It acpi_acquire_global_lock() return AE_NOT_CONFIGURED then "glk" isn't
initialized, which, if you got very unlucky, could cause a bug.
Signed-off-by: Dan Carpenter <[email protected]>
diff --git a/drivers/firmware/qemu_fw_cfg.c b/drivers/firmware/qemu_fw_cfg.c
index d999fe3..0e20116 100644
--- a/drivers/firmware/qemu_fw_cfg.c
+++ b/drivers/firmware/qemu_fw_cfg.c
@@ -77,7 +77,7 @@ static inline u16 fw_cfg_sel_endianness(u16 key)
static inline void fw_cfg_read_blob(u16 key,
void *buf, loff_t pos, size_t count)
{
- u32 glk;
+ u32 glk = -1U;
acpi_status status;
/* If we have ACPI, ensure mutual exclusion against any potential
On Thu, Apr 14, 2016 at 12:33:37PM +0300, Dan Carpenter wrote:
> It acpi_acquire_global_lock() return AE_NOT_CONFIGURED then "glk" isn't
^ ^
If returns
> initialized, which, if you got very unlucky, could cause a bug.
In principle I'm OK with being cautious and initializing local
variables just in case, but I'm curious:
acpi_acquire_global_lock() (and its friend, acpi_release_global_lock())
are both wrapped inside the same macro -- ACPI_HW_DEPENDENT_RETURN_STATUS
-- which either makes them both do something useful, or makes them both
no-ops returning a hardcoded AE_NOT_CONFIGURED.
So what else do you think could be a way to get very unlucky ?
Otherwise, sure: Just 'cause we're paranoid doesn't mean someone's not
out to get us! :)
Thanks,
--Gabriel
> Signed-off-by: Dan Carpenter <[email protected]>
>
> diff --git a/drivers/firmware/qemu_fw_cfg.c b/drivers/firmware/qemu_fw_cfg.c
> index d999fe3..0e20116 100644
> --- a/drivers/firmware/qemu_fw_cfg.c
> +++ b/drivers/firmware/qemu_fw_cfg.c
> @@ -77,7 +77,7 @@ static inline u16 fw_cfg_sel_endianness(u16 key)
> static inline void fw_cfg_read_blob(u16 key,
> void *buf, loff_t pos, size_t count)
> {
> - u32 glk;
> + u32 glk = -1U;
> acpi_status status;
>
> /* If we have ACPI, ensure mutual exclusion against any potential
On Thu, Apr 14, 2016 at 02:40:06PM -0400, Gabriel L. Somlo wrote:
> On Thu, Apr 14, 2016 at 12:33:37PM +0300, Dan Carpenter wrote:
> > It acpi_acquire_global_lock() return AE_NOT_CONFIGURED then "glk" isn't
> ^ ^
> If returns
>
> > initialized, which, if you got very unlucky, could cause a bug.
>
>
> In principle I'm OK with being cautious and initializing local
> variables just in case, but I'm curious:
>
> acpi_acquire_global_lock() (and its friend, acpi_release_global_lock())
> are both wrapped inside the same macro -- ACPI_HW_DEPENDENT_RETURN_STATUS
> -- which either makes them both do something useful, or makes them both
> no-ops returning a hardcoded AE_NOT_CONFIGURED.
>
> So what else do you think could be a way to get very unlucky ?
If "glk" happened to to equal acpi_gbl_global_lock_handle by chance
then we would release it without acquiring it first. Actually I could
initialize it to zero and that would be better, no?
regards,
dan carpenter
On Thu, Apr 14, 2016 at 10:12:53PM +0300, Dan Carpenter wrote:
> On Thu, Apr 14, 2016 at 02:40:06PM -0400, Gabriel L. Somlo wrote:
> > On Thu, Apr 14, 2016 at 12:33:37PM +0300, Dan Carpenter wrote:
> > > It acpi_acquire_global_lock() return AE_NOT_CONFIGURED then "glk" isn't
> > ^ ^
> > If returns
> >
> > > initialized, which, if you got very unlucky, could cause a bug.
> >
> >
> > In principle I'm OK with being cautious and initializing local
> > variables just in case, but I'm curious:
> >
> > acpi_acquire_global_lock() (and its friend, acpi_release_global_lock())
> > are both wrapped inside the same macro -- ACPI_HW_DEPENDENT_RETURN_STATUS
> > -- which either makes them both do something useful, or makes them both
> > no-ops returning a hardcoded AE_NOT_CONFIGURED.
> >
> > So what else do you think could be a way to get very unlucky ?
>
> If "glk" happened to to equal acpi_gbl_global_lock_handle by chance
> then we would release it without acquiring it first. Actually I could
> initialize it to zero and that would be better, no?
No, because acpi_release_global_lock() would also be a hard-coded
"return AE_NOT_CONFIGURED" by the same macro which also hard-coded
acpi_acquire_global_lock() to be "return AE_NOT_CONFIGURED" in the
first place. See include/acpi/acpixf.h, search for the two occurrences
of
"#define ACPI_HW_DEPENDENT_RETURN_STATUS"
and then for:
"global_lock"
further down in the file.
Whether both (or neither) of lock/unlock are for real or just
hardcoded to return AE_NOT_CONFIGURED depends on ACPI_REDUCED_HARDWARE,
which I assume is also set when there's *no* ACPI hardware at all.
But I don't believe it's possible for "unlock" to do anything at all
if "lock" was hardcoded to simply return AE_NOT_CONFIGURED.
Then again, it's possible I'm still missing something :)
Thanks,
--Gabe
On Thu, Apr 14, 2016 at 12:33:37PM +0300, Dan Carpenter wrote:
> It acpi_acquire_global_lock() return AE_NOT_CONFIGURED then "glk" isn't
> initialized, which, if you got very unlucky, could cause a bug.
>
> Signed-off-by: Dan Carpenter <[email protected]>
>
> diff --git a/drivers/firmware/qemu_fw_cfg.c b/drivers/firmware/qemu_fw_cfg.c
> index d999fe3..0e20116 100644
> --- a/drivers/firmware/qemu_fw_cfg.c
> +++ b/drivers/firmware/qemu_fw_cfg.c
> @@ -77,7 +77,7 @@ static inline u16 fw_cfg_sel_endianness(u16 key)
> static inline void fw_cfg_read_blob(u16 key,
> void *buf, loff_t pos, size_t count)
> {
> - u32 glk;
> + u32 glk = -1U;
After digging through the acpi_[acquire|release]_global_lock() code in
drivers/acpi/acpica/evxface.c, the -1 value actually makes sense, as
glk is set to the value of acpi_gbl_global_lock_handle, which
internally is a 16-bit value which can wrap around, but will never be
equal to 32-bit "-1". As such, the unlock function would fail with
AE_NOT_ACQUIRED if its "for-real" version ever ended up being called.
So, with the typos in the commit blurb fixed (s/It/If/ and
s/return/returns/), and on general "belt-and-suspenders" principle,
Reviewed-by: Gabriel Somlo <[email protected]>
I just wanted to make sure my understanding of "this can't happen with
the way the ACPI macros are currently defined" is still correct :)
Thanks,
--Gabe
> acpi_status status;
>
> /* If we have ACPI, ensure mutual exclusion against any potential
Ah... I see now. You're right. Thanks for the explanation.
On my config those functions are no-ops so the variable isn't
initialized. If they were enabled then *probably* it wouldn't generate
a warning.
Probably just silencing the warning is the way to go though... I bet
GCC optimizes it away. Let me think about this some more...
regards,
dan carpenter