vfs_default: pass in state as the callback data to the subreq

Find the req we're finishing off by looking inside the state.  In a shutdown
close the caller calls talloc_free(req), so we can't access it directly as
callback data.

The next commit will NULL out the state->req pointer when a caller calls
talloc_free(req), and the request is still in flight.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14301

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

diff --git a/source3/modules/vfs_default.c b/source3/modules/vfs_default.c
index fac7fa30ab759e8a5352db94f8e6a07df557fae9..bd39eb47e9ab050a5d7f41d1ad6c53e9d9fc2c6b 100644 (file)
--- a/source3/modules/vfs_default.c
+++ b/source3/modules/vfs_default.c
@@ -3408,7 +3408,7 @@ static struct tevent_req *vfswrap_getxattrat_send(
        if (tevent_req_nomem(subreq, req)) {
                return tevent_req_post(req, ev);
        }
-       tevent_req_set_callback(subreq, vfswrap_getxattrat_done, req);
+       tevent_req_set_callback(subreq, vfswrap_getxattrat_done, state);
 
        talloc_set_destructor(state, vfswrap_getxattrat_state_destructor);
 
@@ -3503,10 +3503,9 @@ end_profile:
 
 static void vfswrap_getxattrat_done(struct tevent_req *subreq)
 {
-       struct tevent_req *req = tevent_req_callback_data(
-               subreq, struct tevent_req);
-       struct vfswrap_getxattrat_state *state = tevent_req_data(
-               req, struct vfswrap_getxattrat_state);
+       struct vfswrap_getxattrat_state *state = tevent_req_callback_data(
+               subreq, struct vfswrap_getxattrat_state);
+       struct tevent_req *req = state->req;
        int ret;
        bool ok;