From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:47459) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bUsnY-0005j1-6H for qemu-devel@nongnu.org; Wed, 03 Aug 2016 05:49:13 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bUsnX-0000ah-05 for qemu-devel@nongnu.org; Wed, 03 Aug 2016 05:49:12 -0400 Received: from mx1.redhat.com ([209.132.183.28]:50862) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bUsnW-0000aH-RJ for qemu-devel@nongnu.org; Wed, 03 Aug 2016 05:49:10 -0400 From: "Daniel P. Berrange" Date: Wed, 3 Aug 2016 10:48:59 +0100 Message-Id: <1470217739-32229-2-git-send-email-berrange@redhat.com> In-Reply-To: <1470217739-32229-1-git-send-email-berrange@redhat.com> References: <1470217739-32229-1-git-send-email-berrange@redhat.com> Subject: [Qemu-devel] [PULL v1] io: remove mistaken call to object_ref on QTask List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Peter Maydell , "Daniel P. Berrange" The QTask struct is just a standalone struct, not a QOM Object, so calling object_ref() on it is not appropriate. This results in mangling the 'destroy' field in the QTask struct, causing the later call to qtask_free() to try to call the function at address 0x1, with predictably segfault happy results. There is in fact no need for ref counting with QTask, as the call to qtask_abort() or qtask_complete() will automatically free associated memory. This fixes the crash shown in https://bugs.launchpad.net/qemu/+bug/1589923 Reviewed-by: Eric Blake Signed-off-by: Daniel P. Berrange --- io/channel-websock.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/io/channel-websock.c b/io/channel-websock.c index 239c75a..533bd4b 100644 --- a/io/channel-websock.c +++ b/io/channel-websock.c @@ -317,14 +317,13 @@ static gboolean qio_channel_websock_handshake_io(QIOChannel *ioc, return TRUE; } - object_ref(OBJECT(task)); trace_qio_channel_websock_handshake_reply(ioc); qio_channel_add_watch( wioc->master, G_IO_OUT, qio_channel_websock_handshake_send, task, - (GDestroyNotify)object_unref); + NULL); return FALSE; } -- 2.7.4