Re: [PATCH v3 5/5] ceph: narrow mdsc->mutex scope in replay_unsafe_requests

Hi Xiubo,

The collect-then-replay pattern here has a list-node race.

list_move(&req->r_unsafe_item, &unsafe_list) takes requests off
session->s_unsafe onto a local list under the mutex. After the mutex is
dropped, the replay loop iterates unsafe_list via r_unsafe_item.
Meanwhile handle_reply() -> __unregister_request() can call
list_del_init(&req->r_unsafe_item) under the mutex from another thread,
mutating the local-list linkage while the replay loop is walking it.
The kref prevents use-after-free, but the list traversal itself is
unsynchronized. Same issue affects old_list.

One way to fix this would be to collect refcounted pointers into an
array (or use storage independent of r_unsafe_item) for the local
iteration, leaving the requests on their canonical lists.

--
Alex Markuze