NFSD: Fix infinite loop in layout state revocation

[ Upstream commit 4f8ef58c10bfe5f86a643c7c8331b37e69e3dae1 ]

find_one_sb_stid() skips stids whose sc_status is non-zero, but the
SC_TYPE_LAYOUT case in nfsd4_revoke_states() never sets sc_status
before calling nfsd4_close_layout(). The retry loop therefore finds
the same layout stid on every iteration, hanging the revoker
indefinitely.

Fixes: 1e33e1414bec ("nfsd: allow layout state to be admin-revoked.")
Reported-by: Dai Ngo <dai.ngo@oracle.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Tested-by: Dai Ngo <dai.ngo@oracle.com>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index 1a15e458b178ae5952db7cce1eacb0528f31bbd0..2d91747297820784d96608aee12a77e060ba5979 100644 (file)
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -1832,6 +1832,13 @@ void nfsd4_revoke_states(struct nfsd_net *nn, struct super_block *sb)
                                        break;
                                case SC_TYPE_LAYOUT:
                                        ls = layoutstateid(stid);
+                                       spin_lock(&clp->cl_lock);
+                                       if (stid->sc_status == 0) {
+                                               stid->sc_status |=
+                                                       SC_STATUS_ADMIN_REVOKED;
+                                               atomic_inc(&clp->cl_admin_revoked);
+                                       }
+                                       spin_unlock(&clp->cl_lock);
                                        nfsd4_close_layout(ls);
                                        break;
                                }