firmware: qemu_fw_cfg.c: potential unintialized variable
Subsystems (2)
PATCH 1/1 firmware: qemu_fw_cfg.c: potential unintialized variable
It acpi_acquire_global_lock() return AE_NOT_CONFIGURED then "glk" isn't initialized, which, if you got very unlucky, could cause a bug.
drivers/firmware/qemu_fw_cfg.c +1 -1
@@ -77,7 +77,7 @@ static inline u16 fw_cfg_sel_endianness(u16 key)static inline void fw_cfg_read_blob (u16 key,void *buf,loff_t pos,size_t count) { -u32 glk; +u32 glk =-1U ;acpi_status status;/* If we have ACPI, ensure mutual exclusion against any potential
Quoted 1 line · Dan Carpenter
It
acpi_acquire_global_lock()returnAE_NOT_CONFIGUREDthen "glk" isn't
^ ^
If returns
Quoted 1 line
initialized, which, if you got very unlucky, could cause a bug.
In principle I'm OK with being cautious and initializing local variables just in case, but I'm curious:
acpi_acquire_global_lock() (and its friend, acpi_release_global_lock()) are both wrapped inside the same macro -- ACPI_HW_DEPENDENT_RETURN_STATUS -- which either makes them both do something useful, or makes them both no-ops returning a hardcoded AE_NOT_CONFIGURED.
So what else do you think could be a way to get very unlucky ?
Otherwise, sure: Just 'cause we're paranoid doesn't mean someone's not out to get us! :)
Thanks,
--Gabriel
Quoted 15 lines
Signed-off-by Dan Carpenter <[email protected]>drivers/firmware/qemu_fw_cfg.c +1
-1@@ -77,7 +77,7 @@ static inline u16 fw_cfg_sel_endianness(u16 key)static inline void fw_cfg_read_blob (u16 key,void *buf,loff_t pos,size_t count) { -u32 glk; +u32 glk =-1U ;acpi_status status;/* If we have ACPI, ensure mutual exclusion against any potential
Quoted 11 lines · Gabriel L. Somlo
Quoted 1 line · Dan Carpenter
It
acpi_acquire_global_lock()returnAE_NOT_CONFIGUREDthen "glk" isn't^ ^
If returnsQuoted 1 line
initialized, which, if you got very unlucky, could cause a bug.
In principle I'm OK with being cautious and initializing local variables just in case, but I'm curious:
Quoted 6 lines
acpi_acquire_global_lock()(and its friend,acpi_release_global_lock()) are both wrapped inside the same macro --ACPI_HW_DEPENDENT_RETURN_STATUS-- which either makes them both do something useful, or makes them both no-ops returning a hardcodedAE_NOT_CONFIGURED.So what else do you think could be a way to get very unlucky ?
If "glk" happened to to equal acpi_gbl_global_lock_handle by chance then we would release it without acquiring it first. Actually I could initialize it to zero and that would be better, no?
regards,
dan carpenter
Quoted 17 lines · Dan Carpenter
Quoted 16 lines · Gabriel L. Somlo
Quoted 1 line · Dan Carpenter
It
acpi_acquire_global_lock()returnAE_NOT_CONFIGUREDthen "glk" isn't^ ^
If returnsQuoted 1 line
initialized, which, if you got very unlucky, could cause a bug.
In principle I'm OK with being cautious and initializing local variables just in case, but I'm curious:
acpi_acquire_global_lock()(and its friend,acpi_release_global_lock()) are both wrapped inside the same macro --ACPI_HW_DEPENDENT_RETURN_STATUS-- which either makes them both do something useful, or makes them both no-ops returning a hardcodedAE_NOT_CONFIGURED.
Quoted 5 lines
Quoted 1 line
So what else do you think could be a way to get very unlucky ?
If "glk" happened to to equal
acpi_gbl_global_lock_handleby chance then we would release it without acquiring it first. Actually I could initialize it to zero and that would be better, no?
No, because acpi_release_global_lock() would also be a hard-coded "return AE_NOT_CONFIGURED" by the same macro which also hard-coded acpi_acquire_global_lock() to be "return AE_NOT_CONFIGURED" in the first place. See include/acpi/acpixf.h, search for the two occurrences of
"#define ACPI_HW_DEPENDENT_RETURN_STATUS"
and then for:
"global_lock"
further down in the file.
Whether both (or neither) of lock/unlock are for real or just hardcoded to return AE_NOT_CONFIGURED depends on ACPI_REDUCED_HARDWARE, which I assume is also set when there's *no* ACPI hardware at all.
But I don't believe it's possible for "unlock" to do anything at all if "lock" was hardcoded to simply return AE_NOT_CONFIGURED.
Then again, it's possible I'm still missing something :)
Thanks,
--Gabe
Ah... I see now. You're right. Thanks for the explanation.
On my config those functions are no-ops so the variable isn't initialized. If they were enabled then *probably* it wouldn't generate a warning.
Probably just silencing the warning is the way to go though... I bet GCC optimizes it away. Let me think about this some more...
regards,
dan carpenter
Quoted 10 lines · Dan Carpenter
It
acpi_acquire_global_lock()returnAE_NOT_CONFIGUREDthen "glk" isn't initialized, which, if you got very unlucky, could cause a bug.Signed-off-by Dan Carpenter <[email protected]>drivers/firmware/qemu_fw_cfg.c +0
-0
drivers/firmware/qemu_fw_cfg.c static inline u16 fw_cfg_sel_endianness(u16 key) · line 80
Quoted 5 lines
drivers/firmware/qemu_fw_cfg.c +1
-1@@ -77,7 +77,7 @@ static inline u16 fw_cfg_sel_endianness(u16 key)static inline void fw_cfg_read_blob (u16 key,void *buf,loff_t pos,size_t count) { -u32 glk; +u32 glk =-1U ;
After digging through the acpi_[acquire|release]_global_lock() code in drivers/acpi/acpica/evxface.c, the -1 value actually makes sense, as glk is set to the value of acpi_gbl_global_lock_handle, which internally is a 16-bit value which can wrap around, but will never be equal to 32-bit "-1". As such, the unlock function would fail with AE_NOT_ACQUIRED if its "for-real" version ever ended up being called.
So, with the typos in the commit blurb fixed (s/It/If/ and s/return/returns/), and on general "belt-and-suspenders" principle,
I just wanted to make sure my understanding of "this can't happen with the way the ACPI macros are currently defined" is still correct :)
Thanks,
--Gabe
Quoted 3 lines
drivers/firmware/qemu_fw_cfg.c +0
-0acpi_status status;/* If we have ACPI, ensure mutual exclusion against any potential