There are two place to close the ISCSI ExitBootServiceEvent: One is IScsiOnExitBootService callback function. Another is ISCSI driver stop() function.
When OS loader triggers ExitBootServiceEvent, firstly, the exit boot service callback function will close and free the ExitBootServiceEvent, then secondly the system will call ISCSI driver stop() function, the ExitBootServiceEvent will be closed and freed again, the use-after-free memory access happens. This issue is recorded at https://bugzilla.tianocore.org/show_bug.cgi?id=742. This patch is to resolve the issue. Cc: Ye Ting <ting...@intel.com> Cc: Fu Siyuan <siyuan...@intel.com> Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Wu Jiaxin <jiaxin...@intel.com> *** BLURB HERE *** Jiaxin Wu (2): MdeModulePkg/IScsiDxe: Set ExitBootServiceEvent to NULL after close it. NetworkPkg/IScsiDxe: Set ExitBootServiceEvent to NULL after close it. MdeModulePkg/Universal/Network/IScsiDxe/IScsiMisc.c | 12 ++++++++---- NetworkPkg/IScsiDxe/IScsiMisc.c | 12 ++++++++---- 2 files changed, 16 insertions(+), 8 deletions(-) -- 1.9.5.msysgit.1 _______________________________________________ edk2-devel mailing list edk2-devel@lists.01.org https://lists.01.org/mailman/listinfo/edk2-devel
