diff options
| author | Daniel P. Berrange <berrange@redhat.com> | 2016-06-07 12:27:51 +0100 |
|---|---|---|
| committer | Daniel P. Berrange <berrange@redhat.com> | 2016-08-03 10:28:50 +0100 |
| commit | bc35d51077b33e68a0ab10a057f352747214223f (patch) | |
| tree | c3e4741a16350ece487a5f6e1cbe7d2a4dbb653d /io | |
| parent | 8b54a6a6c63dc84f2744f6b125c1a6c5a16ee10b (diff) | |
io: remove mistaken call to object_ref on QTask
The QTask struct is just a standalone struct, not a QOM Object,
so calling object_ref() on it is not appropriate. This results
in mangling the 'destroy' field in the QTask struct, causing
the later call to qtask_free() to try to call the function
at address 0x1, with predictably segfault happy results.
There is in fact no need for ref counting with QTask, as the
call to qtask_abort() or qtask_complete() will automatically
free associated memory.
This fixes the crash shown in
https://bugs.launchpad.net/qemu/+bug/1589923
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Diffstat (limited to 'io')
| -rw-r--r-- | io/channel-websock.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/io/channel-websock.c b/io/channel-websock.c index 239c75a979..533bd4b3b5 100644 --- a/io/channel-websock.c +++ b/io/channel-websock.c @@ -317,14 +317,13 @@ static gboolean qio_channel_websock_handshake_io(QIOChannel *ioc, return TRUE; } - object_ref(OBJECT(task)); trace_qio_channel_websock_handshake_reply(ioc); qio_channel_add_watch( wioc->master, G_IO_OUT, qio_channel_websock_handshake_send, task, - (GDestroyNotify)object_unref); + NULL); return FALSE; } |