhdGlvbiIsInZhbHMiOlt7InZhbHVlIjoiQ1RQX0lDIn1dfV19LCJTdWJqZWN0TGFiZWxzIjpbXSwiVE1DVmVyc2lvbiI6IjE3LjIuNS4xOCIsIlRydXN0ZWRMYWJlbEhhc2giOiJaR3Y2UjdCNVNzbGpOVEZVc2dyVFA2MlRUaEFMQkdZWXZMcXAyNzBRYVFpcmxzTlcrNDJYOVwvZ2VmQTFHNjV2WSJ9 dlp-product: dlpe-windows dlp-version: 11.0.0.116 dlp-reaction: no-action x-originating-ip: [10.239.127.40] MIME-Version: 1.0 Subject: Re: [RFC] MdeModulePkg/Ip4Dxe: fix ICMP echo reply memory leak X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 07 Dec 2017 02:43:11 -0000 Content-Language: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Reviewed-by: Fu Siyuan > -----Original Message----- > From: Heyi Guo [mailto:heyi.guo@linaro.org] > Sent: Thursday, December 7, 2017 10:22 AM > To: linaro-uefi@lists.linaro.org; edk2-devel@lists.01.org > Cc: Heyi Guo ; Junbiao Hong = ; > Zeng, Star ; Dong, Eric ; Ni, > Ruiyu ; Fu, Siyuan ; Wu, Jiaxin > > Subject: [RFC] MdeModulePkg/Ip4Dxe: fix ICMP echo reply memory leak >=20 > When UEFI receives IPMP echo packets it will enter Ip4IcmpReplyEcho > function, and then call Ip4Output. However, if Ip4Output gets some > error and exits early, e.g. fails to find the route entry, memory > buffer of "Data" gets no chance to be freed and memory leak will be > caused. If there is such an attacker in the network, we will see UEFI > runs out of memory and system hangs. >=20 > Network stack code is so complicated that this is just a RFC to fix > this issue. Please provide your comments about this. >=20 > Contributed-under: TianoCore Contribution Agreement 1.1 > Signed-off-by: Junbiao Hong > Signed-off-by: Heyi Guo > Cc: Star Zeng > Cc: Eric Dong > Cc: Ruiyu Ni > Cc: Siyuan Fu > Cc: Jiaxin Wu > --- > MdeModulePkg/Universal/Network/Ip4Dxe/Ip4Icmp.c | 3 +++ > 1 file changed, 3 insertions(+) >=20 > diff --git a/MdeModulePkg/Universal/Network/Ip4Dxe/Ip4Icmp.c > b/MdeModulePkg/Universal/Network/Ip4Dxe/Ip4Icmp.c > index b4b0864..ed6bdbe 100644 > --- a/MdeModulePkg/Universal/Network/Ip4Dxe/Ip4Icmp.c > +++ b/MdeModulePkg/Universal/Network/Ip4Dxe/Ip4Icmp.c > @@ -267,6 +267,9 @@ Ip4IcmpReplyEcho ( > Ip4SysPacketSent, > NULL > ); > + if (EFI_ERROR (Status)) { > + NetbufFree (Data); > + } >=20 > ON_EXIT: > NetbufFree (Packet); > -- > 2.7.4