Re: [PATCH v8 1/9] NFSD: Fix infinite loop in layout state revocation

[Jeff Layton <jlayton@kernel.org>]

On Wed, 2026-04-08 at 08:29 -0400, Chuck Lever wrote:
> From: Chuck Lever <chuck.lever@oracle.com>
> 
> find_one_sb_stid() skips stids whose sc_status is non-zero, but the
> SC_TYPE_LAYOUT case in nfsd4_revoke_states() never sets sc_status
> before calling nfsd4_close_layout(). The retry loop therefore finds
> the same layout stid on every iteration, hanging the revoker
> indefinitely.
> 
> Fixes: 1e33e1414bec ("nfsd: allow layout state to be admin-revoked.")
> Reported-by: Dai Ngo <dai.ngo@oracle.com>
> Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
> ---
>  fs/nfsd/nfs4state.c | 7 +++++++
>  1 file changed, 7 insertions(+)
> 
> diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
> index 07df4511ba23..c6cb67cf02ad 100644
> --- a/fs/nfsd/nfs4state.c
> +++ b/fs/nfsd/nfs4state.c
> @@ -1872,6 +1872,13 @@ void nfsd4_revoke_states(struct nfsd_net *nn, struct super_block *sb)
>  					break;
>  				case SC_TYPE_LAYOUT:
>  					ls = layoutstateid(stid);
> +					spin_lock(&clp->cl_lock);
> +					if (stid->sc_status == 0) {
> +						stid->sc_status |=
> +							SC_STATUS_ADMIN_REVOKED;
> +						atomic_inc(&clp->cl_admin_revoked);
> +					}
> +					spin_unlock(&clp->cl_lock);
>  					nfsd4_close_layout(ls);
>  					break;
>  				}

Nice catch.

Reviewed-by: Jeff Layton <jlayton@kernel.org>