Merge branch 'master' of ssh://git.samba.org/data/git/samba

21 files changed, 112 insertions, 56 deletions

diff --git a/source4/ntvfs/posix/pvfs_acl.c b/source4/ntvfs/posix/pvfs_acl.c
index d479f1e2ee..1adced44aa 100644
--- a/source4/ntvfs/posix/pvfs_acl.c
+++ b/source4/ntvfs/posix/pvfs_acl.c
@@ -51,7 +51,7 @@ NTSTATUS pvfs_acl_register(const struct pvfs_acl_ops *ops)
 	backends = talloc_realloc(talloc_autofree_context(), backends, struct pvfs_acl_backend, num_backends+1);
 	NT_STATUS_HAVE_NO_MEMORY(backends);
 
-	new_ops = talloc_memdup(backends, ops, sizeof(*ops));
+	new_ops = (struct pvfs_acl_ops *)talloc_memdup(backends, ops, sizeof(*ops));
 	new_ops->name = talloc_strdup(new_ops, ops->name);
 
 	backends[num_backends].ops = new_ops;
diff --git a/source4/ntvfs/posix/pvfs_aio.c b/source4/ntvfs/posix/pvfs_aio.c
index 56566e3592..e2028d0017 100644
--- a/source4/ntvfs/posix/pvfs_aio.c
+++ b/source4/ntvfs/posix/pvfs_aio.c
@@ -145,7 +145,7 @@ NTSTATUS pvfs_aio_pwrite(struct ntvfs_request *req, union smb_write *wr,
 	state = talloc(req, struct pvfs_aio_write_state);
 	NT_STATUS_HAVE_NO_MEMORY(state);
 
-        io_prep_pwrite(&iocb, f->handle->fd, wr->writex.in.data,
+	io_prep_pwrite(&iocb, f->handle->fd, discard_const(wr->writex.in.data),
 		       wr->writex.in.count, wr->writex.in.offset);
 	state->ae = tevent_add_aio(req->ctx->event_ctx, req->ctx->event_ctx, &iocb,
 				   pvfs_aio_write_handler, state);
diff --git a/source4/ntvfs/posix/pvfs_flush.c b/source4/ntvfs/posix/pvfs_flush.c
index 6e09c1f34a..f425fccec7 100644
--- a/source4/ntvfs/posix/pvfs_flush.c
+++ b/source4/ntvfs/posix/pvfs_flush.c
@@ -42,7 +42,8 @@ NTSTATUS pvfs_flush(struct ntvfs_module_context *ntvfs,
 		    struct ntvfs_request *req,
 		    union smb_flush *io)
 {
-	struct pvfs_state *pvfs = ntvfs->private_data;
+	struct pvfs_state *pvfs = talloc_get_type(ntvfs->private_data,
+				  struct pvfs_state);
 	struct pvfs_file *f;
 
 	switch (io->generic.level) {
diff --git a/source4/ntvfs/posix/pvfs_fsinfo.c b/source4/ntvfs/posix/pvfs_fsinfo.c
index 9a836fac32..10fb7cf707 100644
--- a/source4/ntvfs/posix/pvfs_fsinfo.c
+++ b/source4/ntvfs/posix/pvfs_fsinfo.c
@@ -85,7 +85,8 @@ NTSTATUS pvfs_fsinfo(struct ntvfs_module_context *ntvfs,
 		     struct ntvfs_request *req, union smb_fsinfo *fs)
 {
 	NTSTATUS status;
-	struct pvfs_state *pvfs = ntvfs->private_data;
+	struct pvfs_state *pvfs = talloc_get_type(ntvfs->private_data,
+				  struct pvfs_state);
 	uint64_t blocks_free, blocks_total;
 	uint_t bpunit;
 	struct stat st;
diff --git a/source4/ntvfs/posix/pvfs_ioctl.c b/source4/ntvfs/posix/pvfs_ioctl.c
index 92d3eae061..f263e9852b 100644
--- a/source4/ntvfs/posix/pvfs_ioctl.c
+++ b/source4/ntvfs/posix/pvfs_ioctl.c
@@ -38,7 +38,8 @@ static NTSTATUS pvfs_ioctl_old(struct ntvfs_module_context *ntvfs,
 static NTSTATUS pvfs_ntioctl(struct ntvfs_module_context *ntvfs,
 			     struct ntvfs_request *req, union smb_ioctl *io)
 {
-	struct pvfs_state *pvfs = ntvfs->private_data;
+	struct pvfs_state *pvfs = talloc_get_type(ntvfs->private_data,
+				  struct pvfs_state);
 	struct pvfs_file *f;
 
