From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=192.55.52.115; helo=mga14.intel.com; envelope-from=siyuan.fu@intel.com; receiver=edk2-devel@lists.01.org Received: from mga14.intel.com (mga14.intel.com [192.55.52.115]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id 55CC12035D334 for ; Mon, 8 Jan 2018 22:09:08 -0800 (PST) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga005.jf.intel.com ([10.7.209.41]) by fmsmga103.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 08 Jan 2018 22:14:17 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.46,334,1511856000"; d="scan'208";a="191729410" Received: from fmsmsx103.amr.corp.intel.com ([10.18.124.201]) by orsmga005.jf.intel.com with ESMTP; 08 Jan 2018 22:14:17 -0800 Received: from fmsmsx112.amr.corp.intel.com (10.18.116.6) by FMSMSX103.amr.corp.intel.com (10.18.124.201) with Microsoft SMTP Server (TLS) id 14.3.319.2; Mon, 8 Jan 2018 22:14:17 -0800 Received: from shsmsx104.ccr.corp.intel.com (10.239.4.70) by FMSMSX112.amr.corp.intel.com (10.18.116.6) with Microsoft SMTP Server (TLS) id 14.3.319.2; Mon, 8 Jan 2018 22:14:16 -0800 Received: from shsmsx103.ccr.corp.intel.com ([169.254.4.213]) by SHSMSX104.ccr.corp.intel.com ([169.254.5.152]) with mapi id 14.03.0319.002; Tue, 9 Jan 2018 14:14:15 +0800 From: "Fu, Siyuan" To: "Wu, Jiaxin" , "edk2-devel@lists.01.org" CC: "Ye, Ting" Thread-Topic: [Patch 0/2] IScsiDxe: Set ExitBootServiceEvent to NULL after close it. Thread-Index: AQHTiPVob+piZUIO40a1ExcMc2WXHqNq/wBg Date: Tue, 9 Jan 2018 06:14:14 +0000 Message-ID: References: <1515466566-13136-1-git-send-email-jiaxin.wu@intel.com> In-Reply-To: <1515466566-13136-1-git-send-email-jiaxin.wu@intel.com> Accept-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ctpclassification: CTP_NT x-titus-metadata-40: eyJDYXRlZ29yeUxhYmVscyI6IiIsIk1ldGFkYXRhIjp7Im5zIjoiaHR0cDpcL1wvd3d3LnRpdHVzLmNvbVwvbnNcL0ludGVsMyIsImlkIjoiNzU0YWM2MjItZWFmMS00OWE4LWIxYjMtMzVlMDg0M2U1MzVkIiwicHJvcHMiOlt7Im4iOiJDVFBDbGFzc2lmaWNhdGlvbiIsInZhbHMiOlt7InZhbHVlIjoiQ1RQX05UIn1dfV19LCJTdWJqZWN0TGFiZWxzIjpbXSwiVE1DVmVyc2lvbiI6IjE3LjIuNS4xOCIsIlRydXN0ZWRMYWJlbEhhc2giOiJQcjNsV0x0XC80M0JQR1Z6NDUwSWVBV2RqbXp4UVlvRXN0V3FxMXpYMVp0bjBtSjUxXC80UkhWaSt6WWdld29pZjIifQ== dlp-product: dlpe-windows dlp-version: 11.0.0.116 dlp-reaction: no-action x-originating-ip: [10.239.127.40] MIME-Version: 1.0 Subject: Re: [Patch 0/2] IScsiDxe: Set ExitBootServiceEvent to NULL after close it. X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Jan 2018 06:09:08 -0000 Content-Language: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi, Jiaxin, The patch is good to me. Reviewed-by: Fu Siyuan > -----Original Message----- > From: Wu, Jiaxin > Sent: Tuesday, January 9, 2018 10:56 AM > To: edk2-devel@lists.01.org > Cc: Ye, Ting ; Fu, Siyuan ; Wu, > Jiaxin > Subject: [Patch 0/2] IScsiDxe: Set ExitBootServiceEvent to NULL after > close it. >=20 > There are two place to close the ISCSI ExitBootServiceEvent: > One is IScsiOnExitBootService callback function. > Another is ISCSI driver stop() function. >=20 > When OS loader triggers ExitBootServiceEvent, firstly, the exit boot > service > callback function will close and free the ExitBootServiceEvent, then > secondly > the system will call ISCSI driver stop() function, the > ExitBootServiceEvent > will be closed and freed again, the use-after-free memory access happens. >=20 > This issue is recorded at > https://bugzilla.tianocore.org/show_bug.cgi?id=3D742. > This patch is to resolve the issue. >=20 > Cc: Ye Ting > Cc: Fu Siyuan > Contributed-under: TianoCore Contribution Agreement 1.0 > Signed-off-by: Wu Jiaxin >=20 > *** BLURB HERE *** >=20 > Jiaxin Wu (2): > MdeModulePkg/IScsiDxe: Set ExitBootServiceEvent to NULL after close > it. > NetworkPkg/IScsiDxe: Set ExitBootServiceEvent to NULL after close it. >=20 > MdeModulePkg/Universal/Network/IScsiDxe/IScsiMisc.c | 12 ++++++++---- > NetworkPkg/IScsiDxe/IScsiMisc.c | 12 ++++++++---- > 2 files changed, 16 insertions(+), 8 deletions(-) >=20 > -- > 1.9.5.msysgit.1