Skip to content

[2511] NetworkPkg: Ip4Dxe/Ip6Dxe: Set SB notify to NULL after event close#1662

Merged
makubacki merged 1 commit intomicrosoft:release/202511from
makubacki:networkpkg_ip4dxe_prevent_dhcp_sb_notify_double_close_2511
Feb 27, 2026
Merged

[2511] NetworkPkg: Ip4Dxe/Ip6Dxe: Set SB notify to NULL after event close#1662
makubacki merged 1 commit intomicrosoft:release/202511from
makubacki:networkpkg_ip4dxe_prevent_dhcp_sb_notify_double_close_2511

Conversation

@makubacki
Copy link
Member

Description

Ip4StartAutoConfig() and Ip6ConfigStartStatefulAutoConfig() close the DHCP service binding notify event when the service child is successfully created, but do not NULL the instance field afterward.

On re-entry, the stale handle passes the non-NULL condition and is closed a second time, which results in a page fault with memory protections enabled.

This change sets the event field to NULL immediately after CloseEvent() so that subsequent calls skip attempting to close the event again.

Code design issue in original implementation. Not a regression.

  • Impacts functionality?
  • Impacts security?
  • Breaking change?
  • Includes tests?
  • Includes documentation?

How This Was Tested

PXE boot with a specific Kensington USB HUB and memory protections enabled.

Repro snippets from debug log:

[CoreCreateEventInternal]: EVENT CREATED. D6A2CB7F-6A18-4E2F-B43B-9920A733700A
...
[Ip4StartAutoConfig]: EVENT CLOSED. 9FB1A1F3-3B71-4324-B39A-745CBB015FFF
[CoreCloseEvent]: EVENT CLOSED. D6A2CB7F-6A18-4E2F-B43B-9920A733700A
...
[Ip4StartAutoConfig]: EVENT CLOSED. 9FB1A1F3-3B71-4324-B39A-745CBB015FFF
[CoreCloseEvent]: EVENT CLOSED. D6A2CB7F-6A18-4E2F-B43B-9920A733700A

Integration Instructions

N/A

Ip4StartAutoConfig() and Ip6ConfigStartStatefulAutoConfig() close
the DHCP service binding notify event when the service child is
successfully created, but do not NULL the instance field afterward.

On re-entry, the stale handle passes the non-NULL condition and is
closed a second time, which results in a page fault with memory
protections enabled.

This change sets the event field to NULL immediately after
CloseEvent() so that subsequent calls skip attempting to clsoe the
event again.

Co-authored-by: Wenbo Hou <wenbhou@microsoft.com>
Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>
@makubacki makubacki requested review from apop5, kuqin12 and os-d February 27, 2026 18:18
@makubacki makubacki self-assigned this Feb 27, 2026
@makubacki makubacki added the type:bug Something isn't working label Feb 27, 2026
@apop5
Copy link
Collaborator

apop5 commented Feb 27, 2026

Its good that you are finding and fixing these.

How are the interfaces being exercised? Was it a shell test app or something else that is verifying everything? Asking because something that could exercise all the network interfaces would be useful for testing.

@makubacki
Copy link
Member Author

Its good that you are finding and fixing these.

How are the interfaces being exercised? Was it a shell test app or something else that is verifying everything? Asking because something that could exercise all the network interfaces would be useful for testing.

Unfortunately, it is through manual testing of different scenarios on different hardware. Given the emerging trend of these issues in NetworkPkg, some automated testing likely would find more.

@codecov-commenter
Copy link

Codecov Report

❌ Patch coverage is 0% with 2 lines in your changes missing coverage. Please review.
⚠️ Please upload report for BASE (release/202511@a460671). Learn more about missing BASE report.

Files with missing lines Patch % Lines
NetworkPkg/Ip4Dxe/Ip4Config2Impl.c 0.00% 1 Missing ⚠️
NetworkPkg/Ip6Dxe/Ip6ConfigImpl.c 0.00% 1 Missing ⚠️
Additional details and impacted files
@@               Coverage Diff                @@
##             release/202511   #1662   +/-   ##
================================================
  Coverage                  ?   0.55%           
================================================
  Files                     ?     165           
  Lines                     ?   72366           
  Branches                  ?    1789           
================================================
  Hits                      ?     402           
  Misses                    ?   71957           
  Partials                  ?       7           
Flag Coverage Δ
NetworkPkg 0.55% <0.00%> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@makubacki makubacki merged commit f4942fb into microsoft:release/202511 Feb 27, 2026
51 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

type:bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants