nfsd4: fix delegation recall race use-after-free

[net-next-2.6.git] / fs / nfsd / nfs4callback.c

diff --git a/fs/nfsd/nfs4callback.c b/fs/nfsd/nfs4callback.c
index a4686326b5aef4b538088dd7973246e9307aa55c..1e6497ed3e1219c4db2abcf07f0c380ab4b4007a 100644 (file)
--- a/fs/nfsd/nfs4callback.c
+++ b/fs/nfsd/nfs4callback.c
@@ -689,6 +689,7 @@ static void nfsd4_cb_recall_done(struct rpc_task *task, void *calldata)
                warn_no_callback_path(clp, task->tk_status);
                if (current_rpc_client != task->tk_client) {
                        /* queue a callback on the new connection: */
+                       atomic_inc(&dp->dl_count);
                        nfsd4_cb_recall(dp);
                        return;
                }