diff --git a/fs/nfs/nfs4file.c b/fs/nfs/nfs4file.c
index 6401f6363f75..9a434f5dda8d 100644
--- a/fs/nfs/nfs4file.c
+++ b/fs/nfs/nfs4file.c
@@ -402,6 +402,7 @@ static void __nfs42_ssc_close(struct file *filep)
 }
 
 static const struct nfs4_ssc_client_ops nfs4_ssc_clnt_ops_tbl = {
+	.owner = THIS_MODULE,
 	.sco_open = __nfs42_ssc_open,
 	.sco_close = __nfs42_ssc_close,
 };
diff --git a/fs/nfs_common/nfs_ssc.c b/fs/nfs_common/nfs_ssc.c
index a8e79ec68701..ef158008b803 100644
--- a/fs/nfs_common/nfs_ssc.c
+++ b/fs/nfs_common/nfs_ssc.c
@@ -13,7 +13,7 @@
 #include "../nfs/nfs4_fs.h"
 
 struct nfs_ssc_client_ops_tbl {
-	const struct nfs4_ssc_client_ops *ssc_nfs4_ops;
+	const struct nfs4_ssc_client_ops __rcu *ssc_nfs4_ops;
 };
 
 static struct nfs_ssc_client_ops_tbl nfs_ssc_client_tbl __read_mostly;
@@ -38,10 +38,24 @@ struct file *nfsd42_ssc_open(struct vfsmount *ss_mnt, struct nfs_fh *src_fh,
 	 * source file cannot be opened, so callers get -EIO.
 	 */
 #if IS_ENABLED(CONFIG_NFSD_V4_2_INTER_SSC)
-	const struct nfs4_ssc_client_ops *ops = nfs_ssc_client_tbl.ssc_nfs4_ops;
+	const struct nfs4_ssc_client_ops *ops;
+	struct file *res;
 
-	if (ops)
-		return ops->sco_open(ss_mnt, src_fh, stateid);
+	/*
+	 * sco_open() sleeps and must not run inside an RCU read-side
+	 * section. Pin the provider module so the open runs with the
+	 * module held; try_module_get() fails once unregister begins,
+	 * and the copy then gets -EIO.
+	 */
+	rcu_read_lock();
+	ops = rcu_dereference(nfs_ssc_client_tbl.ssc_nfs4_ops);
+	if (ops && try_module_get(ops->owner)) {
+		rcu_read_unlock();
+		res = ops->sco_open(ss_mnt, src_fh, stateid);
+		module_put(ops->owner);
+		return res;
+	}
+	rcu_read_unlock();
 #endif
 
 	return ERR_PTR(-EIO);
@@ -53,17 +67,21 @@ EXPORT_SYMBOL_GPL(nfsd42_ssc_open);
  * @filp: struct file to be closed
  *
  * The real cleanup happens unconditionally in nfsd4_cleanup_inter_ssc().
- * The vfsmount is pinned until this function is called, preventing
- * the client from unregistering its SSC ops.
+ * The client ops table is read under RCU; nfs42_ssc_unregister() calls
+ * synchronize_rcu() so unregistration cannot complete while a close is
+ * in flight.
  */
 void nfsd42_ssc_close(struct file *filp)
 {
 	/* Live only under CONFIG_NFSD_V4_2_INTER_SSC; see nfsd42_ssc_open(). */
 #if IS_ENABLED(CONFIG_NFSD_V4_2_INTER_SSC)
-	const struct nfs4_ssc_client_ops *ops = nfs_ssc_client_tbl.ssc_nfs4_ops;
+	const struct nfs4_ssc_client_ops *ops;
 
+	rcu_read_lock();
+	ops = rcu_dereference(nfs_ssc_client_tbl.ssc_nfs4_ops);
 	if (ops)
 		ops->sco_close(filp);
+	rcu_read_unlock();
 #endif
 }
 EXPORT_SYMBOL_GPL(nfsd42_ssc_close);
@@ -78,7 +96,7 @@ EXPORT_SYMBOL_GPL(nfsd42_ssc_close);
  */
 void nfs42_ssc_register(const struct nfs4_ssc_client_ops *ops)
 {
-	nfs_ssc_client_tbl.ssc_nfs4_ops = ops;
+	rcu_assign_pointer(nfs_ssc_client_tbl.ssc_nfs4_ops, ops);
 }
 EXPORT_SYMBOL_GPL(nfs42_ssc_register);
 
@@ -92,10 +110,12 @@ EXPORT_SYMBOL_GPL(nfs42_ssc_register);
  */
 void nfs42_ssc_unregister(const struct nfs4_ssc_client_ops *ops)
 {
-	if (nfs_ssc_client_tbl.ssc_nfs4_ops != ops)
+	if (rcu_dereference_protected(nfs_ssc_client_tbl.ssc_nfs4_ops,
+				      true) != ops)
 		return;
 
-	nfs_ssc_client_tbl.ssc_nfs4_ops = NULL;
+	rcu_assign_pointer(nfs_ssc_client_tbl.ssc_nfs4_ops, NULL);
+	synchronize_rcu();
 }
 EXPORT_SYMBOL_GPL(nfs42_ssc_unregister);
 #endif /* CONFIG_NFS_V4_2 */
diff --git a/include/linux/nfs_ssc.h b/include/linux/nfs_ssc.h
index fc0d5d48dec2..b392d56a4dc2 100644
--- a/include/linux/nfs_ssc.h
+++ b/include/linux/nfs_ssc.h
@@ -14,6 +14,7 @@
  * NFS_V4
  */
 struct nfs4_ssc_client_ops {
+	struct module *owner;
 	struct file *(*sco_open)(struct vfsmount *ss_mnt,
 		struct nfs_fh *src_fh, nfs4_stateid *stateid);
 	void (*sco_close)(struct file *filep);