 	f = pvfs_find_fd(pvfs, req, io->ntioctl.in.file.ntvfs);
diff --git a/source4/ntvfs/posix/pvfs_lock.c b/source4/ntvfs/posix/pvfs_lock.c
index 2353baeff4..711c924ae3 100644
--- a/source4/ntvfs/posix/pvfs_lock.c
+++ b/source4/ntvfs/posix/pvfs_lock.c
@@ -90,7 +90,8 @@ static void pvfs_lock_async_failed(struct pvfs_state *pvfs,
 */
 static void pvfs_pending_lock_continue(void *private_data, enum pvfs_wait_notice reason)
 {
-	struct pvfs_pending_lock *pending = private_data;
+	struct pvfs_pending_lock *pending = talloc_get_type(private_data,
+					    struct pvfs_pending_lock);
 	struct pvfs_state *pvfs = pending->pvfs;
 	struct pvfs_file *f = pending->f;
 	struct ntvfs_request *req = pending->req;
@@ -277,7 +278,8 @@ static NTSTATUS pvfs_lock_cancel(struct pvfs_state *pvfs, struct ntvfs_request *
 NTSTATUS pvfs_lock(struct ntvfs_module_context *ntvfs,
 		   struct ntvfs_request *req, union smb_lock *lck)
 {
-	struct pvfs_state *pvfs = ntvfs->private_data;
+	struct pvfs_state *pvfs = talloc_get_type(ntvfs->private_data,
+				  struct pvfs_state);
 	struct pvfs_file *f;
 	struct smb_lock_entry *locks;
 	int i;
diff --git a/source4/ntvfs/posix/pvfs_mkdir.c b/source4/ntvfs/posix/pvfs_mkdir.c
index 8cc96173ad..6ec9e60955 100644
--- a/source4/ntvfs/posix/pvfs_mkdir.c
+++ b/source4/ntvfs/posix/pvfs_mkdir.c
@@ -96,7 +96,8 @@ static NTSTATUS pvfs_t2mkdir(struct pvfs_state *pvfs,
 NTSTATUS pvfs_mkdir(struct ntvfs_module_context *ntvfs,
 		    struct ntvfs_request *req, union smb_mkdir *md)
 {
-	struct pvfs_state *pvfs = ntvfs->private_data;
+	struct pvfs_state *pvfs = talloc_get_type(ntvfs->private_data,
+				  struct pvfs_state);
 	NTSTATUS status;
 	struct pvfs_filename *name;
 	mode_t mode;
@@ -153,7 +154,8 @@ NTSTATUS pvfs_mkdir(struct ntvfs_module_context *ntvfs,
 NTSTATUS pvfs_rmdir(struct ntvfs_module_context *ntvfs,
 		    struct ntvfs_request *req, struct smb_rmdir *rd)
 {
-	struct pvfs_state *pvfs = ntvfs->private_data;
+	struct pvfs_state *pvfs = talloc_get_type(ntvfs->private_data,
+				  struct pvfs_state);
 	NTSTATUS status;
 	struct pvfs_filename *name;
 
