mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

io: remove mistaken call to object_ref on QTask

Browse Source 
The QTask struct is just a standalone struct, not a QOM Object,
so calling object_ref() on it is not appropriate. This results
in mangling the 'destroy' field in the QTask struct, causing
the later call to qtask_free() to try to call the function
at address 0x1, with predictably segfault happy results.

There is in fact no need for ref counting with QTask, as the
call to qtask_abort() or qtask_complete() will automatically
free associated memory.

This fixes the crash shown in

  https://bugs.launchpad.net/qemu/+bug/1589923

Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
(cherry picked from commit bc35d51077)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
This commit is contained in:
Daniel P. Berrange 2016-06-07 12:27:51 +01:00 committed by Michael Roth
parent d59d37dea4
commit 510531ea44
1 changed files with 1 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
io/channel-websock.c
View File

@ -316,14 +316,13 @@ static gboolean qio_channel_websock_handshake_io(QIOChannel *ioc,
return TRUE; return TRUE;
} }
object_ref(OBJECT(task));
trace_qio_channel_websock_handshake_reply(ioc); trace_qio_channel_websock_handshake_reply(ioc);
qio_channel_add_watch( qio_channel_add_watch(
wioc->master, wioc->master,
G_IO_OUT, G_IO_OUT,
qio_channel_websock_handshake_send, qio_channel_websock_handshake_send,
task, task,
(GDestroyNotify)object_unref); NULL);
return FALSE; return FALSE;
} }