NFSD: Avoid corruption of a referring call list

The new code neglects to remove a freshly-allocated RCL from the
callback's referring call list when no matching referring call is
found.

Reported-by: kernel test robot <[e-mail]>
Reported-by: Dan Carpenter <[e-mail]>
Closes: https://lore.kernel.org/r/[e-mail]/
Fixes: 4f3c8d8c9e10 ("NFSD: Implement CB_SEQUENCE referring call lists")
Reviewed-by: Jeff Layton <[e-mail]>
Signed-off-by: Chuck Lever <[e-mail]>

fs/nfsd/nfs4callback.c

···
 out:
 	if (!rcl->__nr_referring_calls) {
 		cb->cb_nr_referring_call_list--;
+		list_del(&rcl->__list);
 		kfree(rcl);
 	}
 }