nfsd: decrease sc_count directly if fail to queue dl_recall

In the Linux kernel, the following vulnerability has been resolved:

nfsd: decrease sc_count directly if fail to queue dl_recall

A deadlock warning occurred when invoking nfs4_put_stid following a failed

dl_recall queue operation:

T1 T2

nfs4_laundromat

nfs4_get_client_reaplist

nfs4_anylock_blockers

__break_lease

spin_lock // ctx->flc_lock

spin_lock // clp->cl_lock

nfs4_lockowner_has_blockers

locks_owner_has_blockers

spin_lock // flctx->flc_lock

nfsd_break_deleg_cb

nfsd_break_one_deleg

nfs4_put_stid

refcount_dec_and_lock

spin_lock // clp->cl_lock

When a file is opened, an nfs4_delegation is allocated with sc_count

initialized to 1, and the file_lease holds a reference to the delegation.

The file_lease is then associated with the file through kernel_setlease.

The disassociation is performed in nfsd4_delegreturn via the following

call chain:

nfsd4_delegreturn --> destroy_delegation --> destroy_unhashed_deleg -->

nfs4_unlock_deleg_lease --> kernel_setlease --> generic_delete_lease

The corresponding sc_count reference will be released after this

disassociation.

Since nfsd_break_one_deleg executes while holding the flc_lock, the

disassociation process becomes blocked when attempting to acquire flc_lock

in generic_delete_lease. This means:

1) sc_count in nfsd_break_one_deleg will not be decremented to 0;

2) The nfs4_put_stid called by nfsd_break_one_deleg will not attempt to

acquire cl_lock;

3) Consequently, no deadlock condition is created.

Given that sc_count in nfsd_break_one_deleg remains non-zero, we can

safely perform refcount_dec on sc_count directly. This approach

effectively avoids triggering deadlock warnings.