diff --git a/source4/ntvfs/posix/pvfs_open.c b/source4/ntvfs/posix/pvfs_open.c
index fe3c915576..12f50fcc97 100644
--- a/source4/ntvfs/posix/pvfs_open.c
+++ b/source4/ntvfs/posix/pvfs_open.c
@@ -868,7 +868,8 @@ struct pvfs_odb_retry {
 /* destroy a pending request */
 static int pvfs_odb_retry_destructor(struct pvfs_odb_retry *r)
 {
-	struct pvfs_state *pvfs = r->ntvfs->private_data;
+	struct pvfs_state *pvfs = talloc_get_type(r->ntvfs->private_data,
+				  struct pvfs_state);
 	if (r->odb_locking_key.data) {
 		struct odb_lock *lck;
 		lck = odb_lock(r->req, pvfs->odb_context, &r->odb_locking_key);
@@ -913,7 +914,8 @@ NTSTATUS pvfs_odb_retry_setup(struct ntvfs_module_context *ntvfs,
 					       void *private_data,
 					       enum pvfs_wait_notice reason))
 {
-	struct pvfs_state *pvfs = ntvfs->private_data;
+	struct pvfs_state *pvfs = talloc_get_type(ntvfs->private_data,
+				  struct pvfs_state);
 	struct pvfs_odb_retry *r;
 	struct pvfs_wait *wait_handle;
 	NTSTATUS status;
@@ -1039,7 +1041,8 @@ static NTSTATUS pvfs_open_deny_dos(struct ntvfs_module_context *ntvfs,
 				   struct ntvfs_request *req, union smb_open *io,
 				   struct pvfs_file *f, struct odb_lock *lck)
 {
-	struct pvfs_state *pvfs = ntvfs->private_data;
+	struct pvfs_state *pvfs = talloc_get_type(ntvfs->private_data,
+				  struct pvfs_state);
 	struct pvfs_file *f2;
 	struct pvfs_filename *name;
 	NTSTATUS status;
@@ -1120,7 +1123,8 @@ static NTSTATUS pvfs_open_setup_retry(struct ntvfs_module_context *ntvfs,
 				      struct odb_lock *lck,
 				      NTSTATUS parent_status)
 {
-	struct pvfs_state *pvfs = ntvfs->private_data;
+	struct pvfs_state *pvfs = talloc_get_type(ntvfs->private_data,
+				  struct pvfs_state);
 	NTSTATUS status;
 	struct timeval end_time;
 	struct timeval *final_timeout = NULL;
@@ -1174,7 +1178,8 @@ static NTSTATUS pvfs_open_setup_retry(struct ntvfs_module_context *ntvfs,
 NTSTATUS pvfs_open(struct ntvfs_module_context *ntvfs,
 		   struct ntvfs_request *req, union smb_open *io)
 {
-	struct pvfs_state *pvfs = ntvfs->private_data;
+	struct pvfs_state *pvfs = talloc_get_type(ntvfs->private_data,
+				  struct pvfs_state);
 	int flags = 0;
 	struct pvfs_filename *name;
 	struct pvfs_file *f;
@@ -1627,7 +1632,8 @@ NTSTATUS pvfs_open(struct ntvfs_module_context *ntvfs,
 NTSTATUS pvfs_close(struct ntvfs_module_context *ntvfs,
 		    struct ntvfs_request *req, union smb_close *io)
 {
-	struct pvfs_state *pvfs = ntvfs->private_data;
+	struct pvfs_state *pvfs = talloc_get_type(ntvfs->private_data,
+				  struct pvfs_state);
 	struct pvfs_file *f;
 
 	if (io->generic.level == RAW_CLOSE_SPLCLOSE) {
@@ -1684,7 +1690,8 @@ NTSTATUS pvfs_close(struct ntvfs_module_context *ntvfs,
 NTSTATUS pvfs_logoff(struct ntvfs_module_context *ntvfs,
 		     struct ntvfs_request *req)
 {
-	struct pvfs_state *pvfs = ntvfs->private_data;
+	struct pvfs_state *pvfs = talloc_get_type(ntvfs->private_data,
+				  struct pvfs_state);
 	struct pvfs_file *f, *next;
 
 	for (f=pvfs->files.list;f;f=next) {
@@ -1704,7 +1711,8 @@ NTSTATUS pvfs_logoff(struct ntvfs_module_context *ntvfs,
 NTSTATUS pvfs_exit(struct ntvfs_module_context *ntvfs,
 		   struct ntvfs_request *req)
 {
-	struct pvfs_state *pvfs = ntvfs->private_data;
+	struct pvfs_state *pvfs = talloc_get_type(ntvfs->private_data,
+				  struct pvfs_state);
 	struct pvfs_file *f, *next;
 
 	for (f=pvfs->files.list;f;f=next) {
diff --git a/source4/ntvfs/posix/pvfs_oplock.c b/source4/ntvfs/posix/pvfs_oplock.c
index 71add72987..e5a069addc 100644
--- a/source4/ntvfs/posix/pvfs_oplock.c
+++ b/source4/ntvfs/posix/pvfs_oplock.c
@@ -245,7 +245,8 @@ NTSTATUS pvfs_setup_oplock(struct pvfs_file *f, uint32_t oplock_granted)
 NTSTATUS pvfs_oplock_release(struct ntvfs_module_context *ntvfs,
 			     struct ntvfs_request *req, union smb_lock *lck)
 {
-	struct pvfs_state *pvfs = ntvfs->private_data;
+	struct pvfs_state *pvfs = talloc_get_type(ntvfs->private_data,
+				  struct pvfs_state);
 	struct pvfs_file *f;
 	uint8_t oplock_break;
 	NTSTATUS status;
diff --git a/source4/ntvfs/posix/pvfs_qfileinfo.c b/source4/ntvfs/posix/pvfs_qfileinfo.c
index 3196cf2f8d..bfc9a8441c 100644
--- a/source4/ntvfs/posix/pvfs_qfileinfo.c
+++ b/source4/ntvfs/posix/pvfs_qfileinfo.c
@@ -338,7 +338,8 @@ static NTSTATUS pvfs_map_fileinfo(struct pvfs_state *pvfs,
 NTSTATUS pvfs_qpathinfo(struct ntvfs_module_context *ntvfs,
 		        struct ntvfs_request *req, union smb_fileinfo *info)
 {
-	struct pvfs_state *pvfs = ntvfs->private_data;
+	struct pvfs_state *pvfs = talloc_get_type(ntvfs->private_data,
+				  struct pvfs_state);
 	struct pvfs_filename *name;
 	NTSTATUS status;
 
