[PATCH v2 1/2] nfsd: prevent write delegations when client has existing opens

[Chuck Lever <cel@kernel.org>]

From: Chuck Lever <chuck.lever@oracle.com>

When a client holds an existing OPEN stateid for a file and then
requests a new OPEN that could receive a write delegation, the
server must not grant that delegation. A write delegation promises
the client it can handle "all opens" locally, but this promise is
violated when the server is already tracking open state for that
same client.

Currently, nfsd4_check_conflicting_opens() prevents write
delegations only when other clients have write opens. It does not
check for existing opens from the same client. This creates a
problematic situation:

1. Client opens file O_RDONLY, gets READ delegation (or just OPEN)
2. Client returns READ delegation but keeps the OPEN stateid
3. Client opens same file O_WRONLY
4. Server grants WRITE delegation
5. nfsd4_add_rdaccess_to_wrdeleg() tries to add READ access
6. Finds fp->fi_fds[O_RDONLY] already set from step 1

Seen with generic/750 over NFSv4.1.

Fixes: 1d3dd1d56ce8 ("NFSD: Enable write delegation support")
X-Cc: stable@vger.kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
---
 fs/nfsd/nfs4state.c | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

Changes since v1:
* This patch replaces https://lore.kernel.org/linux-nfs/20251201220955.1949-1-cel@kernel.org/
* 2/2 adds a canary where this bug was caught


diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index 35004568d43e..1c9802d06de1 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -5947,11 +5947,16 @@ static int nfsd4_check_conflicting_opens(struct nfs4_client *clp,
 	 */
 	spin_lock(&fp->fi_lock);
 	list_for_each_entry(st, &fp->fi_stateids, st_perfile) {
-		if (st->st_openstp == NULL /* it's an open */ &&
-		    access_permit_write(st) &&
-		    st->st_stid.sc_client != clp) {
-			spin_unlock(&fp->fi_lock);
-			return -EAGAIN;
+		if (st->st_openstp == NULL /* it's an open */) {
+			if (st->st_stid.sc_client != clp &&
+			    access_permit_write(st)) {
+				spin_unlock(&fp->fi_lock);
+				return -EAGAIN;
+			}
+			if (st->st_stid.sc_client == clp) {
+				spin_unlock(&fp->fi_lock);
+				return -EAGAIN;
+			}
 		}
 	}
 	spin_unlock(&fp->fi_lock);
-- 
2.52.0