Re: [PATCH v3 5/5] ceph: narrow mdsc->mutex scope in replay_unsafe_requests

Alex,

Yeah, this also makes sense. I will fix it by adding one r_aux_item instead.

Thanks
- XIubo

On Tue, 11 Aug 2026 at 06:44, Alex Markuze <[email protected]> wrote:
>
> Hi Xiubo,
>
> The collect-then-replay pattern here has a list-node race.
>
> list_move(&req->r_unsafe_item, &unsafe_list) takes requests off
> session->s_unsafe onto a local list under the mutex. After the mutex is
> dropped, the replay loop iterates unsafe_list via r_unsafe_item.
> Meanwhile handle_reply() -> __unregister_request() can call
> list_del_init(&req->r_unsafe_item) under the mutex from another thread,
> mutating the local-list linkage while the replay loop is walking it.
> The kref prevents use-after-free, but the list traversal itself is
> unsynchronized. Same issue affects old_list.
>
> One way to fix this would be to collect refcounted pointers into an
> array (or use storage independent of r_unsafe_item) for the local
> iteration, leaving the requests on their canonical lists.
>
> --
> Alex Markuze
>