aboutsummaryrefslogtreecommitdiff
path: root/io
diff options
context:
space:
mode:
authorDaniel P. Berrange <berrange@redhat.com>2016-06-07 12:27:51 +0100
committerDaniel P. Berrange <berrange@redhat.com>2016-08-03 10:28:50 +0100
commitbc35d51077b33e68a0ab10a057f352747214223f (patch)
treec3e4741a16350ece487a5f6e1cbe7d2a4dbb653d /io
parent8b54a6a6c63dc84f2744f6b125c1a6c5a16ee10b (diff)
downloadqemu-arm-bc35d51077b33e68a0ab10a057f352747214223f.tar.gz
io: remove mistaken call to object_ref on QTask
The QTask struct is just a standalone struct, not a QOM Object, so calling object_ref() on it is not appropriate. This results in mangling the 'destroy' field in the QTask struct, causing the later call to qtask_free() to try to call the function at address 0x1, with predictably segfault happy results. There is in fact no need for ref counting with QTask, as the call to qtask_abort() or qtask_complete() will automatically free associated memory. This fixes the crash shown in https://bugs.launchpad.net/qemu/+bug/1589923 Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Diffstat (limited to 'io')
-rw-r--r--io/channel-websock.c3
1 files changed, 1 insertions, 2 deletions
diff --git a/io/channel-websock.c b/io/channel-websock.c
index 239c75a979..533bd4b3b5 100644
--- a/io/channel-websock.c
+++ b/io/channel-websock.c
@@ -317,14 +317,13 @@ static gboolean qio_channel_websock_handshake_io(QIOChannel *ioc,
return TRUE;
}
- object_ref(OBJECT(task));
trace_qio_channel_websock_handshake_reply(ioc);
qio_channel_add_watch(
wioc->master,
G_IO_OUT,
qio_channel_websock_handshake_send,
task,
- (GDestroyNotify)object_unref);
+ NULL);
return FALSE;
}