From: Patrick Donnelly <pdonnell@redhat.com>
Date: Fri, 1 Nov 2019 20:31:23 +0000 (-0700)
Subject: messages: protect CephFS messages get/put methods
X-Git-Tag: v15.1.0~1046^2
X-Git-Url: http://git-server-git.apps.pok.os.sepia.ceph.com/?a=commitdiff_plain;h=3bc7a8732ff3bc5b11a910ead5074e9d784a2d0a;p=ceph.git

messages: protect CephFS messages get/put methods

Use SafeMessage inheritance so that only intrusive pointers can modify
the reference count. This is just a defensive programming refactor.

Signed-off-by: Patrick Donnelly <pdonnell@redhat.com>
---

diff --git a/src/messages/MCacheExpire.h b/src/messages/MCacheExpire.h
index dede4f3fefef..4645e8132263 100644
--- a/src/messages/MCacheExpire.h
+++ b/src/messages/MCacheExpire.h
@@ -21,7 +21,7 @@
 
 #include "mds/mdstypes.h"
 
-class MCacheExpire : public Message {
+class MCacheExpire : public SafeMessage {
 private:
   __s32 from;
 
@@ -66,9 +66,9 @@ public:
   int get_from() const { return from; }
 
 protected:
-  MCacheExpire() : Message{MSG_MDS_CACHEEXPIRE}, from(-1) {}
+  MCacheExpire() : SafeMessage{MSG_MDS_CACHEEXPIRE}, from(-1) {}
   MCacheExpire(int f) : 
-    Message{MSG_MDS_CACHEEXPIRE},
+    SafeMessage{MSG_MDS_CACHEEXPIRE},
     from(f) { }
   ~MCacheExpire() override {}
 
diff --git a/src/messages/MClientCapRelease.h b/src/messages/MClientCapRelease.h
index 10ff58f8ef3c..f9442c981f1d 100644
--- a/src/messages/MClientCapRelease.h
+++ b/src/messages/MClientCapRelease.h
@@ -18,7 +18,7 @@
 #include "msg/Message.h"
 
 
-class MClientCapRelease : public Message {
+class MClientCapRelease : public SafeMessage {
  public:
   std::string_view get_type_name() const override { return "client_cap_release";}
   void print(ostream& out) const override {
@@ -56,7 +56,7 @@ private:
   static constexpr int COMPAT_VERSION = 1;
 
   MClientCapRelease() : 
-    Message{CEPH_MSG_CLIENT_CAPRELEASE, HEAD_VERSION, COMPAT_VERSION}
+    SafeMessage{CEPH_MSG_CLIENT_CAPRELEASE, HEAD_VERSION, COMPAT_VERSION}
   {
     memset(&head, 0, sizeof(head));
   }
diff --git a/src/messages/MClientCaps.h b/src/messages/MClientCaps.h
index 292eeeb1845d..99ef6a1954e9 100644
--- a/src/messages/MClientCaps.h
+++ b/src/messages/MClientCaps.h
@@ -19,7 +19,7 @@
 #include "mds/mdstypes.h"
 #include "include/ceph_features.h"
 
-class MClientCaps : public Message {
+class MClientCaps : public SafeMessage {
 private:
 
   static constexpr int HEAD_VERSION = 11;
@@ -129,7 +129,7 @@ private:
 
 protected:
   MClientCaps()
-    : Message{CEPH_MSG_CLIENT_CAPS, HEAD_VERSION, COMPAT_VERSION} {}
+    : SafeMessage{CEPH_MSG_CLIENT_CAPS, HEAD_VERSION, COMPAT_VERSION} {}
   MClientCaps(int op,
 	      inodeno_t ino,
 	      inodeno_t realm,
@@ -140,7 +140,7 @@ protected:
 	      int dirty,
 	      int mseq,
               epoch_t oeb)
-    : Message{CEPH_MSG_CLIENT_CAPS, HEAD_VERSION, COMPAT_VERSION},
+    : SafeMessage{CEPH_MSG_CLIENT_CAPS, HEAD_VERSION, COMPAT_VERSION},
       osd_epoch_barrier(oeb) {
     memset(&head, 0, sizeof(head));
     head.op = op;
@@ -157,7 +157,7 @@ protected:
   MClientCaps(int op,
 	      inodeno_t ino, inodeno_t realm,
 	      uint64_t id, int mseq, epoch_t oeb)
-    : Message{CEPH_MSG_CLIENT_CAPS, HEAD_VERSION, COMPAT_VERSION},
+    : SafeMessage{CEPH_MSG_CLIENT_CAPS, HEAD_VERSION, COMPAT_VERSION},
       osd_epoch_barrier(oeb) {
     memset(&head, 0, sizeof(head));
     head.op = op;
diff --git a/src/messages/MClientLease.h b/src/messages/MClientLease.h
index f75cd26915b3..52c5883d5846 100644
--- a/src/messages/MClientLease.h
+++ b/src/messages/MClientLease.h
@@ -20,7 +20,7 @@
 
