NetworkPkg: Fix Duplicate FreePool Error in WCM

* REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1577

In WiFi Connection Manager scan process, the result received
from WiFi device driver will be freed twice, and will cause
unexpected errors, and even system crash.

This issue also exists in some other places potentially, this
patch is to fix these issues and also add Timer Cancelling
before Close to avoid potential NULL reference.

Cc: Ye Ting <ting.ye@intel.com>
Cc: Fu Siyuan <siyuan.fu@intel.com>
Cc: Wu Jiaxin <jiaxin.wu@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Wang Fan <fan.wang@intel.com>
Reviewed-by: Fu Siyuan <siyuan.fu@intel.com>
Reviewed-by: Wu Jiaxin <jiaxin.wu@intel.com>

diff --git a/NetworkPkg/WifiConnectionManagerDxe/WifiConnectionMgrDriver.c b/NetworkPkg/WifiConnectionManagerDxe/WifiConnectionMgrDriver.c
index 1431cdc7ea07eb4bab4af5363fd4fa834f5080d7..63b0670c636e7272c2c6a303409a1d8e34a72646 100644 (file)
--- a/NetworkPkg/WifiConnectionManagerDxe/WifiConnectionMgrDriver.c
+++ b/NetworkPkg/WifiConnectionManagerDxe/WifiConnectionMgrDriver.c
@@ -411,6 +411,7 @@ WifiMgrDxeDriverBindingStop (
   //\r
   // Close Event\r
   //\r
+  gBS->SetTimer (Nic->TickTimer, TimerCancel, 0);\r
   gBS->CloseEvent (Nic->TickTimer);\r
 \r
   //\r

diff --git a/NetworkPkg/WifiConnectionManagerDxe/WifiConnectionMgrFileUtil.c b/NetworkPkg/WifiConnectionManagerDxe/WifiConnectionMgrFileUtil.c
index 6db1626f2d07751686763b726d751b635162b592..02248234314dd13b383b7b06280fbd503f963160 100644 (file)
--- a/NetworkPkg/WifiConnectionManagerDxe/WifiConnectionMgrFileUtil.c
+++ b/NetworkPkg/WifiConnectionManagerDxe/WifiConnectionMgrFileUtil.c
@@ -253,6 +253,7 @@ UpdatePage(
 \r
     if (Private->FileContext->FileName != NULL) {\r
       FreePool (Private->FileContext->FileName);\r
+      Private->FileContext->FileName = NULL;\r
     }\r
     Private->FileContext->FileName = FileName;\r
 \r

diff --git a/NetworkPkg/WifiConnectionManagerDxe/WifiConnectionMgrHiiConfigAccess.c b/NetworkPkg/WifiConnectionManagerDxe/WifiConnectionMgrHiiConfigAccess.c
index bfb6b6e5caa8dcb52255cb905cc0671a2dadd7c8..d0d55f46dac2ed9a2329182e9922997d8225c79b 100644 (file)
--- a/NetworkPkg/WifiConnectionManagerDxe/WifiConnectionMgrHiiConfigAccess.c
+++ b/NetworkPkg/WifiConnectionManagerDxe/WifiConnectionMgrHiiConfigAccess.c
@@ -447,6 +447,8 @@ WifiMgrRefreshNetworkList (
       }\r
       FreePool (AKMListDisplay);\r
       FreePool (CipherListDisplay);\r
+      AKMListDisplay    = NULL;\r
+      CipherListDisplay = NULL;\r
 \r
       HiiCreateGotoOpCode (\r
         StartOpCodeHandle,\r
@@ -532,6 +534,8 @@ WifiMgrRefreshNetworkList (
       }\r
       FreePool (AKMListDisplay);\r
       FreePool (CipherListDisplay);\r
+      AKMListDisplay    = NULL;\r
+      CipherListDisplay = NULL;\r
 \r
       HiiCreateGotoOpCode (\r
         StartOpCodeHandle,\r
@@ -612,6 +616,8 @@ WifiMgrRefreshNetworkList (
       }\r
       FreePool (AKMListDisplay);\r
       FreePool (CipherListDisplay);\r
+      AKMListDisplay    = NULL;\r
+      CipherListDisplay = NULL;\r
 \r
       PortHelpToken = HiiSetString (Private->RegisteredHandle, 0, PortString, NULL);\r
 \r
@@ -1657,6 +1663,7 @@ WifiMgrDxeHiiConfigAccessCallback (
 \r
           ZeroMem (Profile->PrivateKeyData, Profile->PrivateKeyDataSize);\r
           FreePool (Profile->PrivateKeyData);\r
+          Profile->PrivateKeyData = NULL;\r
         }\r
 \r
         Status = WifiMgrReadFileToBuffer (\r
@@ -1700,12 +1707,14 @@ WifiMgrDxeHiiConfigAccessCallback (
 \r
             ZeroMem (Profile->CACertData, Profile->CACertSize);\r
             FreePool (Profile->CACertData);\r
+            Profile->CACertData = NULL;\r
           }\r
         } else if (Private->FileType == FileTypeClientCert) {\r
           if (Profile->ClientCertData != NULL) {\r
 \r
             ZeroMem (Profile->ClientCertData, Profile->ClientCertSize);\r
             FreePool (Profile->ClientCertData);\r
+            Profile->ClientCertData = NULL;\r
           }\r
         } else {\r
           break;\r

diff --git a/NetworkPkg/WifiConnectionManagerDxe/WifiConnectionMgrImpl.c b/NetworkPkg/WifiConnectionManagerDxe/WifiConnectionMgrImpl.c
index 52ce18dfd8d1de524ed27c61368f8be5815a876e..9417440ac577ff7e51d25911691e3cc4231845d5 100644 (file)
--- a/NetworkPkg/WifiConnectionManagerDxe/WifiConnectionMgrImpl.c
+++ b/NetworkPkg/WifiConnectionManagerDxe/WifiConnectionMgrImpl.c
@@ -212,7 +212,6 @@ WifiMgrOnScanFinished (
     }\r
   }\r
 \r
-  FreePool (Result);\r
   gBS->SignalEvent (Nic->Private->NetworkListRefreshEvent);\r
 \r
   //\r