[Qemu-devel] [PATCH] io: remove mistaken call to object_ref on QTask

[Qemu-devel] [PATCH] io: remove mistaken call to object_ref on QTask

[Daniel P. Berrange]

The QTask struct is just a standalone struct, not a QOM Object,
so calling object_ref() on it is not appropriate. This results
in mangling the 'destroy' field in the QTask struct, causing
the later call to qtask_free() to try to call the function
at address 0x1, with predictably segfault happy results.

There is in fact no need for ref counting with QTask, as the
call to qtask_abort() or qtask_complete() will automatically
free associated memory.

This fixes the crash shown in

  https://bugs.launchpad.net/qemu/+bug/1589923

Reported-by: Ben Aitchison <ben@meh.net.nz>
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
---
 io/channel-websock.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/io/channel-websock.c b/io/channel-websock.c
index 239c75a..533bd4b 100644
--- a/io/channel-websock.c
+++ b/io/channel-websock.c
@@ -317,14 +317,13 @@ static gboolean qio_channel_websock_handshake_io(QIOChannel *ioc,
         return TRUE;
     }
 
-    object_ref(OBJECT(task));
     trace_qio_channel_websock_handshake_reply(ioc);
     qio_channel_add_watch(
         wioc->master,
         G_IO_OUT,
         qio_channel_websock_handshake_send,
         task,
-        (GDestroyNotify)object_unref);
+        NULL);
     return FALSE;
 }
 
-- 
2.5.5

Re: [Qemu-devel] [PATCH] io: remove mistaken call to object_ref on QTask

[Eric Blake]

[-- Attachment #1: Type: text/plain, Size: 983 bytes --]

On 06/07/2016 08:19 AM, Daniel P. Berrange wrote:
> The QTask struct is just a standalone struct, not a QOM Object,
> so calling object_ref() on it is not appropriate. This results
> in mangling the 'destroy' field in the QTask struct, causing
> the later call to qtask_free() to try to call the function
> at address 0x1, with predictably segfault happy results.
> 
> There is in fact no need for ref counting with QTask, as the
> call to qtask_abort() or qtask_complete() will automatically
> free associated memory.
> 
> This fixes the crash shown in
> 
>   https://bugs.launchpad.net/qemu/+bug/1589923
> 
> Reported-by: Ben Aitchison <ben@meh.net.nz>
> Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
> ---
>  io/channel-websock.c | 3 +--
>  1 file changed, 1 insertion(+), 2 deletions(-)
> 

Reviewed-by: Eric Blake <eblake@redhat.com>

-- 
Eric Blake   eblake redhat com    +1-919-301-3266
Libvirt virtualization library http://libvirt.org


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 604 bytes --]

Re: [Qemu-devel] [PATCH STABLE 2.6] io: remove mistaken call to object_ref on QTask

[Daniel P. Berrange]

Adding qemu-stable for 2.6

On Tue, Jun 07, 2016 at 03:19:05PM +0100, Daniel P. Berrange wrote:
> The QTask struct is just a standalone struct, not a QOM Object,
> so calling object_ref() on it is not appropriate. This results
> in mangling the 'destroy' field in the QTask struct, causing
> the later call to qtask_free() to try to call the function
> at address 0x1, with predictably segfault happy results.
> 
> There is in fact no need for ref counting with QTask, as the
> call to qtask_abort() or qtask_complete() will automatically
> free associated memory.
> 
> This fixes the crash shown in
> 
>   https://bugs.launchpad.net/qemu/+bug/1589923
> 
> Reported-by: Ben Aitchison <ben@meh.net.nz>
> Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
> ---
>  io/channel-websock.c | 3 +--
>  1 file changed, 1 insertion(+), 2 deletions(-)
> 
> diff --git a/io/channel-websock.c b/io/channel-websock.c
> index 239c75a..533bd4b 100644
> --- a/io/channel-websock.c
> +++ b/io/channel-websock.c
> @@ -317,14 +317,13 @@ static gboolean qio_channel_websock_handshake_io(QIOChannel *ioc,
>          return TRUE;
>      }
>  
> -    object_ref(OBJECT(task));
>      trace_qio_channel_websock_handshake_reply(ioc);
>      qio_channel_add_watch(
>          wioc->master,
>          G_IO_OUT,
>          qio_channel_websock_handshake_send,
>          task,
> -        (GDestroyNotify)object_unref);
> +        NULL);
>      return FALSE;
>  }
>  
> -- 
> 2.5.5
> 

Regards,
Daniel
-- 
|: http://berrange.com      -o-    http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org              -o-             http://virt-manager.org :|
|: http://autobuild.org       -o-         http://search.cpan.org/~danberr/ :|
|: http://entangle-photo.org       -o-       http://live.gnome.org/gtk-vnc :|