 #include "msg/Message.h"
 
-class MClientLease : public Message {
+class MClientLease : public SafeMessage {
 public:
   struct ceph_mds_lease h;
   std::string dname;
@@ -33,13 +33,13 @@ public:
   snapid_t get_last() const { return snapid_t(h.last); }
 
 protected:
-  MClientLease() : Message(CEPH_MSG_CLIENT_LEASE) {}
+  MClientLease() : SafeMessage(CEPH_MSG_CLIENT_LEASE) {}
   MClientLease(const MClientLease& m) :
-    Message(CEPH_MSG_CLIENT_LEASE),
+    SafeMessage(CEPH_MSG_CLIENT_LEASE),
     h(m.h),
     dname(m.dname) {}
   MClientLease(int ac, ceph_seq_t seq, int m, uint64_t i, uint64_t sf, uint64_t sl) :
-    Message(CEPH_MSG_CLIENT_LEASE) {
+    SafeMessage(CEPH_MSG_CLIENT_LEASE) {
     h.action = ac;
     h.seq = seq;
     h.mask = m;
@@ -49,7 +49,7 @@ protected:
     h.duration_ms = 0;
   }
   MClientLease(int ac, ceph_seq_t seq, int m, uint64_t i, uint64_t sf, uint64_t sl, std::string_view d) :
-    Message(CEPH_MSG_CLIENT_LEASE),
+    SafeMessage(CEPH_MSG_CLIENT_LEASE),
     dname(d) {
     h.action = ac;
     h.seq = seq;
diff --git a/src/messages/MClientQuota.h b/src/messages/MClientQuota.h
index 0042f37fbffb..817a88c13933 100644
--- a/src/messages/MClientQuota.h
+++ b/src/messages/MClientQuota.h
@@ -3,7 +3,7 @@
 
 #include "msg/Message.h"
 
-class MClientQuota : public Message {
+class MClientQuota : public SafeMessage {
 public:
   inodeno_t ino;
   nest_info_t rstat;
@@ -11,7 +11,7 @@ public:
 
 protected:
   MClientQuota() :
-    Message{CEPH_MSG_CLIENT_QUOTA},
+    SafeMessage{CEPH_MSG_CLIENT_QUOTA},
     ino(0)
   {}
   ~MClientQuota() override {}
diff --git a/src/messages/MClientReclaim.h b/src/messages/MClientReclaim.h
index e98fee8e9609..03bad8d6401d 100644
--- a/src/messages/MClientReclaim.h
+++ b/src/messages/MClientReclaim.h
@@ -18,7 +18,7 @@
 
 #include "msg/Message.h"
 
-class MClientReclaim: public Message {
+class MClientReclaim: public SafeMessage {
 public:
   static constexpr int HEAD_VERSION = 1;
   static constexpr int COMPAT_VERSION = 1;
@@ -49,9 +49,9 @@ public:
 
 protected:
   MClientReclaim() :
-    Message{CEPH_MSG_CLIENT_RECLAIM, HEAD_VERSION, COMPAT_VERSION} {}
+    SafeMessage{CEPH_MSG_CLIENT_RECLAIM, HEAD_VERSION, COMPAT_VERSION} {}
   MClientReclaim(std::string_view _uuid, uint32_t _flags) :
-    Message{CEPH_MSG_CLIENT_RECLAIM, HEAD_VERSION, COMPAT_VERSION},
+    SafeMessage{CEPH_MSG_CLIENT_RECLAIM, HEAD_VERSION, COMPAT_VERSION},
     uuid(_uuid), flags(_flags) {}
 private:
   ~MClientReclaim() override {}
diff --git a/src/messages/MClientReclaimReply.h b/src/messages/MClientReclaimReply.h
index ef0b17de9e83..b91b588b35fc 100644
--- a/src/messages/MClientReclaimReply.h
+++ b/src/messages/MClientReclaimReply.h
@@ -18,7 +18,7 @@
 
 #include "msg/Message.h"
 
