The QTask struct is just a standalone struct, not a QOM Object, so calling object_ref() on it is not appropriate. This results in mangling the 'destroy' field in the QTask struct, causing the later call to qtask_free() to try to call the function at address 0x1, with predictably segfault happy results. There is in fact no need for ref counting with QTask, as the call to qtask_abort() or qtask_complete() will automatically free associated memory. This fixes the crash shown in https://bugs.launchpad.net/qemu/+bug/1589923 Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Daniel P. Berrange <berrange@redhat.com> |
||
---|---|---|
.. | ||
channel-buffer.c | ||
channel-command.c | ||
channel-file.c | ||
channel-socket.c | ||
channel-tls.c | ||
channel-util.c | ||
channel-watch.c | ||
channel-websock.c | ||
channel.c | ||
Makefile.objs | ||
task.c | ||
trace-events |