diff options
| author | Daniel P. Berrange <berrange@redhat.com> | 2016-06-07 12:27:51 +0100 |
|---|---|---|
| committer | Michael Roth <mdroth@linux.vnet.ibm.com> | 2016-08-05 13:44:29 -0500 |
| commit | 510531ea442a02048b1837fcf574d03559b38c9e (patch) | |
| tree | 4a35e5aa70d398e7355f4602f2f313c5e37f30a1 /io | |
| parent | d59d37dea4fa8ae716409a828f5ba117ce597da6 (diff) | |
io: remove mistaken call to object_ref on QTask
The QTask struct is just a standalone struct, not a QOM Object,
so calling object_ref() on it is not appropriate. This results
in mangling the 'destroy' field in the QTask struct, causing
the later call to qtask_free() to try to call the function
at address 0x1, with predictably segfault happy results.
There is in fact no need for ref counting with QTask, as the
call to qtask_abort() or qtask_complete() will automatically
free associated memory.
This fixes the crash shown in
https://bugs.launchpad.net/qemu/+bug/1589923
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
(cherry picked from commit bc35d51077b33e68a0ab10a057f352747214223f)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Diffstat (limited to 'io')
| -rw-r--r-- | io/channel-websock.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/io/channel-websock.c b/io/channel-websock.c index 708178779e..d5a4ed3f9c 100644 --- a/io/channel-websock.c +++ b/io/channel-websock.c @@ -316,14 +316,13 @@ static gboolean qio_channel_websock_handshake_io(QIOChannel *ioc, return TRUE; } - object_ref(OBJECT(task)); trace_qio_channel_websock_handshake_reply(ioc); qio_channel_add_watch( wioc->master, G_IO_OUT, qio_channel_websock_handshake_send, task, - (GDestroyNotify)object_unref); + NULL); return FALSE; } |