From: Daniel P. Berrange <berrange@redhat.com>
Date: Tue, 7 Jun 2016 11:27:51 +0000 (+0100)
Subject: io: remove mistaken call to object_ref on QTask
X-Git-Tag: v2.6.1~49
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=510531ea442a02048b1837fcf574d03559b38c9e;p=thirdparty%2Fqemu.git

io: remove mistaken call to object_ref on QTask

The QTask struct is just a standalone struct, not a QOM Object,
so calling object_ref() on it is not appropriate. This results
in mangling the 'destroy' field in the QTask struct, causing
the later call to qtask_free() to try to call the function
at address 0x1, with predictably segfault happy results.

There is in fact no need for ref counting with QTask, as the
call to qtask_abort() or qtask_complete() will automatically
free associated memory.

This fixes the crash shown in

  https://bugs.launchpad.net/qemu/+bug/1589923

Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
(cherry picked from commit bc35d51077b33e68a0ab10a057f352747214223f)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
---

diff --git a/io/channel-websock.c b/io/channel-websock.c
index 708178779e7..d5a4ed3f9c8 100644
--- a/io/channel-websock.c
+++ b/io/channel-websock.c
@@ -316,14 +316,13 @@ static gboolean qio_channel_websock_handshake_io(QIOChannel *ioc,
         return TRUE;
     }
 
-    object_ref(OBJECT(task));
     trace_qio_channel_websock_handshake_reply(ioc);
     qio_channel_add_watch(
         wioc->master,
         G_IO_OUT,
         qio_channel_websock_handshake_send,
         task,
-        (GDestroyNotify)object_unref);
+        NULL);
     return FALSE;
 }