1 files changed, 6 insertions, 5 deletions

diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
index ab86b7927f84..bd31208bbb61 100644
--- a/net/sunrpc/svc_xprt.c
+++ b/net/sunrpc/svc_xprt.c
@@ -902,12 +902,13 @@ void svc_delete_xprt(struct svc_xprt *xprt)
         if (!test_and_set_bit(XPT_DETACHED, &xprt->xpt_flags))
                 list_del_init(&xprt->xpt_list);
         /*
-         * We used to delete the transport from whichever list
-         * it's sk_xprt.xpt_ready node was on, but we don't actually
-         * need to.  This is because the only time we're called
-         * while still attached to a queue, the queue itself
-         * is about to be destroyed (in svc_destroy).
+         * The only time we're called while xpt_ready is still on a list
+         * is while the list itself is about to be destroyed (in
+         * svc_destroy).  BUT svc_xprt_enqueue could still be attempting
+         * to add new entries to the sp_sockets list, so we can't leave
+         * a freed xprt on it.
          */
+        list_del_init(&xprt->xpt_ready);
         if (test_bit(XPT_TEMP, &xprt->xpt_flags))
                 serv->sv_tmpcnt--;
         spin_unlock_bh(&serv->sv_lock);