diff --git a/FatPkg/EnhancedFatDxe/Misc.c b/FatPkg/EnhancedFatDxe/Misc.c index c035670bf78f..af66b1d0e317 100644 --- a/FatPkg/EnhancedFatDxe/Misc.c +++ b/FatPkg/EnhancedFatDxe/Misc.c @@ -132,6 +132,7 @@ FatQueueTask ( { EFI_STATUS Status; LIST_ENTRY *Link; + LIST_ENTRY *NextLink; FAT_SUBTASK *Subtask; // @@ -149,9 +150,17 @@ FatQueueTask ( EfiReleaseLock (&FatTaskLock); Status = EFI_SUCCESS; - for ( Link = GetFirstNode (&Task->Subtasks) - ; !IsNull (&Task->Subtasks, Link) - ; Link = GetNextNode (&Task->Subtasks, Link) + // + // Use NextLink to store the next link of the list, because Link might be remove from the + // doubly-linked list and get freed in the end of current loop. + // + // Also, list operation APIs like IsNull() and GetNextNode() are avoided during the loop, since + // they may check the validity of doubly-linked lists by traversing them. These APIs cannot + // handle list elements being removed during the traverse. + // + for ( Link = GetFirstNode (&Task->Subtasks), NextLink = GetNextNode (&Task->Subtasks, Link) + ; Link != &Task->Subtasks + ; Link = NextLink, NextLink = Link->ForwardLink ) { Subtask = CR (Link, FAT_SUBTASK, Link, FAT_SUBTASK_SIGNATURE); if (Subtask->Write) {