[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH] io: remove mistaken call to object_ref on QTask
From: |
Daniel P. Berrange |
Subject: |
[Qemu-devel] [PATCH] io: remove mistaken call to object_ref on QTask |
Date: |
Tue, 7 Jun 2016 15:19:05 +0100 |
The QTask struct is just a standalone struct, not a QOM Object,
so calling object_ref() on it is not appropriate. This results
in mangling the 'destroy' field in the QTask struct, causing
the later call to qtask_free() to try to call the function
at address 0x1, with predictably segfault happy results.
There is in fact no need for ref counting with QTask, as the
call to qtask_abort() or qtask_complete() will automatically
free associated memory.
This fixes the crash shown in
https://bugs.launchpad.net/qemu/+bug/1589923
Reported-by: Ben Aitchison <address@hidden>
Signed-off-by: Daniel P. Berrange <address@hidden>
---
io/channel-websock.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/io/channel-websock.c b/io/channel-websock.c
index 239c75a..533bd4b 100644
--- a/io/channel-websock.c
+++ b/io/channel-websock.c
@@ -317,14 +317,13 @@ static gboolean
qio_channel_websock_handshake_io(QIOChannel *ioc,
return TRUE;
}
- object_ref(OBJECT(task));
trace_qio_channel_websock_handshake_reply(ioc);
qio_channel_add_watch(
wioc->master,
G_IO_OUT,
qio_channel_websock_handshake_send,
task,
- (GDestroyNotify)object_unref);
+ NULL);
return FALSE;
}
--
2.5.5
- [Qemu-devel] [PATCH] io: remove mistaken call to object_ref on QTask,
Daniel P. Berrange <=