Re: [PATCH v3] nfsd: prevent a double put of revoked layout stateids

[Chuck Lever]

On Wed, 14 Oct 2026 15:12:18 +0900, Jinpyo Lee wrote:
> nfsd4_free_stateid() finds an admin-revoked layout stateid with
> find_stateid_locked(), which does not acquire a reference. The layout
> case drops cl_lock without marking the stateid closed, then stops fence
> work and calls nfs4_put_stid() without owning a reference. Concurrent
> disposal can therefore access a freed layout stateid or drop a reference
> owned by another holder.
> 
> [...]

Applied to nfsd-testing, thanks!

[1/1] nfsd: prevent a double put of revoked layout stateids
      commit: d6f7f9b5c41466f3f54219f7968b26f2587794ee

--
Chuck Lever