[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH 30/56] io: remove mistaken call to object_ref on QTa
From: |
Michael Roth |
Subject: |
[Qemu-devel] [PATCH 30/56] io: remove mistaken call to object_ref on QTask |
Date: |
Mon, 8 Aug 2016 16:04:01 -0500 |
From: "Daniel P. Berrange" <address@hidden>
The QTask struct is just a standalone struct, not a QOM Object,
so calling object_ref() on it is not appropriate. This results
in mangling the 'destroy' field in the QTask struct, causing
the later call to qtask_free() to try to call the function
at address 0x1, with predictably segfault happy results.
There is in fact no need for ref counting with QTask, as the
call to qtask_abort() or qtask_complete() will automatically
free associated memory.
This fixes the crash shown in
https://bugs.launchpad.net/qemu/+bug/1589923
Reviewed-by: Eric Blake <address@hidden>
Signed-off-by: Daniel P. Berrange <address@hidden>
(cherry picked from commit bc35d51077b33e68a0ab10a057f352747214223f)
Signed-off-by: Michael Roth <address@hidden>
---
io/channel-websock.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/io/channel-websock.c b/io/channel-websock.c
index 7081787..d5a4ed3 100644
--- a/io/channel-websock.c
+++ b/io/channel-websock.c
@@ -316,14 +316,13 @@ static gboolean
qio_channel_websock_handshake_io(QIOChannel *ioc,
return TRUE;
}
- object_ref(OBJECT(task));
trace_qio_channel_websock_handshake_reply(ioc);
qio_channel_add_watch(
wioc->master,
G_IO_OUT,
qio_channel_websock_handshake_send,
task,
- (GDestroyNotify)object_unref);
+ NULL);
return FALSE;
}
--
1.9.1
- [Qemu-devel] [PATCH 17/56] vga: add sr_vbe register set, (continued)
- [Qemu-devel] [PATCH 17/56] vga: add sr_vbe register set, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 14/56] esp: check dma length before reading scsi command(CVE-2016-4441), Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 22/56] Fix configure test for PBKDF2 in nettle, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 18/56] vfio: Fix broken EEH, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 20/56] nbd: Don't trim unrequested bytes, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 01/56] i386: kvmvapic: initialise imm32 variable, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 19/56] block/iscsi: avoid potential overflow of acb->task->cdb, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 27/56] vmsvga: add more fifo checks, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 21/56] savevm: fail if migration blockers are present, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 24/56] scsi: mptsas: infinite loop while fetching requests, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 30/56] io: remove mistaken call to object_ref on QTask,
Michael Roth <=
- [Qemu-devel] [PATCH 23/56] scsi: pvscsi: check command descriptor ring buffer size (CVE-2016-4952), Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 29/56] vmsvga: don't process more than 1024 fifo commands at once, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 31/56] ui: fix regression in printing VNC host/port on startup, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 32/56] net: fix qemu_announce_self not emitting packets, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 25/56] block: Drop bdrv_ioctl_bh_cb, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 26/56] vmsvga: move fifo sanity checks to vmsvga_fifo_length, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 02/56] spice/gl: add & use qemu_spice_gl_monitor_config, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 28/56] vmsvga: shadow fifo registers, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 34/56] qcow2: Avoid making the L1 table too big, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 33/56] backup: Don't leak BackupBlockJob in error path, Michael Roth, 2016/08/08