The QEMU monitor open method would not take a reference on the virDomainObjPtr until it had successfully opened the monitor. The cleanup code upon failure to open though would call qemuMonitorClose() which would in turn decrement the reference count. This caused the virDoaminObjPtr to be mistakenly freed and then the whole driver crashes * src/qemu/qemu_monitor.c: Fix reference counting in qemuMonitorOpen --- src/qemu/qemu_monitor.c | 3 +-- 1 files changed, 1 insertions(+), 2 deletions(-) diff --git a/src/qemu/qemu_monitor.c b/src/qemu/qemu_monitor.c index 2357734..f0ef81b 100644 --- a/src/qemu/qemu_monitor.c +++ b/src/qemu/qemu_monitor.c @@ -456,6 +456,7 @@ qemuMonitorOpen(virDomainObjPtr vm, mon->vm = vm; mon->eofCB = eofCB; qemuMonitorLock(mon); + virDomainObjRef(vm); switch (vm->monitor_chr->type) { case VIR_DOMAIN_CHR_TYPE_UNIX: @@ -499,8 +500,6 @@ qemuMonitorOpen(virDomainObjPtr vm, goto cleanup; } - virDomainObjRef(vm); - VIR_DEBUG("New mon %p fd =%d watch=%d", mon, mon->fd, mon->watch); qemuMonitorUnlock(mon); -- 1.6.2.5