@@ -374,7 +375,8 @@ NTSTATUS pvfs_qpathinfo(struct ntvfs_module_context *ntvfs,
 NTSTATUS pvfs_qfileinfo(struct ntvfs_module_context *ntvfs,
 		        struct ntvfs_request *req, union smb_fileinfo *info)
 {
-	struct pvfs_state *pvfs = ntvfs->private_data;
+	struct pvfs_state *pvfs = talloc_get_type(ntvfs->private_data,
+				  struct pvfs_state);
 	struct pvfs_file *f;
 	struct pvfs_file_handle *h;
 	NTSTATUS status;
diff --git a/source4/ntvfs/posix/pvfs_read.c b/source4/ntvfs/posix/pvfs_read.c
index 8e1a59473f..d9080d632d 100644
--- a/source4/ntvfs/posix/pvfs_read.c
+++ b/source4/ntvfs/posix/pvfs_read.c
@@ -29,7 +29,8 @@
 NTSTATUS pvfs_read(struct ntvfs_module_context *ntvfs,
 		   struct ntvfs_request *req, union smb_read *rd)
 {
-	struct pvfs_state *pvfs = ntvfs->private_data;
+	struct pvfs_state *pvfs = talloc_get_type(ntvfs->private_data,
+				  struct pvfs_state);
 	ssize_t ret;
 	struct pvfs_file *f;
 	NTSTATUS status;
diff --git a/source4/ntvfs/posix/pvfs_rename.c b/source4/ntvfs/posix/pvfs_rename.c
index ed90bf3d7b..7f8eab5aa0 100644
--- a/source4/ntvfs/posix/pvfs_rename.c
+++ b/source4/ntvfs/posix/pvfs_rename.c
@@ -103,7 +103,7 @@ static const char *pvfs_resolve_wildcard_component(TALLOC_CTX *mem_ctx,
 	char *dest, *d;
 
 	/* the length is bounded by the length of the two strings combined */
-	dest = talloc_size(mem_ctx, strlen(fname) + strlen(pattern) + 1);
+	dest = talloc_array(mem_ctx, char, strlen(fname) + strlen(pattern) + 1);
 	if (dest == NULL) {
 		return NULL;
 	}
@@ -133,6 +133,8 @@ static const char *pvfs_resolve_wildcard_component(TALLOC_CTX *mem_ctx,
 
 	*d = 0;
 
+	talloc_set_name_const(dest, dest);
+
 	return dest;
 }
 
@@ -247,7 +249,8 @@ static NTSTATUS pvfs_rename_setup_retry(struct ntvfs_module_context *ntvfs,
 					struct odb_lock *lck,
 					NTSTATUS status)
 {
-	struct pvfs_state *pvfs = ntvfs->private_data;
+	struct pvfs_state *pvfs = talloc_get_type(ntvfs->private_data,
+				  struct pvfs_state);
 	struct timeval end_time;
 
 	if (NT_STATUS_EQUAL(status, NT_STATUS_SHARING_VIOLATION)) {
@@ -393,7 +396,8 @@ static NTSTATUS pvfs_rename_wildcard(struct pvfs_state *pvfs,
 static NTSTATUS pvfs_rename_mv(struct ntvfs_module_context *ntvfs,
 			       struct ntvfs_request *req, union smb_rename *ren)
 {
-	struct pvfs_state *pvfs = ntvfs->private_data;
+	struct pvfs_state *pvfs = talloc_get_type(ntvfs->private_data,
+				  struct pvfs_state);
 	NTSTATUS status;
 	struct pvfs_filename *name1, *name2;
 	struct odb_lock *lck = NULL;
@@ -470,7 +474,8 @@ static NTSTATUS pvfs_rename_stream(struct ntvfs_module_context *ntvfs,
 				   struct ntvfs_request *req, union smb_rename *ren,
 				   struct pvfs_filename *name1)
 {
-	struct pvfs_state *pvfs = ntvfs->private_data;
+	struct pvfs_state *pvfs = talloc_get_type(ntvfs->private_data,
+				  struct pvfs_state);
 	NTSTATUS status;
 	struct odb_lock *lck = NULL;
 
