[patch] firmware: qemu_fw_cfg.c: potential unintialized variable

[patch] firmware: qemu_fw_cfg.c: potential unintialized variable

[Dan Carpenter]

It acpi_acquire_global_lock() return AE_NOT_CONFIGURED then "glk" isn't
initialized, which, if you got very unlucky, could cause a bug.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

diff --git a/drivers/firmware/qemu_fw_cfg.c b/drivers/firmware/qemu_fw_cfg.c
index d999fe3..0e20116 100644
--- a/drivers/firmware/qemu_fw_cfg.c
+++ b/drivers/firmware/qemu_fw_cfg.c
@@ -77,7 +77,7 @@ static inline u16 fw_cfg_sel_endianness(u16 key)
 static inline void fw_cfg_read_blob(u16 key,
 				    void *buf, loff_t pos, size_t count)
 {
-	u32 glk;
+	u32 glk = -1U;
 	acpi_status status;
 
 	/* If we have ACPI, ensure mutual exclusion against any potential

Re: [patch] firmware: qemu_fw_cfg.c: potential unintialized variable

[Gabriel L. Somlo]

On Thu, Apr 14, 2016 at 12:33:37PM +0300, Dan Carpenter wrote:
> It acpi_acquire_global_lock() return AE_NOT_CONFIGURED then "glk" isn't
  ^                               ^
  If                            returns

> initialized, which, if you got very unlucky, could cause a bug.


In principle I'm OK with being cautious and initializing local
variables just in case, but I'm curious:

acpi_acquire_global_lock() (and its friend, acpi_release_global_lock())
are both wrapped inside the same macro -- ACPI_HW_DEPENDENT_RETURN_STATUS
-- which either makes them both do something useful, or makes them both
no-ops returning a hardcoded AE_NOT_CONFIGURED.

So what else do you think could be a way to get very unlucky ?

Otherwise, sure: Just 'cause we're paranoid doesn't mean someone's not
out to get us! :)

Thanks,
--Gabriel

> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> 
> diff --git a/drivers/firmware/qemu_fw_cfg.c b/drivers/firmware/qemu_fw_cfg.c
> index d999fe3..0e20116 100644
> --- a/drivers/firmware/qemu_fw_cfg.c
> +++ b/drivers/firmware/qemu_fw_cfg.c
> @@ -77,7 +77,7 @@ static inline u16 fw_cfg_sel_endianness(u16 key)
>  static inline void fw_cfg_read_blob(u16 key,
>  				    void *buf, loff_t pos, size_t count)
>  {
> -	u32 glk;
> +	u32 glk = -1U;
>  	acpi_status status;
>  
>  	/* If we have ACPI, ensure mutual exclusion against any potential

Re: [patch] firmware: qemu_fw_cfg.c: potential unintialized variable

[Dan Carpenter]

On Thu, Apr 14, 2016 at 02:40:06PM -0400, Gabriel L. Somlo wrote:
> On Thu, Apr 14, 2016 at 12:33:37PM +0300, Dan Carpenter wrote:
> > It acpi_acquire_global_lock() return AE_NOT_CONFIGURED then "glk" isn't
>   ^                               ^
>   If                            returns
> 
> > initialized, which, if you got very unlucky, could cause a bug.
> 
> 
> In principle I'm OK with being cautious and initializing local
> variables just in case, but I'm curious:
> 
> acpi_acquire_global_lock() (and its friend, acpi_release_global_lock())
> are both wrapped inside the same macro -- ACPI_HW_DEPENDENT_RETURN_STATUS
> -- which either makes them both do something useful, or makes them both
> no-ops returning a hardcoded AE_NOT_CONFIGURED.
> 
> So what else do you think could be a way to get very unlucky ?

