libcli/smb: make sure we remove the writev_send() request when a request is destroyed

This way smbXcli_conn_disconnect() removes all tevent_fd structures attached to
the sock_fd before closing it.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11316

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
(cherry picked from commit 006042ac126261e87089fb9835c28789e8aeae1b)

diff --git a/libcli/smb/smbXcli_base.c b/libcli/smb/smbXcli_base.c
index 61edd285758e717021d97bb2188ba8770bf860fc..c27b31710997050ae5319b94189a45b846d24a2e 100644 (file)
--- a/libcli/smb/smbXcli_base.c
+++ b/libcli/smb/smbXcli_base.c
@@ -206,6 +206,8 @@ struct smbXcli_req_state {
 
        uint8_t *inbuf;
 
+       struct tevent_req *write_req;
+
        struct {
                /* Space for the header including the wct */
                uint8_t hdr[HDR_VWV];
@@ -812,6 +814,8 @@ void smbXcli_req_unset_pending(struct tevent_req *req)
        size_t num_pending = talloc_array_length(conn->pending);
        size_t i;
 
+       TALLOC_FREE(state->write_req);
+
        if (state->smb1.mid != 0) {
                /*
                 * This is a [nt]trans[2] request which waits
@@ -870,6 +874,8 @@ static void smbXcli_req_cleanup(struct tevent_req *req,
                tevent_req_data(req,
                struct smbXcli_req_state);
 
+       TALLOC_FREE(state->write_req);
+
        switch (req_state) {
        case TEVENT_REQ_RECEIVED:
                /*
@@ -1572,6 +1578,8 @@ static NTSTATUS smb1cli_req_writev_submit(struct tevent_req *req,
                return NT_STATUS_NO_MEMORY;
        }
        tevent_req_set_callback(subreq, smb1cli_req_writev_done, req);
+       state->write_req = subreq;
+
        return NT_STATUS_OK;
 }
 
@@ -1628,6 +1636,8 @@ static void smb1cli_req_writev_done(struct tevent_req *subreq)
        ssize_t nwritten;
        int err;
 
+       state->write_req = NULL;
+
        nwritten = writev_recv(subreq, &err);
        TALLOC_FREE(subreq);
        if (nwritten == -1) {
@@ -3109,6 +3119,8 @@ skip_credits:
                return NT_STATUS_NO_MEMORY;
        }
        tevent_req_set_callback(subreq, smb2cli_req_writev_done, reqs[0]);
+       state->write_req = subreq;
+
        return NT_STATUS_OK;
 }
 
@@ -3170,6 +3182,8 @@ static void smb2cli_req_writev_done(struct tevent_req *subreq)
        ssize_t nwritten;
        int err;
 
+       state->write_req = NULL;
+
        nwritten = writev_recv(subreq, &err);
        TALLOC_FREE(subreq);
        if (nwritten == -1) {