From: Daniil Tatianin <d-tatia...@yandex-team.ru>
Object is supposed to be freed by invoking obj->free, and not
obj->instance_finalize. This would lead to use-after-free followed by
double free in object_unref/object_finalize.
Signed-off-by: Daniil Tatianin <d-tatia...@yandex-team.ru>
Reviewed-by: Marc-André Lureau <marcandre.lur...@redhat.com>
Message-Id: <20211117142349.836279-1-d-tatia...@yandex-team.ru>
Signed-off-by: Paolo Bonzini <pbonz...@redhat.com>
(cherry picked from commit fdc6e168181d06391711171b7c409b34f2981ced)
Signed-off-by: Michael Roth <michael.r...@amd.com>
---
chardev/wctablet.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/chardev/wctablet.c b/chardev/wctablet.c
index 95e005f5a5..e8b292c43c 100644
--- a/chardev/wctablet.c
+++ b/chardev/wctablet.c
@@ -320,7 +320,6 @@ static void wctablet_chr_finalize(Object *obj)
TabletChardev *tablet = WCTABLET_CHARDEV(obj);
qemu_input_handler_unregister(tablet->hs);
- g_free(tablet);
}
static void wctablet_chr_open(Chardev *chr,
--
2.25.1
