From: Chuck Lever chuck.lever@oracle.com
On Fri, 18 Oct 2024 15:24:58 -0400, Olga Kornievskaia wrote:
There is a race between laundromat handling of revoked delegations and a client sending free_stateid operation. Laundromat thread finds that delegation has expired and needs to be revoked so it marks the delegation stid revoked and it puts it on a reaper list but then it unlock the state lock and the actual delegation revocation happens without the lock. Once the stid is marked revoked a racing free_stateid processing thread does the following (1) it calls list_del_init() which removes it from the reaper list and (2) frees the delegation stid structure. The laundromat thread ends up not calling the revoke_delegation() function for this particular delegation but that means it will no release the lock lease that exists on the file.
[...]
Applied to nfsd-fixes for v6.12, thanks!
[1/1] nfsd: fix race between laundromat and free_stateid commit: 8dd91e8d31febf4d9cca3ae1bb4771d33ae7ee5a
-- Chuck Lever