| Message ID | 1465309145-6224-1-git-send-email-berrange@redhat.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On 06/07/2016 08:19 AM, Daniel P. Berrange wrote: > The QTask struct is just a standalone struct, not a QOM Object, > so calling object_ref() on it is not appropriate. This results > in mangling the 'destroy' field in the QTask struct, causing > the later call to qtask_free() to try to call the function > at address 0x1, with predictably segfault happy results. > > There is in fact no need for ref counting with QTask, as the > call to qtask_abort() or qtask_complete() will automatically > free associated memory. > > This fixes the crash shown in > > https://bugs.launchpad.net/qemu/+bug/1589923 > > Reported-by: Ben Aitchison <ben@meh.net.nz> > Signed-off-by: Daniel P. Berrange <berrange@redhat.com> > --- > io/channel-websock.c | 3 +-- > 1 file changed, 1 insertion(+), 2 deletions(-) > Reviewed-by: Eric Blake <eblake@redhat.com>
Adding qemu-stable for 2.6 On Tue, Jun 07, 2016 at 03:19:05PM +0100, Daniel P. Berrange wrote: > The QTask struct is just a standalone struct, not a QOM Object, > so calling object_ref() on it is not appropriate. This results > in mangling the 'destroy' field in the QTask struct, causing > the later call to qtask_free() to try to call the function > at address 0x1, with predictably segfault happy results. > > There is in fact no need for ref counting with QTask, as the > call to qtask_abort() or qtask_complete() will automatically > free associated memory. > > This fixes the crash shown in > > https://bugs.launchpad.net/qemu/+bug/1589923 > > Reported-by: Ben Aitchison <ben@meh.net.nz> > Signed-off-by: Daniel P. Berrange <berrange@redhat.com> > --- > io/channel-websock.c | 3 +-- > 1 file changed, 1 insertion(+), 2 deletions(-) > > diff --git a/io/channel-websock.c b/io/channel-websock.c > index 239c75a..533bd4b 100644 > --- a/io/channel-websock.c > +++ b/io/channel-websock.c > @@ -317,14 +317,13 @@ static gboolean qio_channel_websock_handshake_io(QIOChannel *ioc, > return TRUE; > } > > - object_ref(OBJECT(task)); > trace_qio_channel_websock_handshake_reply(ioc); > qio_channel_add_watch( > wioc->master, > G_IO_OUT, > qio_channel_websock_handshake_send, > task, > - (GDestroyNotify)object_unref); > + NULL); > return FALSE; > } > > -- > 2.5.5 > Regards, Daniel
diff --git a/io/channel-websock.c b/io/channel-websock.c index 239c75a..533bd4b 100644 --- a/io/channel-websock.c +++ b/io/channel-websock.c @@ -317,14 +317,13 @@ static gboolean qio_channel_websock_handshake_io(QIOChannel *ioc, return TRUE; } - object_ref(OBJECT(task)); trace_qio_channel_websock_handshake_reply(ioc); qio_channel_add_watch( wioc->master, G_IO_OUT, qio_channel_websock_handshake_send, task, - (GDestroyNotify)object_unref); + NULL); return FALSE; }
The QTask struct is just a standalone struct, not a QOM Object, so calling object_ref() on it is not appropriate. This results in mangling the 'destroy' field in the QTask struct, causing the later call to qtask_free() to try to call the function at address 0x1, with predictably segfault happy results. There is in fact no need for ref counting with QTask, as the call to qtask_abort() or qtask_complete() will automatically free associated memory. This fixes the crash shown in https://bugs.launchpad.net/qemu/+bug/1589923 Reported-by: Ben Aitchison <ben@meh.net.nz> Signed-off-by: Daniel P. Berrange <berrange@redhat.com> --- io/channel-websock.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)