@@ -522,7 +527,8 @@ static NTSTATUS pvfs_rename_stream(struct ntvfs_module_context *ntvfs,
 static NTSTATUS pvfs_rename_nt(struct ntvfs_module_context *ntvfs,
 			       struct ntvfs_request *req, union smb_rename *ren)
 {
-	struct pvfs_state *pvfs = ntvfs->private_data;
+	struct pvfs_state *pvfs = talloc_get_type(ntvfs->private_data,
+				  struct pvfs_state);
 	NTSTATUS status;
 	struct pvfs_filename *name1, *name2;
 	struct odb_lock *lck = NULL;
@@ -630,7 +636,8 @@ static NTSTATUS pvfs_rename_nt(struct ntvfs_module_context *ntvfs,
 NTSTATUS pvfs_rename(struct ntvfs_module_context *ntvfs,
 		     struct ntvfs_request *req, union smb_rename *ren)
 {
-	struct pvfs_state *pvfs = ntvfs->private_data;
+	struct pvfs_state *pvfs = talloc_get_type(ntvfs->private_data,
+				  struct pvfs_state);
 	struct pvfs_file *f;
 
 	switch (ren->generic.level) {
diff --git a/source4/ntvfs/posix/pvfs_resolve.c b/source4/ntvfs/posix/pvfs_resolve.c
index 43547c275b..c33323350e 100644
--- a/source4/ntvfs/posix/pvfs_resolve.c
+++ b/source4/ntvfs/posix/pvfs_resolve.c
@@ -464,7 +464,7 @@ static NTSTATUS pvfs_reduce_name(TALLOC_CTX *mem_ctx,
 	}
 
 	/* rebuild the name */
-	ret = talloc_size(mem_ctx, len+1);
+	ret = talloc_array(mem_ctx, char, len+1);
 	if (ret == NULL) {
 		talloc_free(s);
 		return NT_STATUS_NO_MEMORY;
@@ -478,6 +478,8 @@ static NTSTATUS pvfs_reduce_name(TALLOC_CTX *mem_ctx,
 	}	
 	ret[len] = 0;
 
+	talloc_set_name_const(ret, ret);
+
 	talloc_free(s);
 
 	*fname = ret;
diff --git a/source4/ntvfs/posix/pvfs_search.c b/source4/ntvfs/posix/pvfs_search.c
index 22aa297210..dc4f86b4d2 100644
--- a/source4/ntvfs/posix/pvfs_search.c
+++ b/source4/ntvfs/posix/pvfs_search.c
@@ -294,8 +294,12 @@ static void pvfs_search_cleanup(struct pvfs_state *pvfs)
 	time_t t = time(NULL);
 
 	for (i=0;i<MAX_OLD_SEARCHES;i++) {
-		struct pvfs_search_state *search = idr_find(pvfs->search.idtree, i);
-		if (search == NULL) return;
+		struct pvfs_search_state *search;
+		void *p = idr_find(pvfs->search.idtree, i);
+
+		if (p == NULL) return;
+
+		search = talloc_get_type(p, struct pvfs_search_state);
 		if (pvfs_list_eos(search->dir, search->current_index) &&
 		    search->last_used != 0 &&
 		    t > search->last_used + 30) {
@@ -316,7 +320,8 @@ static NTSTATUS pvfs_search_first_old(struct ntvfs_module_context *ntvfs,
 				      bool (*callback)(void *, const union smb_search_data *))
 {
 	struct pvfs_dir *dir;
-	struct pvfs_state *pvfs = ntvfs->private_data;
+	struct pvfs_state *pvfs = talloc_get_type(ntvfs->private_data,
+				  struct pvfs_state);
 	struct pvfs_search_state *search;
 	uint_t reply_count;
 	uint16_t search_attrib;
@@ -405,7 +410,9 @@ static NTSTATUS pvfs_search_next_old(struct ntvfs_module_context *ntvfs,
 				     void *search_private, 
 				     bool (*callback)(void *, const union smb_search_data *))
 {
-	struct pvfs_state *pvfs = ntvfs->private_data;
+	struct pvfs_state *pvfs = talloc_get_type(ntvfs->private_data,
+				  struct pvfs_state);
+	void *p;
 	struct pvfs_search_state *search;
 	struct pvfs_dir *dir;
 	uint_t reply_count, max_count;
@@ -415,12 +422,14 @@ static NTSTATUS pvfs_search_next_old(struct ntvfs_module_context *ntvfs,
 	handle    = io->search_next.in.id.handle | (io->search_next.in.id.reserved<<8);
 	max_count = io->search_next.in.max_count;
 
