Reporting Issues
Bug 3315 - DxeCore: Unloading image pre-CpuDxe may dereference NULL
Summary: DxeCore: Unloading image pre-CpuDxe may dereference NULL
Status: RESOLVED INVALID
Alias: None
Product: EDK2
Classification: Unclassified
Component: Code (show other bugs)
Version: Current
Hardware: All All
: Normal normal
Assignee: Marvin Häuser
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2021-04-12 09:11 UTC by Marvin Häuser
Modified: 2021-06-23 08:11 UTC (History)
5 users (show)

See Also:
EDK II Code First industry standard specifications: ---
Branch URL:
Release(s) the issue is observed: EDK II Master
The OS the target platform is running: ---
Package: MdeModulePkg
Release(s) the issues must be fixed: EDK II Master
Tianocore documents:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Marvin Häuser 2021-04-12 09:11:25 UTC 
CoreUnloadAndCloseImage() unconditionally calls UnprotectUefiImage()[1], which unconditionally calls SetUefiImageMemoryAttributes()[2], which has a precondition that CpuDxe has loaded[3]. When an image is loaded and unloaded before CpuDxe is ready (e.g. returns an error code from the entry point), this may cause a NULL dereference.

[1] https://github.com/tianocore/edk2/blob/2072c22a0d63c780b0cc6377f6d4ffb116ad6144/MdeModulePkg/Core/Dxe/Image/Image.c#L936

[2] https://github.com/tianocore/edk2/blob/2072c22a0d63c780b0cc6377f6d4ffb116ad6144/MdeModulePkg/Core/Dxe/Misc/MemoryProtection.c#L613

[3] https://github.com/tianocore/edk2/blob/2072c22a0d63c780b0cc6377f6d4ffb116ad6144/MdeModulePkg/Core/Dxe/Misc/MemoryProtection.c#L225
Comment 1 gaoliming 2021-04-13 21:57:53 UTC 
Marvin, you can continue to provide the proposal.
Comment 2 Marvin Häuser 2021-06-12 09:30:10 UTC 
Sorry, I must have accidentally run into the issue on an old version of EDK II or something, it is not reproducible on the latest master, and my explanation was actually flawed because image protection aborts early pre-CpuDxe [1].

I'm very sorry for the confusion.

[1] https://github.com/tianocore/edk2/blob/2072c22a0d63c780b0cc6377f6d4ffb116ad6144/MdeModulePkg/Core/Dxe/Misc/MemoryProtection.c#L405-L407
Comment 3 Laszlo Ersek 2021-06-23 08:11:07 UTC 
Closing as INVALID per comment 2; please revert if I'm mistaken. Thank you.