--- /dev/null
+From a6ab1e8126d205238defbb55d23661a3a5c6a0d8 Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb@suse.com>
+Date: Fri, 4 Mar 2016 17:20:13 +1100
+Subject: sunrpc/cache: drop reference when sunrpc_cache_pipe_upcall() detects a race
+
+From: NeilBrown <neilb@suse.com>
+
+commit a6ab1e8126d205238defbb55d23661a3a5c6a0d8 upstream.
+
+sunrpc_cache_pipe_upcall() can detect a race if CACHE_PENDING is no longer
+set. In this case it aborts the queuing of the upcall.
+However it has already taken a new counted reference on "h" and
+doesn't "put" it, even though it frees the data structure holding the reference.
+
+So let's delay the "cache_get" until we know we need it.
+
+Fixes: f9e1aedc6c79 ("sunrpc/cache: remove races with queuing an upcall.")
+Signed-off-by: NeilBrown <neilb@suse.com>
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/sunrpc/cache.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/net/sunrpc/cache.c
++++ b/net/sunrpc/cache.c
+@@ -1187,14 +1187,14 @@ int sunrpc_cache_pipe_upcall(struct cach
+ }
+
+ crq->q.reader = 0;
+- crq->item = cache_get(h);
+ crq->buf = buf;
+ crq->len = 0;
+ crq->readers = 0;
+ spin_lock(&queue_lock);
+- if (test_bit(CACHE_PENDING, &h->flags))
++ if (test_bit(CACHE_PENDING, &h->flags)) {
++ crq->item = cache_get(h);
+ list_add_tail(&crq->q.list, &detail->queue);
+- else
++ } else
+ /* Lost a race, no longer PENDING, so don't enqueue */
+ ret = -EAGAIN;
+ spin_unlock(&queue_lock);