If "glk" happened to to equal acpi_gbl_global_lock_handle by chance
then we would release it without acquiring it first.  Actually I could
initialize it to zero and that would be better, no?

regards,
dan carpenter

Re: [patch] firmware: qemu_fw_cfg.c: potential unintialized variable

[Gabriel L. Somlo]

On Thu, Apr 14, 2016 at 10:12:53PM +0300, Dan Carpenter wrote:
> On Thu, Apr 14, 2016 at 02:40:06PM -0400, Gabriel L. Somlo wrote:
> > On Thu, Apr 14, 2016 at 12:33:37PM +0300, Dan Carpenter wrote:
> > > It acpi_acquire_global_lock() return AE_NOT_CONFIGURED then "glk" isn't
> >   ^                               ^
> >   If                            returns
> > 
> > > initialized, which, if you got very unlucky, could cause a bug.
> > 
> > 
> > In principle I'm OK with being cautious and initializing local
> > variables just in case, but I'm curious:
> > 
> > acpi_acquire_global_lock() (and its friend, acpi_release_global_lock())
> > are both wrapped inside the same macro -- ACPI_HW_DEPENDENT_RETURN_STATUS
> > -- which either makes them both do something useful, or makes them both
> > no-ops returning a hardcoded AE_NOT_CONFIGURED.
> > 
> > So what else do you think could be a way to get very unlucky ?
> 
> If "glk" happened to to equal acpi_gbl_global_lock_handle by chance
> then we would release it without acquiring it first.  Actually I could
> initialize it to zero and that would be better, no?

No, because acpi_release_global_lock() would also be a hard-coded
"return AE_NOT_CONFIGURED" by the same macro which also hard-coded
acpi_acquire_global_lock() to be "return AE_NOT_CONFIGURED" in the
first place. See include/acpi/acpixf.h, search for the two occurrences
of

	"#define ACPI_HW_DEPENDENT_RETURN_STATUS"

and then for:

	"global_lock"

further down in the file.

Whether both (or neither) of lock/unlock are for real or just
hardcoded to return AE_NOT_CONFIGURED depends on ACPI_REDUCED_HARDWARE,
which I assume is also set when there's *no* ACPI hardware at all.

But I don't believe it's possible for "unlock" to do anything at all
if "lock" was hardcoded to simply return AE_NOT_CONFIGURED.

Then again, it's possible I'm still missing something :)

Thanks,
--Gabe

Re: [patch] firmware: qemu_fw_cfg.c: potential unintialized variable

[Dan Carpenter]

Ah...  I see now.  You're right.  Thanks for the explanation.

On my config those functions are no-ops so the variable isn't
initialized.  If they were enabled then *probably* it wouldn't generate
a warning.

Probably just silencing the warning is the way to go though...  I bet
GCC optimizes it away.  Let me think about this some more...

regards,
dan carpenter

Re: [patch] firmware: qemu_fw_cfg.c: potential unintialized variable

[Gabriel L. Somlo]

On Thu, Apr 14, 2016 at 12:33:37PM +0300, Dan Carpenter wrote:
> It acpi_acquire_global_lock() return AE_NOT_CONFIGURED then "glk" isn't
> initialized, which, if you got very unlucky, could cause a bug.
> 
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> 
> diff --git a/drivers/firmware/qemu_fw_cfg.c b/drivers/firmware/qemu_fw_cfg.c
> index d999fe3..0e20116 100644
> --- a/drivers/firmware/qemu_fw_cfg.c
> +++ b/drivers/firmware/qemu_fw_cfg.c
> @@ -77,7 +77,7 @@ static inline u16 fw_cfg_sel_endianness(u16 key)
>  static inline void fw_cfg_read_blob(u16 key,
>  				    void *buf, loff_t pos, size_t count)
>  {
> -	u32 glk;
> +	u32 glk = -1U;

After digging through the acpi_[acquire|release]_global_lock() code in
drivers/acpi/acpica/evxface.c, the -1 value actually makes sense, as
glk is set to the value of acpi_gbl_global_lock_handle, which
internally is a 16-bit value which can wrap around, but will never be
equal to 32-bit "-1". As such, the unlock function would fail with
AE_NOT_ACQUIRED if its "for-real" version ever ended up being called.

So, with the typos in the commit blurb fixed (s/It/If/ and
s/return/returns/), and on general "belt-and-suspenders" principle,

Reviewed-by: Gabriel Somlo <somlo@cmu.edu>

I just wanted to make sure my understanding of "this can't happen with
the way the ACPI macros are currently defined" is still correct :)

Thanks,
--Gabe

>  	acpi_status status;
>  
>  	/* If we have ACPI, ensure mutual exclusion against any potential