set_bit(NFSD4_CLIENT_CB_KILL, &clp->cl_flags);
        /*
         * Note this won't actually result in a null callback;
-        * instead, nfsd4_do_callback_rpc() will detect the killed
+        * instead, nfsd4_run_cb_null() will detect the killed
         * client, destroy the rpc client, and stop:
         */
        do_probe_callback(clp);
                run_nfsd4_cb(cb);
 }
 
-void
-nfsd4_do_callback_rpc(struct work_struct *w)
+static void
+nfsd4_run_callback_rpc(struct nfsd4_callback *cb)
 {
-       struct nfsd4_callback *cb = container_of(w, struct nfsd4_callback, cb_work);
        struct nfs4_client *clp = cb->cb_clp;
        struct rpc_clnt *clnt;
 
                        cb->cb_ops, cb);
 }
 
+void
+nfsd4_run_cb_null(struct work_struct *w)
+{
+       struct nfsd4_callback *cb = container_of(w, struct nfsd4_callback,
+                                                       cb_work);
+       nfsd4_run_callback_rpc(cb);
+}
+
+void
+nfsd4_run_cb_recall(struct work_struct *w)
+{
+       struct nfsd4_callback *cb = container_of(w, struct nfsd4_callback,
+                                                       cb_work);
+
+       nfsd4_prepare_cb_recall(cb->cb_op);
+       nfsd4_run_callback_rpc(cb);
+}
+
 void nfsd4_cb_recall(struct nfs4_delegation *dp)
 {
        struct nfsd4_callback *cb = &dp->dl_recall;
 
 static inline void
 put_nfs4_file(struct nfs4_file *fi)
 {
+       might_lock(&state_lock);
+
        if (atomic_dec_and_lock(&fi->fi_ref, &state_lock)) {
                hlist_del(&fi->fi_hash);
                spin_unlock(&state_lock);
        u32 hash;
        struct bloom_pair *bd = &blocked_delegations;
 
+       lockdep_assert_held(&state_lock);
+
        hash = arch_fast_hash(&fh->fh_base, fh->fh_size, 0);
 
        __set_bit(hash&255, bd->set[bd->new]);
        fh_copy_shallow(&dp->dl_fh, ¤t_fh->fh_handle);
        dp->dl_time = 0;
        atomic_set(&dp->dl_count, 1);
-       INIT_WORK(&dp->dl_recall.cb_work, nfsd4_do_callback_rpc);
+       INIT_WORK(&dp->dl_recall.cb_work, nfsd4_run_cb_recall);
        return dp;
 }
 
        lockdep_assert_held(&state_lock);
 
        dp->dl_stid.sc_type = NFS4_DELEG_STID;
+       spin_lock(&fp->fi_lock);
        list_add(&dp->dl_perfile, &fp->fi_delegations);
+       spin_unlock(&fp->fi_lock);
        list_add(&dp->dl_perclnt, &dp->dl_stid.sc_client->cl_delegations);
 }
 
 static void
 unhash_delegation(struct nfs4_delegation *dp)
 {
+       struct nfs4_file *fp = dp->dl_file;
+
        spin_lock(&state_lock);
        list_del_init(&dp->dl_perclnt);
-       list_del_init(&dp->dl_perfile);
        list_del_init(&dp->dl_recall_lru);
+       spin_lock(&fp->fi_lock);
+       list_del_init(&dp->dl_perfile);
+       spin_unlock(&fp->fi_lock);
        spin_unlock(&state_lock);
-       if (dp->dl_file) {
-               nfs4_put_deleg_lease(dp->dl_file);
-               put_nfs4_file(dp->dl_file);
+       if (fp) {
+               nfs4_put_deleg_lease(fp);
+               put_nfs4_file(fp);
                dp->dl_file = NULL;
        }
 }
                spin_unlock(&nn->client_lock);
                return NULL;
        }
-       INIT_WORK(&clp->cl_cb_null.cb_work, nfsd4_do_callback_rpc);
+       INIT_WORK(&clp->cl_cb_null.cb_work, nfsd4_run_cb_null);
        clp->cl_time = get_seconds();
        clear_bit(0, &clp->cl_cb_slot_busy);
        copy_verf(clp, verf);
        return ret;
 }
 
-static void nfsd_break_one_deleg(struct nfs4_delegation *dp)
+void nfsd4_prepare_cb_recall(struct nfs4_delegation *dp)
 {
        struct nfs4_client *clp = dp->dl_stid.sc_client;
        struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
 
-       lockdep_assert_held(&state_lock);
-       /* We're assuming the state code never drops its reference
-        * without first removing the lease.  Since we're in this lease
-        * callback (and since the lease code is serialized by the kernel
-        * lock) we know the server hasn't removed the lease yet, we know
-        * it's safe to take a reference: */
-       atomic_inc(&dp->dl_count);
-
+       /*
+        * We can't do this in nfsd_break_deleg_cb because it is
+        * already holding inode->i_lock
+        */
+       spin_lock(&state_lock);
+       block_delegations(&dp->dl_fh);
        /*
         * If the dl_time != 0, then we know that it has already been
         * queued for a lease break. Don't queue it again.
         */
        if (dp->dl_time == 0) {
-               list_add_tail(&dp->dl_recall_lru, &nn->del_recall_lru);
                dp->dl_time = get_seconds();
+               list_add_tail(&dp->dl_recall_lru, &nn->del_recall_lru);
        }
+       spin_unlock(&state_lock);
+}
 
-       block_delegations(&dp->dl_fh);
-
+static void nfsd_break_one_deleg(struct nfs4_delegation *dp)
+{
+       /*
+        * We're assuming the state code never drops its reference
+        * without first removing the lease.  Since we're in this lease
+        * callback (and since the lease code is serialized by the kernel
+        * lock) we know the server hasn't removed the lease yet, we know
+        * it's safe to take a reference.
+        */
+       atomic_inc(&dp->dl_count);
        nfsd4_cb_recall(dp);
 }
 
         */
        fl->fl_break_time = 0;
 
-       spin_lock(&state_lock);
        fp->fi_had_conflict = true;
+       spin_lock(&fp->fi_lock);
        list_for_each_entry(dp, &fp->fi_delegations, dl_perfile)
                nfsd_break_one_deleg(dp);
-       spin_unlock(&state_lock);
+       spin_unlock(&fp->fi_lock);
 }
 
 static
 
 extern __be32 nfs4_check_open_reclaim(clientid_t *clid,
                struct nfsd4_compound_state *cstate, struct nfsd_net *nn);
 extern int set_callback_cred(void);
-void nfsd4_do_callback_rpc(struct work_struct *w);
+void nfsd4_run_cb_null(struct work_struct *w);
+void nfsd4_run_cb_recall(struct work_struct *w);
 extern void nfsd4_probe_callback(struct nfs4_client *clp);
 extern void nfsd4_probe_callback_sync(struct nfs4_client *clp);
 extern void nfsd4_change_callback(struct nfs4_client *clp, struct nfs4_cb_conn *);
 extern int nfsd4_create_callback_queue(void);
 extern void nfsd4_destroy_callback_queue(void);
 extern void nfsd4_shutdown_callback(struct nfs4_client *);
+extern void nfsd4_prepare_cb_recall(struct nfs4_delegation *dp);
 extern void nfs4_put_delegation(struct nfs4_delegation *dp);
 extern struct nfs4_client_reclaim *nfs4_client_to_reclaim(const char *name,
                                                        struct nfsd_net *nn);