510531ea44
The QTask struct is just a standalone struct, not a QOM Object,
so calling object_ref() on it is not appropriate. This results
in mangling the 'destroy' field in the QTask struct, causing
the later call to qtask_free() to try to call the function
at address 0x1, with predictably segfault happy results.
There is in fact no need for ref counting with QTask, as the
call to qtask_abort() or qtask_complete() will automatically
free associated memory.
This fixes the crash shown in
https://bugs.launchpad.net/qemu/+bug/1589923
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
(cherry picked from commit
|
||
|---|---|---|
| .. | ||
| channel-buffer.c | ||
| channel-command.c | ||
| channel-file.c | ||
| channel-socket.c | ||
| channel-tls.c | ||
| channel-util.c | ||
| channel-watch.c | ||
| channel-websock.c | ||
| channel.c | ||
| Makefile.objs | ||
| task.c | ||