From: Chuck Lever <chuck.lever@xxxxxxxxxx>
On Fri, 18 Oct 2024 15:24:58 -0400, Olga Kornievskaia wrote:
> There is a race between laundromat handling of revoked delegations
> and a client sending free_stateid operation. Laundromat thread
> finds that delegation has expired and needs to be revoked so it
> marks the delegation stid revoked and it puts it on a reaper list
> but then it unlock the state lock and the actual delegation revocation
> happens without the lock. Once the stid is marked revoked a racing
> free_stateid processing thread does the following (1) it calls
> list_del_init() which removes it from the reaper list and (2) frees
> the delegation stid structure. The laundromat thread ends up not
> calling the revoke_delegation() function for this particular delegation
> but that means it will no release the lock lease that exists on
> the file.
>
> [...]
Applied to nfsd-fixes for v6.12, thanks!
[1/1] nfsd: fix race between laundromat and free_stateid
commit: 8dd91e8d31febf4d9cca3ae1bb4771d33ae7ee5a
--
Chuck Lever
