lease: reject KeepAlive during lease revocation

When a lease expires, the leader revokes it by deleting attached keys
and then removing the lease from leaseMap. A concurrent KeepAlive
(Renew) request can race in between these two steps: it finds the
lease still in leaseMap and successfully renews it, returning a
positive TTL to the client while the keys are already gone.

Fix this by closing lease.revokec at the start of Revoke() before
releasing the lock to delete keys, and checking lease.revokec in
Renew() after acquiring the lock. If revokec is closed, Renew()
returns ErrLeaseNotFound, ensuring the client is not misled into
thinking the lease (and its keys) are still alive.

Signed-off-by: Yishuai Li <yishuai.li@pingcap.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: liyishuai

server/lease/lessor.go

@@ -332,7 +332,7 @@ func (le *lessor) Revoke(id LeaseID) error {
 		return ErrLeaseNotFound
 	}
 
-	defer close(l.revokec)
+	close(l.revokec)
 	// unlock before doing external work
 	le.mu.Unlock()
 
@@ -448,6 +448,14 @@ func (le *lessor) Renew(id LeaseID) (int64, error) {
 		le.mu.Unlock()
 		return -1, ErrLeaseNotFound
 	}
+
+	select {
+	case <-l.revokec:
+		le.mu.Unlock()
+		return -1, ErrLeaseNotFound
+	default:
+	}
+
 	l.refresh(0)
 	item := &LeaseWithTime{id: l.ID, time: l.expiry}
 	le.leaseExpiredNotifier.RegisterOrUpdate(item)