diff --git a/lustre/sec/gss/sec_gss.c b/lustre/sec/gss/sec_gss.c
index b811f0040ef1e348b2725bf00610d3d277cd41d3..f46d2f59a903462c3fc0078303ef4162cfbaba0b 100644
--- a/lustre/sec/gss/sec_gss.c
+++ b/lustre/sec/gss/sec_gss.c
@@ -431,6 +431,7 @@ void gss_release_msg(struct gss_upcall_msg *gmsg)
                 return;
         }
         LASSERT(list_empty(&gmsg->gum_list));
+        LASSERT(list_empty(&gmsg->gum_base.list));
         OBD_FREE(gmsg, sizeof(*gmsg));
         EXIT;
 }
@@ -443,11 +444,6 @@ gss_unhash_msg_nolock(struct gss_upcall_msg *gmsg)
                 EXIT;
                 return;
         }
-        /* FIXME should not do this. when we in upper upcall queue,
-         * downcall will call unhash_msg, thus later put_msg might
-         * free msg buffer while it's not dequeued XXX */
-        list_del_init(&gmsg->gum_base.list);
-        /* FIXME */
 
         list_del_init(&gmsg->gum_list);
         wake_up(&gmsg->gum_waitq);
@@ -513,7 +509,7 @@ static void gss_init_upcall_msg(struct gss_upcall_msg *gmsg,
 #endif /* __KERNEL__ */
 
 /********************************************
- * gss cred manupulation helpers            *
+ * gss cred manipulation helpers            *
  ********************************************/
 static
 int gss_cred_is_uptodate_ctx(struct ptlrpc_cred *cred)
@@ -839,9 +835,7 @@ waiting:
                 res = 0;
 
 out:
-        spin_lock(&gsec->gs_lock);
         gss_release_msg(gss_msg);
-        spin_unlock(&gsec->gs_lock);
 
         RETURN(res);
 }
diff --git a/lustre/sec/gss/svcsec_gss.c b/lustre/sec/gss/svcsec_gss.c
index fda3d014f2be4feee251c2ed0e3fded97ae5cd34..f40544ece786a525ebe2efea97989503eeef0699 100644
--- a/lustre/sec/gss/svcsec_gss.c
+++ b/lustre/sec/gss/svcsec_gss.c
@@ -944,6 +944,7 @@ gss_svcsec_handle_init(struct ptlrpc_request *req,
         rc = lustre_pack_reply(req, 0, NULL, NULL);
         if (rc) {
                 CERROR("failed to pack reply, rc = %d\n", rc);
+                set_bit(CACHE_NEGATIVE, &rsci->h.flags);
                 GOTO(out, rc = SVC_DROP);
         }