From 6eceae607639b46ea46ba26a288270bd1c97dc0f Mon Sep 17 00:00:00 2001 From: Jon Maloy Date: Thu, 13 Jun 2024 18:35:46 -0400 Subject: [PATCH 31/31] NetworkPkg TcpDxe: Fixed system stuck on PXE boot flow in iPXE environment MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit RH-Author: Jon Maloy RH-MergeRequest: 77: UINT32 overflow in S3 ResumeCount and Pixiefail fixes RH-Jira: RHEL-21854 RHEL-21856 RHEL-40099 RH-Acked-by: Gerd Hoffmann RH-Commit: [31/31] 2088a79fef3d6dfec032f2f560ccf87ae42d786f JIRA: https://issues.redhat.com/browse/RHEL-21854 Upstream: Merged CVE: CVE-2023-45236 commit ced13b93afea87a8a1fe6ddbb67240a84cb2e3d3 Author: Sam Date: Wed May 29 07:46:03 2024 +0800 NetworkPkg TcpDxe: Fixed system stuck on PXE boot flow in iPXE environment This bug fix is based on the following commit "NetworkPkg TcpDxe: SECURITY PATCH" REF: 1904a64 Issue Description: An "Invalid handle" error was detected during runtime when attempting to destroy a child instance of the hashing protocol. The problematic code segment was: NetworkPkg\TcpDxe\TcpDriver.c Status = Hash2ServiceBinding->DestroyChild(Hash2ServiceBinding, ​&mHash2ServiceHandle); Root Cause Analysis: The root cause of the error was the passing of an incorrect parameter type, a pointer to an EFI_HANDLE instead of an EFI_HANDLE itself, to the DestroyChild function. This mismatch resulted in the function receiving an invalid handle. Implemented Solution: To resolve this issue, the function call was corrected to pass mHash2ServiceHandle directly: NetworkPkg\TcpDxe\TcpDriver.c Status = Hash2ServiceBinding->DestroyChild(Hash2ServiceBinding, mHash2ServiceHandle); This modification ensures the correct handle type is used, effectively rectifying the "Invalid handle" error. Verification: Testing has been conducted, confirming the efficacy of the fix. Additionally, the BIOS can boot into the OS in an iPXE environment. Cc: Doug Flick [MSFT] Signed-off-by: Sam Tsai [Wiwynn] Reviewed-by: Saloni Kasbekar Signed-off-by: Jon Maloy --- NetworkPkg/TcpDxe/TcpDriver.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/NetworkPkg/TcpDxe/TcpDriver.c b/NetworkPkg/TcpDxe/TcpDriver.c index 34ae838ae0..1aec292501 100644 --- a/NetworkPkg/TcpDxe/TcpDriver.c +++ b/NetworkPkg/TcpDxe/TcpDriver.c @@ -509,7 +509,7 @@ TcpDestroyService ( // // Destroy the instance of the hashing protocol for this controller. // - Status = Hash2ServiceBinding->DestroyChild (Hash2ServiceBinding, &mHash2ServiceHandle); + Status = Hash2ServiceBinding->DestroyChild (Hash2ServiceBinding, mHash2ServiceHandle); if (EFI_ERROR (Status)) { return EFI_UNSUPPORTED; } -- 2.39.3