-class MClientReclaimReply: public Message {
+class MClientReclaimReply: public SafeMessage {
 public:
   static constexpr int HEAD_VERSION = 1;
   static constexpr int COMPAT_VERSION = 1;
@@ -55,7 +55,7 @@ protected:
     MClientReclaimReply{0, 0}
   {}
   MClientReclaimReply(int r, epoch_t e=0) :
-    Message{CEPH_MSG_CLIENT_RECLAIM_REPLY, HEAD_VERSION, COMPAT_VERSION},
+    SafeMessage{CEPH_MSG_CLIENT_RECLAIM_REPLY, HEAD_VERSION, COMPAT_VERSION},
     result(r), epoch(e) {}
 
 private:
diff --git a/src/messages/MClientReconnect.h b/src/messages/MClientReconnect.h
index d631a697b579..e4592c7b01bf 100644
--- a/src/messages/MClientReconnect.h
+++ b/src/messages/MClientReconnect.h
@@ -20,7 +20,7 @@
 #include "include/ceph_features.h"
 
 
-class MClientReconnect : public Message {
+class MClientReconnect : public SafeMessage {
 private:
   static constexpr int HEAD_VERSION = 5;
   static constexpr int COMPAT_VERSION = 4;
@@ -32,7 +32,7 @@ public:
 
 private:
   MClientReconnect() :
-    Message{CEPH_MSG_CLIENT_RECONNECT, HEAD_VERSION, COMPAT_VERSION} {}
+    SafeMessage{CEPH_MSG_CLIENT_RECONNECT, HEAD_VERSION, COMPAT_VERSION} {}
   ~MClientReconnect() override {}
 
   size_t cap_size = 0;
diff --git a/src/messages/MClientReply.h b/src/messages/MClientReply.h
index c064ecbd2b32..fb08b24c88a1 100644
--- a/src/messages/MClientReply.h
+++ b/src/messages/MClientReply.h
@@ -263,7 +263,7 @@ struct InodeStat {
 };
 
 
-class MClientReply : public Message {
+class MClientReply : public SafeMessage {
 public:
   // reply data
   struct ceph_mds_reply_head head {};
@@ -287,9 +287,9 @@ public:
   bool is_safe() const { return head.safe; }
 
 protected:
-  MClientReply() : Message{CEPH_MSG_CLIENT_REPLY} {}
+  MClientReply() : SafeMessage{CEPH_MSG_CLIENT_REPLY} {}
   MClientReply(const MClientRequest &req, int result = 0) :
-    Message{CEPH_MSG_CLIENT_REPLY} {
+    SafeMessage{CEPH_MSG_CLIENT_REPLY} {
     memset(&head, 0, sizeof(head));
     header.tid = req.get_tid();
     head.op = req.get_op();
diff --git a/src/messages/MClientRequest.h b/src/messages/MClientRequest.h
index 944cd8810c0e..d565f204ac50 100644
--- a/src/messages/MClientRequest.h
+++ b/src/messages/MClientRequest.h
@@ -48,7 +48,7 @@
 
 // metadata ops.
 
-class MClientRequest : public Message {
+class MClientRequest : public SafeMessage {
 private:
   static constexpr int HEAD_VERSION = 4;
   static constexpr int COMPAT_VERSION = 1;
@@ -89,9 +89,9 @@ public:
 protected:
   // cons
   MClientRequest()
-    : Message(CEPH_MSG_CLIENT_REQUEST, HEAD_VERSION, COMPAT_VERSION) {}
+    : SafeMessage(CEPH_MSG_CLIENT_REQUEST, HEAD_VERSION, COMPAT_VERSION) {}
   MClientRequest(int op)
-    : Message(CEPH_MSG_CLIENT_REQUEST, HEAD_VERSION, COMPAT_VERSION) {
+    : SafeMessage(CEPH_MSG_CLIENT_REQUEST, HEAD_VERSION, COMPAT_VERSION) {
     memset(&head, 0, sizeof(head));
     head.op = op;
   }
diff --git a/src/messages/MClientRequestForward.h b/src/messages/MClientRequestForward.h
index b92c49329e74..b0aeebebae87 100644
--- a/src/messages/MClientRequestForward.h
+++ b/src/messages/MClientRequestForward.h
@@ -18,7 +18,7 @@
 
 #include "msg/Message.h"
 
