diff --git a/src/rpc/virnetsocket.c b/src/rpc/virnetsocket.c
index 88dc2a4f7a6c1cbe3379dbd0448d52229df865ae..93e062a1ff4818a748a7aef6e12d49985e30411c 100644
--- a/src/rpc/virnetsocket.c
+++ b/src/rpc/virnetsocket.c
@@ -655,6 +655,14 @@ int virNetSocketNewConnectExternal(const char **cmdargv,
 }
 
 
+void virNetSocketRef(virNetSocketPtr sock)
+{
+    virMutexLock(&sock->lock);
+    sock->refs++;
+    virMutexUnlock(&sock->lock);
+}
+
+
 void virNetSocketFree(virNetSocketPtr sock)
 {
     if (!sock)
@@ -1187,20 +1195,19 @@ int virNetSocketAddIOCallback(virNetSocketPtr sock,
 {
     int ret = -1;
 
+    virNetSocketRef(sock);
     virMutexLock(&sock->lock);
     if (sock->watch > 0) {
         VIR_DEBUG("Watch already registered on socket %p", sock);
         goto cleanup;
     }
 
-    sock->refs++;
     if ((sock->watch = virEventAddHandle(sock->fd,
                                          events,
                                          virNetSocketEventHandle,
                                          sock,
                                          virNetSocketEventFree)) < 0) {
         VIR_DEBUG("Failed to register watch on socket %p", sock);
-        sock->refs--;
         goto cleanup;
     }
     sock->func = func;
@@ -1211,6 +1218,8 @@ int virNetSocketAddIOCallback(virNetSocketPtr sock,
 
 cleanup:
     virMutexUnlock(&sock->lock);
+    if (ret != 0)
+        virNetSocketFree(sock);
     return ret;
 }
 
diff --git a/src/rpc/virnetsocket.h b/src/rpc/virnetsocket.h
index f7e5ebbb78f824f6f59d72365347f0260f8f6276..9c4f11251bc7a69c9e10af7591553254e772fff4 100644
--- a/src/rpc/virnetsocket.h
+++ b/src/rpc/virnetsocket.h
@@ -101,6 +101,7 @@ void virNetSocketSetSASLSession(virNetSocketPtr sock,
                                 virNetSASLSessionPtr sess);
 # endif
 bool virNetSocketHasCachedData(virNetSocketPtr sock);
+void virNetSocketRef(virNetSocketPtr sock);
 void virNetSocketFree(virNetSocketPtr sock);
 
 const char *virNetSocketLocalAddrString(virNetSocketPtr sock);