From 8a641d2b73295d64438012972aac83838de31671 Mon Sep 17 00:00:00 2001 From: Ruiyu Ni Date: Thu, 1 Feb 2018 18:14:24 +0800 Subject: [PATCH] MdeModulePkg/SmmCore: Fix hang due to already-freed memory deference SmiHandlerUnRegister() validates the DispatchHandle by checking whether the first 32bit matches to a certain signature (SMI_HANDLER_SIGNATURE). But if a caller calls *UnRegister() twice and the memory freed by first call still contains the signature, the second call may hang. The patch fixes this issue by locating the DispatchHandle in all SMI handlers, instead of checking the signature. Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Ruiyu Ni Cc: Jiewen Yao Reviewed-by: Star Zeng --- MdeModulePkg/Core/PiSmmCore/Smi.c | 37 ++++++++++++++++++++++++++----- 1 file changed, 32 insertions(+), 5 deletions(-) diff --git a/MdeModulePkg/Core/PiSmmCore/Smi.c b/MdeModulePkg/Core/PiSmmCore/Smi.c index ad483a1877..0c09e7fa10 100644 --- a/MdeModulePkg/Core/PiSmmCore/Smi.c +++ b/MdeModulePkg/Core/PiSmmCore/Smi.c @@ -1,7 +1,7 @@ /** @file SMI management. - Copyright (c) 2009 - 2017, Intel Corporation. All rights reserved.
+ Copyright (c) 2009 - 2018, Intel Corporation. All rights reserved.
This program and the accompanying materials are licensed and made available under the terms and conditions of the BSD License which accompanies this distribution. The full text of the license may be found at @@ -276,14 +276,41 @@ SmiHandlerUnRegister ( { SMI_HANDLER *SmiHandler; SMI_ENTRY *SmiEntry; + LIST_ENTRY *EntryLink; + LIST_ENTRY *HandlerLink; - SmiHandler = (SMI_HANDLER *) DispatchHandle; - - if (SmiHandler == NULL) { + if (DispatchHandle == NULL) { return EFI_INVALID_PARAMETER; } - if (SmiHandler->Signature != SMI_HANDLER_SIGNATURE) { + // + // Look for it in root SMI handlers + // + SmiHandler = NULL; + for ( HandlerLink = GetFirstNode (&mRootSmiEntry.SmiHandlers) + ; !IsNull (&mRootSmiEntry.SmiHandlers, HandlerLink) && (SmiHandler != DispatchHandle) + ; HandlerLink = GetNextNode (&mRootSmiEntry.SmiHandlers, HandlerLink) + ) { + SmiHandler = CR (HandlerLink, SMI_HANDLER, Link, SMI_HANDLER_SIGNATURE); + } + + // + // Look for it in non-root SMI handlers + // + for ( EntryLink = GetFirstNode (&mSmiEntryList) + ; !IsNull (&mSmiEntryList, EntryLink) && (SmiHandler != DispatchHandle) + ; EntryLink = GetNextNode (&mSmiEntryList, EntryLink) + ) { + SmiEntry = CR (EntryLink, SMI_ENTRY, AllEntries, SMI_ENTRY_SIGNATURE); + for ( HandlerLink = GetFirstNode (&SmiEntry->SmiHandlers) + ; !IsNull (&SmiEntry->SmiHandlers, HandlerLink) && (SmiHandler != DispatchHandle) + ; HandlerLink = GetNextNode (&SmiEntry->SmiHandlers, HandlerLink) + ) { + SmiHandler = CR (HandlerLink, SMI_HANDLER, Link, SMI_HANDLER_SIGNATURE); + } + } + + if (SmiHandler != DispatchHandle) { return EFI_INVALID_PARAMETER; }