File ovmf-bsc980635-fix-http-crash.patch of Package ovmf

Overview Repositories Revisions Requests Users Attributes Meta

File ovmf-bsc980635-fix-http-crash.patch of Package ovmf (Revision 21ae2cf4987d2d120ee7ef22aee35ade)

Currently displaying revision 21ae2cf4987d2d120ee7ef22aee35ade , Show latest

From 72a4f34eab072132652565dd6bed24ec8d553aac Mon Sep 17 00:00:00 2001
From: Gary Lin <glin@suse.com>
Date: Thu, 19 May 2016 11:49:18 +0800
Subject: [PATCH 1/2] NetworkPkg/TcpDxe: Remove the status check of
 SockProcessRcvToken

SockProcessRcvToken only returns the number of the received bytes, not
an EFI Status.

Cc: "Siyuan Fu" <siyuan.fu@intel.com>
Cc: "Jiaxin Wu" <jiaxin.wu@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Gary Lin <glin@suse.com>
Reviewed-by: Samer El-Haj-Mahmoud <elhaj@hpe.com>
Reviewed-by: Jiaxin Wu <jiaxin.wu@intel.com>
Reviewed-by: Siyuan Fu <siyuan.fu@intel.com>
---
 NetworkPkg/TcpDxe/SockInterface.c | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/NetworkPkg/TcpDxe/SockInterface.c b/NetworkPkg/TcpDxe/SockInterface.c
index 4abda74..1f3524b 100644
--- a/NetworkPkg/TcpDxe/SockInterface.c
+++ b/NetworkPkg/TcpDxe/SockInterface.c
@@ -724,11 +724,7 @@ SockRcv (
   }
 
   if (RcvdBytes != 0) {
-    Status = SockProcessRcvToken (Sock, RcvToken);
-
-    if (EFI_ERROR (Status)) {
-      goto Exit;
-    }
+    SockProcessRcvToken (Sock, RcvToken);
 
     Status = Sock->ProtoHandler (Sock, SOCK_CONSUMED, NULL);
   } else {
-- 
2.8.2

From 6340f2b8587e85fd094261065831546c84b27926 Mon Sep 17 00:00:00 2001
From: Gary Lin <glin@suse.com>
Date: Fri, 20 May 2016 11:18:16 +0800
Subject: [PATCH 2/2] NetworkPkg/HttpDxe: Don't free Wrap in
 HttpTcpReceiveNotifyDpc

The HTTP Token Wrap is created in EfiHttpResponse() and then passed
to the deferred Receive event callback, HttpTcpReceiveNotifyDpc.
HttpTcpReceiveHeader and HttpTcpReceiveBody use a Tcp polling loop to
monitor the socket status and trigger the Receive event when a new
packet arrives. The Receive event brings up HttpTcpReceiveNotifyDpc
to process the HTTP message and the function will set Wrap->TcpWrap.IsRxDone
to TRUE to break the Tcp polling loop.

However, HttpTcpReceiveNotifyDpc mistakenly freed Wrap, so the Tcp
polling loop was actually checking a dead variable, and this led the
system into an unstable status.

Given the fact that the HTTP Token Wrap will be freed in EfiHttpResponse
or HttpResponseWorker, this commit removes every "FreePool (Wrap)" in
HttpTcpReceiveNotifyDpc.

v2:
* Free Wrap after HttpTcpReceiveBody returns normally.

Cc: "Wu, Jiaxin" <jiaxin.wu@intel.com>
Cc: "Siyuan Fu" <siyuan.fu@intel.com>
Cc: "El-Haj-Mahmoud, Samer" <samer.el-haj-mahmoud@hpe.com>
Cc: "Laszlo Ersek" <lersek@redhat.com>
Cc: "Hegde, Nagaraj P" <nagaraj-p.hegde@hpe.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Gary Lin <glin@suse.com>
Reviewed-by: Samer El-Haj-Mahmoud <elhaj@hpe.com>
Reviewed-by: Jiaxin Wu <jiaxin.wu@intel.com>
Reviewed-by: Siyuan Fu <siyuan.fu@intel.com>
---
 NetworkPkg/HttpDxe/HttpImpl.c  | 1 +
 NetworkPkg/HttpDxe/HttpProto.c | 4 ----
 2 files changed, 1 insertion(+), 4 deletions(-)

diff --git a/NetworkPkg/HttpDxe/HttpImpl.c b/NetworkPkg/HttpDxe/HttpImpl.c
index dd10f82..f4ae28a 100644
--- a/NetworkPkg/HttpDxe/HttpImpl.c
+++ b/NetworkPkg/HttpDxe/HttpImpl.c
@@ -1237,6 +1237,7 @@ HttpResponseWorker (
     goto Error;
   }
 
+  FreePool (Wrap);
   return Status;
 
 Exit:
diff --git a/NetworkPkg/HttpDxe/HttpProto.c b/NetworkPkg/HttpDxe/HttpProto.c
index f3992ed..afa7fe4 100644
--- a/NetworkPkg/HttpDxe/HttpProto.c
+++ b/NetworkPkg/HttpDxe/HttpProto.c
@@ -152,7 +152,6 @@ HttpTcpReceiveNotifyDpc (
     if (EFI_ERROR (Wrap->TcpWrap.Rx6Token.CompletionToken.Status)) {
       Wrap->HttpToken->Status = Wrap->TcpWrap.Rx6Token.CompletionToken.Status;
       gBS->SignalEvent (Wrap->HttpToken->Event);
-      FreePool (Wrap);
       return ;
     }
 
@@ -162,7 +161,6 @@ HttpTcpReceiveNotifyDpc (
     if (EFI_ERROR (Wrap->TcpWrap.Rx4Token.CompletionToken.Status)) {
       Wrap->HttpToken->Status = Wrap->TcpWrap.Rx4Token.CompletionToken.Status;
       gBS->SignalEvent (Wrap->HttpToken->Event);
-      FreePool (Wrap);
       return ;
     }
   }
@@ -234,8 +232,6 @@ HttpTcpReceiveNotifyDpc (
   // Check pending RxTokens and receive the HTTP message.
   //
   NetMapIterate (&Wrap->HttpInstance->RxTokens, HttpTcpReceive, NULL);
-  
-  FreePool (Wrap);
 }
 
 /**
-- 
2.8.2

Places

File ovmf-bsc980635-fix-http-crash.patch of Package ovmf (Revision 21ae2cf4987d2d120ee7ef22aee35ade)

Places