commit 510531ea442a02048b1837fcf574d03559b38c9e
Author: Daniel P. Berrange <email address hidden>
Date: Tue Jun 7 12:27:51 2016 +0100
io: remove mistaken call to object_ref on QTask
The QTask struct is just a standalone struct, not a QOM Object,
so calling object_ref() on it is not appropriate. This results
in mangling the 'destroy' field in the QTask struct, causing
the later call to qtask_free() to try to call the function
at address 0x1, with predictably segfault happy results.
There is in fact no need for ref counting with QTask, as the
call to qtask_abort() or qtask_complete() will automatically
free associated memory.
Reviewed-by: Eric Blake <email address hidden>
Signed-off-by: Daniel P. Berrange <email address hidden>
(cherry picked from commit bc35d51077b33e68a0ab10a057f352747214223f)
Signed-off-by: Michael Roth <email address hidden>
Fixed in stable-2.6 branch in
commit 510531ea442a020 48b1837fcf574d0 3559b38c9e
Author: Daniel P. Berrange <email address hidden>
Date: Tue Jun 7 12:27:51 2016 +0100
io: remove mistaken call to object_ref on QTask
The QTask struct is just a standalone struct, not a QOM Object,
so calling object_ref() on it is not appropriate. This results
in mangling the 'destroy' field in the QTask struct, causing
the later call to qtask_free() to try to call the function
at address 0x1, with predictably segfault happy results.
There is in fact no need for ref counting with QTask, as the
call to qtask_abort() or qtask_complete() will automatically
free associated memory.
This fixes the crash shown in
https:/ /bugs.launchpad .net/qemu/ +bug/1589923
Reviewed-by: Eric Blake <email address hidden> 8a0ab10a057f352 747214223f)
Signed-off-by: Daniel P. Berrange <email address hidden>
(cherry picked from commit bc35d51077b33e6
Signed-off-by: Michael Roth <email address hidden>