---

yaml
---
r: 259047
b: refs/heads/master
c: ebc63e5
h: refs/heads/master
i:
  259045: 3dc8f45
  259043: b7c71d0
  259039: c698e0e
v: v3

[refs]

@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 058c5c99999609e3de7e15b49049665f02d06577
+refs/heads/master: ebc63e531cc6a457595dd110b07ac530eae788c3

trunk/net/sunrpc/svc_xprt.c

@@ -902,12 +902,13 @@ void svc_delete_xprt(struct svc_xprt *xprt)
 	if (!test_and_set_bit(XPT_DETACHED, &xprt->xpt_flags))
 		list_del_init(&xprt->xpt_list);
 	/*
-	 * We used to delete the transport from whichever list
-	 * it's sk_xprt.xpt_ready node was on, but we don't actually
-	 * need to.  This is because the only time we're called
-	 * while still attached to a queue, the queue itself
-	 * is about to be destroyed (in svc_destroy).
+	 * The only time we're called while xpt_ready is still on a list
+	 * is while the list itself is about to be destroyed (in
+	 * svc_destroy).  BUT svc_xprt_enqueue could still be attempting
+	 * to add new entries to the sp_sockets list, so we can't leave
+	 * a freed xprt on it.
 	 */
+	list_del_init(&xprt->xpt_ready);
 	if (test_bit(XPT_TEMP, &xprt->xpt_flags))
 		serv->sv_tmpcnt--;
 	spin_unlock_bh(&serv->sv_lock);