From 6340f2b8587e85fd094261065831546c84b27926 Mon Sep 17 00:00:00 2001 From: Gary Lin Date: Fri, 20 May 2016 11:18:16 +0800 Subject: [PATCH] NetworkPkg/HttpDxe: Don't free Wrap in HttpTcpReceiveNotifyDpc The HTTP Token Wrap is created in EfiHttpResponse() and then passed to the deferred Receive event callback, HttpTcpReceiveNotifyDpc. HttpTcpReceiveHeader and HttpTcpReceiveBody use a Tcp polling loop to monitor the socket status and trigger the Receive event when a new packet arrives. The Receive event brings up HttpTcpReceiveNotifyDpc to process the HTTP message and the function will set Wrap->TcpWrap.IsRxDone to TRUE to break the Tcp polling loop. However, HttpTcpReceiveNotifyDpc mistakenly freed Wrap, so the Tcp polling loop was actually checking a dead variable, and this led the system into an unstable status. Given the fact that the HTTP Token Wrap will be freed in EfiHttpResponse or HttpResponseWorker, this commit removes every "FreePool (Wrap)" in HttpTcpReceiveNotifyDpc. v2: * Free Wrap after HttpTcpReceiveBody returns normally. Cc: "Wu, Jiaxin" Cc: "Siyuan Fu" Cc: "El-Haj-Mahmoud, Samer" Cc: "Laszlo Ersek" Cc: "Hegde, Nagaraj P" Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Gary Lin Reviewed-by: Samer El-Haj-Mahmoud Reviewed-by: Jiaxin Wu Reviewed-by: Siyuan Fu --- NetworkPkg/HttpDxe/HttpImpl.c | 1 + NetworkPkg/HttpDxe/HttpProto.c | 4 ---- 2 files changed, 1 insertion(+), 4 deletions(-) diff --git a/NetworkPkg/HttpDxe/HttpImpl.c b/NetworkPkg/HttpDxe/HttpImpl.c index dd10f826b4..f4ae28aec9 100644 --- a/NetworkPkg/HttpDxe/HttpImpl.c +++ b/NetworkPkg/HttpDxe/HttpImpl.c @@ -1237,6 +1237,7 @@ HttpResponseWorker ( goto Error; } + FreePool (Wrap); return Status; Exit: diff --git a/NetworkPkg/HttpDxe/HttpProto.c b/NetworkPkg/HttpDxe/HttpProto.c index f3992edfdc..afa7fe4b35 100644 --- a/NetworkPkg/HttpDxe/HttpProto.c +++ b/NetworkPkg/HttpDxe/HttpProto.c @@ -152,7 +152,6 @@ HttpTcpReceiveNotifyDpc ( if (EFI_ERROR (Wrap->TcpWrap.Rx6Token.CompletionToken.Status)) { Wrap->HttpToken->Status = Wrap->TcpWrap.Rx6Token.CompletionToken.Status; gBS->SignalEvent (Wrap->HttpToken->Event); - FreePool (Wrap); return ; } @@ -162,7 +161,6 @@ HttpTcpReceiveNotifyDpc ( if (EFI_ERROR (Wrap->TcpWrap.Rx4Token.CompletionToken.Status)) { Wrap->HttpToken->Status = Wrap->TcpWrap.Rx4Token.CompletionToken.Status; gBS->SignalEvent (Wrap->HttpToken->Event); - FreePool (Wrap); return ; } } @@ -234,8 +232,6 @@ HttpTcpReceiveNotifyDpc ( // Check pending RxTokens and receive the HTTP message. // NetMapIterate (&Wrap->HttpInstance->RxTokens, HttpTcpReceive, NULL); - - FreePool (Wrap); } /** -- 2.39.2