-	search = idr_find(pvfs->search.idtree, handle);
-	if (search == NULL) {
+	p = idr_find(pvfs->search.idtree, handle);
+	if (p == NULL) {
 		/* we didn't find the search handle */
 		return NT_STATUS_INVALID_HANDLE;
 	}
 
+	search = talloc_get_type(p, struct pvfs_search_state);
+
 	dir = search->dir;
 
 	status = pvfs_list_seek_ofs(dir, io->search_next.in.id.server_cookie, 
@@ -455,7 +464,8 @@ static NTSTATUS pvfs_search_first_trans2(struct ntvfs_module_context *ntvfs,
 					 bool (*callback)(void *, const union smb_search_data *))
 {
 	struct pvfs_dir *dir;
-	struct pvfs_state *pvfs = ntvfs->private_data;
+	struct pvfs_state *pvfs = talloc_get_type(ntvfs->private_data,
+				  struct pvfs_state);
 	struct pvfs_search_state *search;
 	uint_t reply_count;
 	uint16_t search_attrib, max_count;
@@ -550,7 +560,9 @@ static NTSTATUS pvfs_search_next_trans2(struct ntvfs_module_context *ntvfs,
 					void *search_private, 
 					bool (*callback)(void *, const union smb_search_data *))
 {
-	struct pvfs_state *pvfs = ntvfs->private_data;
+	struct pvfs_state *pvfs = talloc_get_type(ntvfs->private_data,
+				  struct pvfs_state);
+	void *p;
 	struct pvfs_search_state *search;
 	struct pvfs_dir *dir;
 	uint_t reply_count;
@@ -559,12 +571,14 @@ static NTSTATUS pvfs_search_next_trans2(struct ntvfs_module_context *ntvfs,
 
 	handle = io->t2fnext.in.handle;
 
-	search = idr_find(pvfs->search.idtree, handle);
-	if (search == NULL) {
+	p = idr_find(pvfs->search.idtree, handle);
+	if (p == NULL) {
 		/* we didn't find the search handle */
 		return NT_STATUS_INVALID_HANDLE;
 	}
-	
+
+	search = talloc_get_type(p, struct pvfs_search_state);
+
 	dir = search->dir;
 	
 	status = NT_STATUS_OK;
@@ -612,7 +626,8 @@ static NTSTATUS pvfs_search_first_smb2(struct ntvfs_module_context *ntvfs,
 				       bool (*callback)(void *, const union smb_search_data *))
 {
 	struct pvfs_dir *dir;
-	struct pvfs_state *pvfs = ntvfs->private_data;
+	struct pvfs_state *pvfs = talloc_get_type(ntvfs->private_data,
+				  struct pvfs_state);
 	struct pvfs_search_state *search;
 	uint_t reply_count;
 	uint16_t max_count;
@@ -714,7 +729,8 @@ static NTSTATUS pvfs_search_next_smb2(struct ntvfs_module_context *ntvfs,
 				      void *search_private, 
 				      bool (*callback)(void *, const union smb_search_data *))
 {
-	struct pvfs_state *pvfs = ntvfs->private_data;
+	struct pvfs_state *pvfs = talloc_get_type(ntvfs->private_data,
+				  struct pvfs_state);
 	struct pvfs_search_state *search;
 	uint_t reply_count;
 	uint16_t max_count;
@@ -812,7 +828,9 @@ NTSTATUS pvfs_search_next(struct ntvfs_module_context *ntvfs,
 NTSTATUS pvfs_search_close(struct ntvfs_module_context *ntvfs,
 			   struct ntvfs_request *req, union smb_search_close *io)
 {
-	struct pvfs_state *pvfs = ntvfs->private_data;
+	struct pvfs_state *pvfs = talloc_get_type(ntvfs->private_data,
+				  struct pvfs_state);
+	void *p;
 	struct pvfs_search_state *search;
 	uint16_t handle = INVALID_SEARCH_HANDLE;
 
