s->sock is assigned only afterwards, so we're really registering an
aio_fd_handler for file descriptor 0 here. Not exactly what we intended.
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
     /* Now that we're connected, set the socket to be non-blocking and
      * kick the reply mechanism.  */
     socket_set_nonblock(sock);
-    qemu_aio_set_fd_handler(s->sock, nbd_reply_ready, NULL,
+    qemu_aio_set_fd_handler(sock, nbd_reply_ready, NULL,
                             nbd_have_request, s);
 
     s->sock = sock;