aboutsummaryrefslogtreecommitdiff
path: root/io
diff options
context:
space:
mode:
authorDaniel P. Berrange <berrange@redhat.com>2017-01-25 11:10:53 +0000
committerDaniel P. Berrange <berrange@redhat.com>2017-01-26 10:26:18 +0000
commit80fb34eda099e7cc519a91e9701ab3c0262717b3 (patch)
tree44fc2cdb60950b04588b6ad65651b353170ae04b /io
parentc7f1cf01b8245762ca5864e835d84f6677ae8b1f (diff)
downloadqemu-80fb34eda099e7cc519a91e9701ab3c0262717b3.zip
qemu-80fb34eda099e7cc519a91e9701ab3c0262717b3.tar.gz
qemu-80fb34eda099e7cc519a91e9701ab3c0262717b3.tar.bz2
io: fix possible double free of task error object
If a QIOTask has an error set and the calling code uses qio_task_propagate_error() to steal the reference to that Error object, the task would not clear its own reference. This would lead to a double-free when qio_task_free runs, if the caller had (correctly) freed the Error object they now owned. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Diffstat (limited to 'io')
-rw-r--r--io/task.c1
1 files changed, 1 insertions, 0 deletions
diff --git a/io/task.c b/io/task.c
index 60bf1a9..3ce5560 100644
--- a/io/task.c
+++ b/io/task.c
@@ -157,6 +157,7 @@ bool qio_task_propagate_error(QIOTask *task,
{
if (task->err) {
error_propagate(errp, task->err);
+ task->err = NULL;
return true;
}