@@ -829,12 +847,14 @@ NTSTATUS pvfs_search_close(struct ntvfs_module_context *ntvfs,
 		break;
 	}
 
-	search = idr_find(pvfs->search.idtree, handle);
-	if (search == NULL) {
+	p = idr_find(pvfs->search.idtree, handle);
+	if (p == NULL) {
 		/* we didn't find the search handle */
 		return NT_STATUS_INVALID_HANDLE;
 	}
 
+	search = talloc_get_type(p, struct pvfs_search_state);
+
 	talloc_free(search);
 
 	return NT_STATUS_OK;
diff --git a/source4/ntvfs/posix/pvfs_seek.c b/source4/ntvfs/posix/pvfs_seek.c
index a3c4024ed7..2cd3410876 100644
--- a/source4/ntvfs/posix/pvfs_seek.c
+++ b/source4/ntvfs/posix/pvfs_seek.c
@@ -29,7 +29,8 @@ NTSTATUS pvfs_seek(struct ntvfs_module_context *ntvfs,
 		   struct ntvfs_request *req,
 		   union smb_seek *io)
 {
-	struct pvfs_state *pvfs = ntvfs->private_data;
+	struct pvfs_state *pvfs = talloc_get_type(ntvfs->private_data,
+				  struct pvfs_state);
 	struct pvfs_file *f;
 	struct pvfs_file_handle *h;
 	NTSTATUS status;
diff --git a/source4/ntvfs/posix/pvfs_setfileinfo.c b/source4/ntvfs/posix/pvfs_setfileinfo.c
index d2604485d4..9fe02a8e17 100644
--- a/source4/ntvfs/posix/pvfs_setfileinfo.c
+++ b/source4/ntvfs/posix/pvfs_setfileinfo.c
@@ -308,7 +308,8 @@ NTSTATUS pvfs_setfileinfo(struct ntvfs_module_context *ntvfs,
 			  struct ntvfs_request *req, 
 			  union smb_setfileinfo *info)
 {
-	struct pvfs_state *pvfs = ntvfs->private_data;
+	struct pvfs_state *pvfs = talloc_get_type(ntvfs->private_data,
+				  struct pvfs_state);
 	struct pvfs_file *f;
 	struct pvfs_file_handle *h;
 	struct pvfs_filename newstats;
@@ -609,7 +610,8 @@ static NTSTATUS pvfs_setpathinfo_setup_retry(struct ntvfs_module_context *ntvfs,
 					     struct odb_lock *lck,
 					     NTSTATUS status)
 {
-	struct pvfs_state *pvfs = ntvfs->private_data;
+	struct pvfs_state *pvfs = talloc_get_type(ntvfs->private_data,
+				  struct pvfs_state);
 	struct timeval end_time;
 
 	if (NT_STATUS_EQUAL(status, NT_STATUS_SHARING_VIOLATION)) {
@@ -632,7 +634,8 @@ static NTSTATUS pvfs_setpathinfo_setup_retry(struct ntvfs_module_context *ntvfs,
 NTSTATUS pvfs_setpathinfo(struct ntvfs_module_context *ntvfs,
 			  struct ntvfs_request *req, union smb_setfileinfo *info)
 {
-	struct pvfs_state *pvfs = ntvfs->private_data;
+	struct pvfs_state *pvfs = talloc_get_type(ntvfs->private_data,
+				  struct pvfs_state);
 	struct pvfs_filename *name;
 	struct pvfs_filename newstats;
 	NTSTATUS status;
diff --git a/source4/ntvfs/posix/pvfs_unlink.c b/source4/ntvfs/posix/pvfs_unlink.c
index 6a57041770..e10b2e3eef 100644
--- a/source4/ntvfs/posix/pvfs_unlink.c
+++ b/source4/ntvfs/posix/pvfs_unlink.c
@@ -84,7 +84,8 @@ static NTSTATUS pvfs_unlink_setup_retry(struct ntvfs_module_context *ntvfs,
 					struct odb_lock *lck,
 					NTSTATUS status)
 {
-	struct pvfs_state *pvfs = ntvfs->private_data;
+	struct pvfs_state *pvfs = talloc_get_type(ntvfs->private_data,
+				  struct pvfs_state);
 	struct timeval end_time;
 
