From: NeilBrown If nlm_lookup_host finds what it is looking for it exits with an extra reference on the matching 'nsm' structure. So don't actually count the reference until we are (fairly) sure it is going to be used. Signed-off-by: Neil Brown Signed-off-by: Andrew Morton --- fs/lockd/host.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff -puN fs/lockd/host.c~knfsd-lockd-fix-refount-on-nsm fs/lockd/host.c --- a/fs/lockd/host.c~knfsd-lockd-fix-refount-on-nsm +++ a/fs/lockd/host.c @@ -103,8 +103,8 @@ nlm_lookup_host(int server, const struct continue; /* See if we have an NSM handle for this client */ - if (!nsm && (nsm = host->h_nsmhandle) != 0) - atomic_inc(&nsm->sm_count); + if (!nsm) + nsm = host->h_nsmhandle; if (host->h_proto != proto) continue; @@ -120,6 +120,8 @@ nlm_lookup_host(int server, const struct nlm_get_host(host); goto out; } + if (nsm) + atomic_inc(&nsm->sm_count); host = NULL; _