libcli/smb: make sure we remove the writev_send() request when a request is destroyed

This way smbXcli_conn_disconnect() removes all tevent_fd structures attached to
the sock_fd before closing it.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11316

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

diff --git a/libcli/smb/smbXcli_base.c b/libcli/smb/smbXcli_base.c
index 04f8c96656d34bbef2d2cf98a9afb54fd6a8aca8..c8ae5b06a9006434262b5ded36bda54e491a3251 100644 (file)
--- a/libcli/smb/smbXcli_base.c
+++ b/libcli/smb/smbXcli_base.c
@@ -222,6 +222,8 @@ struct smbXcli_req_state {
 
        uint8_t *inbuf;
 
+       struct tevent_req *write_req;
+
        struct {
                /* Space for the header including the wct */
                uint8_t hdr[HDR_VWV];
@@ -838,6 +840,8 @@ void smbXcli_req_unset_pending(struct tevent_req *req)
        size_t num_pending = talloc_array_length(conn->pending);
        size_t i;
 
+       TALLOC_FREE(state->write_req);
+
        if (state->smb1.mid != 0) {
                /*
                 * This is a [nt]trans[2] request which waits
@@ -896,6 +900,8 @@ static void smbXcli_req_cleanup(struct tevent_req *req,
                tevent_req_data(req,
                struct smbXcli_req_state);
 
+       TALLOC_FREE(state->write_req);
+
        switch (req_state) {
        case TEVENT_REQ_RECEIVED:
                /*
@@ -1614,6 +1620,8 @@ static NTSTATUS smb1cli_req_writev_submit(struct tevent_req *req,
                return NT_STATUS_NO_MEMORY;
        }
        tevent_req_set_callback(subreq, smb1cli_req_writev_done, req);
+       state->write_req = subreq;
+
        return NT_STATUS_OK;
 }
 
@@ -1670,6 +1678,8 @@ static void smb1cli_req_writev_done(struct tevent_req *subreq)
        ssize_t nwritten;
        int err;
 
+       state->write_req = NULL;
+
        nwritten = writev_recv(subreq, &err);
        TALLOC_FREE(subreq);
        if (nwritten == -1) {
@@ -3204,6 +3214,8 @@ skip_credits:
                return NT_STATUS_NO_MEMORY;
        }
        tevent_req_set_callback(subreq, smb2cli_req_writev_done, reqs[0]);
+       state->write_req = subreq;
+
        return NT_STATUS_OK;
 }
 
@@ -3265,6 +3277,8 @@ static void smb2cli_req_writev_done(struct tevent_req *subreq)
        ssize_t nwritten;
        int err;
 
+       state->write_req = NULL;
+
        nwritten = writev_recv(subreq, &err);
        TALLOC_FREE(subreq);
        if (nwritten == -1) {