lease: fix Renew/Revoke race by closing revokec eagerly (Issue 14758)

Close revokec at the start of Revoke() (while holding le.mu) instead
of deferring it to function exit. This signals "revocation has started"
before keys are deleted.

In Renew(), add a non-blocking check on revokec after re-acquiring
le.mu and confirming the lease exists in leaseMap. If revokec is
closed, Renew returns ErrLeaseNotFound instead of refreshing the lease.

Both operations happen under le.mu, so they are properly ordered: once
Revoke closes revokec, any concurrent Renew will see it and refuse to
refresh.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Yishuai Li <yishuai.li@pingcap.com>

Author: liyishuai

server/lease/lessor.go

@@ -332,7 +332,10 @@ func (le *lessor) Revoke(id LeaseID) error {
 		return ErrLeaseNotFound
 	}
 
-	defer close(l.revokec)
+	// Signal that revocation has started. This must happen while holding
+	// le.mu so that Renew's revokec check (also under le.mu) is ordered
+	// with respect to this close.
+	close(l.revokec)
 	// unlock before doing external work
 	le.mu.Unlock()
 
@@ -448,6 +451,14 @@ func (le *lessor) Renew(id LeaseID) (int64, error) {
 		le.mu.Unlock()
 		return -1, ErrLeaseNotFound
 	}
+	// Check if Revoke() has started. revokec is closed under le.mu in
+	// Revoke(), so this check is properly ordered.
+	select {
+	case <-l.revokec:
+		le.mu.Unlock()
+		return -1, ErrLeaseNotFound
+	default:
+	}
 	l.refresh(0)
 	item := &LeaseWithTime{id: l.ID, time: l.expiry}
 	le.leaseExpiredNotifier.RegisterOrUpdate(item)