NetworkPkg/HttpDxe: Don't free Wrap in HttpTcpReceiveNotifyDpc

The HTTP Token Wrap is created in EfiHttpResponse() and then passed
to the deferred Receive event callback, HttpTcpReceiveNotifyDpc.
HttpTcpReceiveHeader and HttpTcpReceiveBody use a Tcp polling loop to
monitor the socket status and trigger the Receive event when a new
packet arrives. The Receive event brings up HttpTcpReceiveNotifyDpc
to process the HTTP message and the function will set Wrap->TcpWrap.IsRxDone
to TRUE to break the Tcp polling loop.

However, HttpTcpReceiveNotifyDpc mistakenly freed Wrap, so the Tcp
polling loop was actually checking a dead variable, and this led the
system into an unstable status.

Given the fact that the HTTP Token Wrap will be freed in EfiHttpResponse
or HttpResponseWorker, this commit removes every "FreePool (Wrap)" in
HttpTcpReceiveNotifyDpc.

v2:
* Free Wrap after HttpTcpReceiveBody returns normally.

Cc: "Wu, Jiaxin" <jiaxin.wu@intel.com>
Cc: "Siyuan Fu" <siyuan.fu@intel.com>
Cc: "El-Haj-Mahmoud, Samer" <samer.el-haj-mahmoud@hpe.com>
Cc: "Laszlo Ersek" <lersek@redhat.com>
Cc: "Hegde, Nagaraj P" <nagaraj-p.hegde@hpe.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Gary Lin <glin@suse.com>
Reviewed-by: Samer El-Haj-Mahmoud <elhaj@hpe.com>
Reviewed-by: Jiaxin Wu <jiaxin.wu@intel.com>
Reviewed-by: Siyuan Fu <siyuan.fu@intel.com>

diff --git a/NetworkPkg/HttpDxe/HttpImpl.c b/NetworkPkg/HttpDxe/HttpImpl.c
index dd10f826b4b4470be2a8fe9a9b24ae14c609c936..f4ae28aec98f6a364b8e354d856005488c20289e 100644 (file)
--- a/NetworkPkg/HttpDxe/HttpImpl.c
+++ b/NetworkPkg/HttpDxe/HttpImpl.c
@@ -1237,6 +1237,7 @@ HttpResponseWorker (
     goto Error;\r
   }\r
 \r
+  FreePool (Wrap);\r
   return Status;\r
 \r
 Exit:\r

diff --git a/NetworkPkg/HttpDxe/HttpProto.c b/NetworkPkg/HttpDxe/HttpProto.c
index f3992edfdc803b5d4b5f5cbc1f8d0a87ae43bd3e..afa7fe4b3508bf7b286b45c715f745196db2df7c 100644 (file)
--- a/NetworkPkg/HttpDxe/HttpProto.c
+++ b/NetworkPkg/HttpDxe/HttpProto.c
@@ -152,7 +152,6 @@ HttpTcpReceiveNotifyDpc (
     if (EFI_ERROR (Wrap->TcpWrap.Rx6Token.CompletionToken.Status)) {\r
       Wrap->HttpToken->Status = Wrap->TcpWrap.Rx6Token.CompletionToken.Status;\r
       gBS->SignalEvent (Wrap->HttpToken->Event);\r
-      FreePool (Wrap);\r
       return ;\r
     }\r
 \r
@@ -162,7 +161,6 @@ HttpTcpReceiveNotifyDpc (
     if (EFI_ERROR (Wrap->TcpWrap.Rx4Token.CompletionToken.Status)) {\r
       Wrap->HttpToken->Status = Wrap->TcpWrap.Rx4Token.CompletionToken.Status;\r
       gBS->SignalEvent (Wrap->HttpToken->Event);\r
-      FreePool (Wrap);\r
       return ;\r
     }\r
   }\r
@@ -234,8 +232,6 @@ HttpTcpReceiveNotifyDpc (
   // Check pending RxTokens and receive the HTTP message.\r
   //\r
   NetMapIterate (&Wrap->HttpInstance->RxTokens, HttpTcpReceive, NULL);\r
-  \r
-  FreePool (Wrap);\r
 }\r
 \r
 /**\r