MdeModulePkg/SmmCore: Fix hang due to already-freed memory deference
authorRuiyu Ni <ruiyu.ni@intel.com>
Thu, 1 Feb 2018 10:14:24 +0000 (18:14 +0800)
committerRuiyu Ni <ruiyu.ni@intel.com>
Sat, 3 Feb 2018 06:48:58 +0000 (14:48 +0800)
commit8a641d2b73295d64438012972aac83838de31671
tree886a7d658bd7d82e4f25fdf719f8b0ea3064e427
parent2ad34f65af46b825b4fbf0d492e22df89207516c
MdeModulePkg/SmmCore: Fix hang due to already-freed memory deference

SmiHandlerUnRegister() validates the DispatchHandle by checking
whether the first 32bit matches to a certain signature
(SMI_HANDLER_SIGNATURE).
But if a caller calls *UnRegister() twice and the memory freed by
first call still contains the signature, the second call may hang.

The patch fixes this issue by locating the DispatchHandle
in all SMI handlers, instead of checking the signature.

Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Ruiyu Ni <ruiyu.ni@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Reviewed-by: Star Zeng <star.zeng@intel.com>
MdeModulePkg/Core/PiSmmCore/Smi.c