 	if (NT_STATUS_EQUAL(status, NT_STATUS_SHARING_VIOLATION)) {
@@ -191,7 +192,8 @@ NTSTATUS pvfs_unlink(struct ntvfs_module_context *ntvfs,
 		     struct ntvfs_request *req,
 		     union smb_unlink *unl)
 {
-	struct pvfs_state *pvfs = ntvfs->private_data;
+	struct pvfs_state *pvfs = talloc_get_type(ntvfs->private_data,
+				  struct pvfs_state);
 	struct pvfs_dir *dir;
 	NTSTATUS status;
 	uint32_t total_deleted=0;
diff --git a/source4/ntvfs/posix/pvfs_util.c b/source4/ntvfs/posix/pvfs_util.c
index 09913bc911..81ff20a608 100644
--- a/source4/ntvfs/posix/pvfs_util.c
+++ b/source4/ntvfs/posix/pvfs_util.c
@@ -93,7 +93,7 @@ NTSTATUS pvfs_copy_file(struct pvfs_state *pvfs,
 	mode_t mode;
 	NTSTATUS status;
 	size_t buf_size = 0x10000;
-	char *buf = talloc_size(name2, buf_size);
+	uint8_t *buf = talloc_array(name2, uint8_t, buf_size);
 
 	if (buf == NULL) {
 		return NT_STATUS_NO_MEMORY;
diff --git a/source4/ntvfs/posix/pvfs_wait.c b/source4/ntvfs/posix/pvfs_wait.c
index d396b94da1..5552ab0d1b 100644
--- a/source4/ntvfs/posix/pvfs_wait.c
+++ b/source4/ntvfs/posix/pvfs_wait.c
@@ -78,13 +78,12 @@ static void pvfs_wait_dispatch(struct messaging_context *msg,
 	}
 
 	pwait->reason = PVFS_WAIT_EVENT;
-	req = pwait->req;
 
 	/* the extra reference here is to ensure that the req
 	   structure is not destroyed when the async request reply is
 	   sent, which would cause problems with the other ntvfs
 	   modules above us */
-	talloc_reference(msg, req);
+	req = talloc_reference(msg, pwait->req);
 	ntvfs_async_setup(pwait->req, pwait);
 	talloc_unlink(msg, req);
 }
@@ -185,7 +184,8 @@ struct pvfs_wait *pvfs_wait_message(struct pvfs_state *pvfs,
 */
 NTSTATUS pvfs_cancel(struct ntvfs_module_context *ntvfs, struct ntvfs_request *req)
 {
-	struct pvfs_state *pvfs = ntvfs->private_data;
+	struct pvfs_state *pvfs = talloc_get_type(ntvfs->private_data,
+				  struct pvfs_state);
 	struct pvfs_wait *pwait;
 
 	for (pwait=pvfs->wait_list;pwait;pwait=pwait->next) {
diff --git a/source4/ntvfs/posix/pvfs_write.c b/source4/ntvfs/posix/pvfs_write.c
index ba505e61d7..fb629a87fb 100644
--- a/source4/ntvfs/posix/pvfs_write.c
+++ b/source4/ntvfs/posix/pvfs_write.c
@@ -83,7 +83,8 @@ static void pvfs_trigger_write_time_update(struct pvfs_file_handle *h)
 NTSTATUS pvfs_write(struct ntvfs_module_context *ntvfs,
 		    struct ntvfs_request *req, union smb_write *wr)
 {
-	struct pvfs_state *pvfs = ntvfs->private_data;
+	struct pvfs_state *pvfs = talloc_get_type(ntvfs->private_data,
+				  struct pvfs_state);
 	ssize_t ret;
 	struct pvfs_file *f;
 	NTSTATUS status;
diff --git a/source4/ntvfs/posix/vfs_posix.c b/source4/ntvfs/posix/vfs_posix.c
index 6b0f32e65a..29ef701dee 100644
--- a/source4/ntvfs/posix/vfs_posix.c
+++ b/source4/ntvfs/posix/vfs_posix.c
@@ -274,7 +274,8 @@ static NTSTATUS pvfs_chkpath(struct ntvfs_module_context *ntvfs,
 			     struct ntvfs_request *req,
 			     union smb_chkpath *cp)
 {
-	struct pvfs_state *pvfs = ntvfs->private_data;
+	struct pvfs_state *pvfs = talloc_get_type(ntvfs->private_data,
+				  struct pvfs_state);
 	struct pvfs_filename *name;
 	NTSTATUS status;