diff options
| author | Maciej Rabeda <maciej.rabeda@linux.intel.com> | 2020-02-27 11:30:43 +0100 |
|---|---|---|
| committer | mergify[bot] <37929162+mergify[bot]@users.noreply.github.com> | 2020-04-01 10:53:03 +0000 |
| commit | 65c73df44c61235ede84c5aa1d2eab6650844966 (patch) | |
| tree | d910483fd3b2448543974bfa1b75eed40c6915df /ShellPkg | |
| parent | dd7523b5b123de6f0730f2f2abb207f2a5c1ccd4 (diff) | |
| download | edk2-65c73df44c61235ede84c5aa1d2eab6650844966.tar.gz edk2-65c73df44c61235ede84c5aa1d2eab6650844966.tar.bz2 edk2-65c73df44c61235ede84c5aa1d2eab6650844966.zip | |
ShellPkg: Fix 'ping' command Ip4 receive flow.
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2032
'ping' command's receive flow utilizes a single Rx token which it
attempts to reuse before recycling the previously received packet.
This causes a situation where under ICMP traffic,
Ping6OnEchoReplyReceived() function will receive an already
recycled packet with EFI_SUCCESS token status and finally
dereference invalid pointers from RxData structure.
Cc: Ray Ni <ray.ni@intel.com>
Cc: Zhichao Gao <zhichao.gao@intel.com>
Signed-off-by: Maciej Rabeda <maciej.rabeda@linux.intel.com>
Reviewed-by: Siyuan Fu <siyuan.fu@intel.com>
Acked-by: Zhichao Gao <zhichao.gao@intel.com>
Diffstat (limited to 'ShellPkg')
| -rw-r--r-- | ShellPkg/Library/UefiShellNetwork1CommandsLib/Ping.c | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/ShellPkg/Library/UefiShellNetwork1CommandsLib/Ping.c b/ShellPkg/Library/UefiShellNetwork1CommandsLib/Ping.c index 23567fa2c1..a3fa325151 100644 --- a/ShellPkg/Library/UefiShellNetwork1CommandsLib/Ping.c +++ b/ShellPkg/Library/UefiShellNetwork1CommandsLib/Ping.c @@ -614,6 +614,11 @@ Ping6OnEchoReplyReceived ( ON_EXIT:
+ //
+ // Recycle the packet before reusing RxToken
+ //
+ gBS->SignalEvent (Private->IpChoice == PING_IP_CHOICE_IP6?((EFI_IP6_RECEIVE_DATA*)Private->RxToken.Packet.RxData)->RecycleSignal:((EFI_IP4_RECEIVE_DATA*)Private->RxToken.Packet.RxData)->RecycleSignal);
+
if (Private->RxCount < Private->SendNum) {
//
// Continue to receive icmp echo reply packets.
@@ -632,10 +637,6 @@ ON_EXIT: //
Private->Status = EFI_SUCCESS;
}
- //
- // Singal to recycle the each rxdata here, not at the end of process.
- //
- gBS->SignalEvent (Private->IpChoice == PING_IP_CHOICE_IP6?((EFI_IP6_RECEIVE_DATA*)Private->RxToken.Packet.RxData)->RecycleSignal:((EFI_IP4_RECEIVE_DATA*)Private->RxToken.Packet.RxData)->RecycleSignal);
}
/**
|