[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH STABLE 2.6] io: remove mistaken call to object_r
From: |
Daniel P. Berrange |
Subject: |
Re: [Qemu-devel] [PATCH STABLE 2.6] io: remove mistaken call to object_ref on QTask |
Date: |
Tue, 7 Jun 2016 16:23:39 +0100 |
User-agent: |
Mutt/1.6.0 (2016-04-01) |
Adding qemu-stable for 2.6
On Tue, Jun 07, 2016 at 03:19:05PM +0100, Daniel P. Berrange wrote:
> The QTask struct is just a standalone struct, not a QOM Object,
> so calling object_ref() on it is not appropriate. This results
> in mangling the 'destroy' field in the QTask struct, causing
> the later call to qtask_free() to try to call the function
> at address 0x1, with predictably segfault happy results.
>
> There is in fact no need for ref counting with QTask, as the
> call to qtask_abort() or qtask_complete() will automatically
> free associated memory.
>
> This fixes the crash shown in
>
> https://bugs.launchpad.net/qemu/+bug/1589923
>
> Reported-by: Ben Aitchison <address@hidden>
> Signed-off-by: Daniel P. Berrange <address@hidden>
> ---
> io/channel-websock.c | 3 +--
> 1 file changed, 1 insertion(+), 2 deletions(-)
>
> diff --git a/io/channel-websock.c b/io/channel-websock.c
> index 239c75a..533bd4b 100644
> --- a/io/channel-websock.c
> +++ b/io/channel-websock.c
> @@ -317,14 +317,13 @@ static gboolean
> qio_channel_websock_handshake_io(QIOChannel *ioc,
> return TRUE;
> }
>
> - object_ref(OBJECT(task));
> trace_qio_channel_websock_handshake_reply(ioc);
> qio_channel_add_watch(
> wioc->master,
> G_IO_OUT,
> qio_channel_websock_handshake_send,
> task,
> - (GDestroyNotify)object_unref);
> + NULL);
> return FALSE;
> }
>
> --
> 2.5.5
>
Regards,
Daniel
--
|: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org -o- http://virt-manager.org :|
|: http://autobuild.org -o- http://search.cpan.org/~danberr/ :|
|: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|