media: atomisp: don't pass a pointer to a local variable
authorMauro Carvalho Chehab <mchehab@kernel.org>
Fri, 13 May 2022 08:15:18 +0000 (10:15 +0200)
committerMauro Carvalho Chehab <mchehab@kernel.org>
Fri, 13 May 2022 09:02:20 +0000 (11:02 +0200)
As warned by gcc 12.1:

drivers/staging/media/atomisp/pci/runtime/rmgr/src/rmgr_vbuf.c: In function 'ia_css_rmgr_acq_vbuf':
drivers/staging/media/atomisp/pci/runtime/rmgr/src/rmgr_vbuf.c:275:33: error: storing the address of local variable 'h' in '*handle' [-Werror=dangling-pointer=]
  275 |                         *handle = &h;
      |                         ~~~~~~~~^~~~
drivers/staging/media/atomisp/pci/runtime/rmgr/src/rmgr_vbuf.c:257:40: note: 'h' declared here
  257 |         struct ia_css_rmgr_vbuf_handle h;
      |                                        ^
drivers/staging/media/atomisp/pci/runtime/rmgr/src/rmgr_vbuf.c:257:40: note: 'handle' declared here
cc1: all warnings being treated as errors

The logic uses a temporary struct to update the handler, but,
instead of copying the value to the pointer sent by the caller, it
replaces it with the content with a local variable. That's wrong, and
may lead the caller to use a weird value.

Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
drivers/staging/media/atomisp/pci/runtime/rmgr/src/rmgr_vbuf.c

index d96aaa4..3960475 100644 (file)
@@ -254,7 +254,7 @@ void rmgr_pop_handle(struct ia_css_rmgr_vbuf_pool *pool,
 void ia_css_rmgr_acq_vbuf(struct ia_css_rmgr_vbuf_pool *pool,
                          struct ia_css_rmgr_vbuf_handle **handle)
 {
-       struct ia_css_rmgr_vbuf_handle h;
+       struct ia_css_rmgr_vbuf_handle h = { 0 };
 
        if ((!pool) || (!handle) || (!*handle)) {
                IA_CSS_LOG("Invalid inputs");
@@ -272,7 +272,7 @@ void ia_css_rmgr_acq_vbuf(struct ia_css_rmgr_vbuf_pool *pool,
                        h.size = (*handle)->size;
                        /* release ref to current buffer */
                        ia_css_rmgr_refcount_release_vbuf(handle);
-                       *handle = &h;
+                       **handle = h;
                }
                /* get new buffer for needed size */
                if ((*handle)->vptr == 0x0) {