-class MClientRequestForward : public Message {
+class MClientRequestForward : public SafeMessage {
 private:
   int32_t dest_mds;
   int32_t num_fwd;
@@ -26,10 +26,10 @@ private:
 
 protected:
   MClientRequestForward()
-    : Message{CEPH_MSG_CLIENT_REQUEST_FORWARD},
+    : SafeMessage{CEPH_MSG_CLIENT_REQUEST_FORWARD},
       dest_mds(-1), num_fwd(-1), client_must_resend(false) {}
   MClientRequestForward(ceph_tid_t t, int dm, int nf, bool cmr) :
-    Message{CEPH_MSG_CLIENT_REQUEST_FORWARD},
+    SafeMessage{CEPH_MSG_CLIENT_REQUEST_FORWARD},
     dest_mds(dm), num_fwd(nf), client_must_resend(cmr) {
     ceph_assert(client_must_resend);
     header.tid = t;
diff --git a/src/messages/MClientSession.h b/src/messages/MClientSession.h
index f1d4191726c6..9a4bba74b56b 100644
--- a/src/messages/MClientSession.h
+++ b/src/messages/MClientSession.h
@@ -18,7 +18,7 @@
 #include "msg/Message.h"
 #include "mds/mdstypes.h"
 
-class MClientSession : public Message {
+class MClientSession : public SafeMessage {
 private:
   static constexpr int HEAD_VERSION = 3;
   static constexpr int COMPAT_VERSION = 1;
@@ -36,15 +36,15 @@ public:
   int get_max_leases() const { return head.max_leases; }
 
 protected:
-  MClientSession() : Message{CEPH_MSG_CLIENT_SESSION, HEAD_VERSION, COMPAT_VERSION} { }
+  MClientSession() : SafeMessage{CEPH_MSG_CLIENT_SESSION, HEAD_VERSION, COMPAT_VERSION} { }
   MClientSession(int o, version_t s=0) : 
-    Message{CEPH_MSG_CLIENT_SESSION, HEAD_VERSION, COMPAT_VERSION} {
+    SafeMessage{CEPH_MSG_CLIENT_SESSION, HEAD_VERSION, COMPAT_VERSION} {
     memset(&head, 0, sizeof(head));
     head.op = o;
     head.seq = s;
   }
   MClientSession(int o, utime_t st) : 
-    Message{CEPH_MSG_CLIENT_SESSION, HEAD_VERSION, COMPAT_VERSION} {
+    SafeMessage{CEPH_MSG_CLIENT_SESSION, HEAD_VERSION, COMPAT_VERSION} {
     memset(&head, 0, sizeof(head));
     head.op = o;
     head.seq = 0;
diff --git a/src/messages/MClientSnap.h b/src/messages/MClientSnap.h
index 59f872fc1a38..85c36af1bea4 100644
--- a/src/messages/MClientSnap.h
+++ b/src/messages/MClientSnap.h
@@ -17,7 +17,7 @@
 
 #include "msg/Message.h"
 
-class MClientSnap : public Message {
+class MClientSnap : public SafeMessage {
 public:
   ceph_mds_snap_head head;
   bufferlist bl;
@@ -28,7 +28,7 @@ public:
 
 protected:
   MClientSnap(int o=0) : 
-    Message{CEPH_MSG_CLIENT_SNAP} {
+    SafeMessage{CEPH_MSG_CLIENT_SNAP} {
     memset(&head, 0, sizeof(head));
     head.op = o;
   }
diff --git a/src/messages/MDentryLink.h b/src/messages/MDentryLink.h
index 38cccf1fae1b..0b101683e83d 100644
--- a/src/messages/MDentryLink.h
+++ b/src/messages/MDentryLink.h
@@ -20,7 +20,7 @@
 
 #include "msg/Message.h"
 
-class MDentryLink : public Message {
+class MDentryLink : public SafeMessage {
 private:
   static const int HEAD_VERSION = 1;
   static const int COMPAT_VERSION = 1;
@@ -40,9 +40,9 @@ private:
 
 protected:
   MDentryLink() :
-    Message(MSG_MDS_DENTRYLINK, HEAD_VERSION, COMPAT_VERSION) { }
+    SafeMessage(MSG_MDS_DENTRYLINK, HEAD_VERSION, COMPAT_VERSION) { }
   MDentryLink(dirfrag_t r, dirfrag_t df, std::string_view n, bool p) :
-    Message(MSG_MDS_DENTRYLINK, HEAD_VERSION, COMPAT_VERSION),
+    SafeMessage(MSG_MDS_DENTRYLINK, HEAD_VERSION, COMPAT_VERSION),
     subtree(r),
     dirfrag(df),
     dn(n),
diff --git a/src/messages/MDentryUnlink.h b/src/messages/MDentryUnlink.h
index acff7150f3f5..ee5d285ad44a 100644
--- a/src/messages/MDentryUnlink.h
+++ b/src/messages/MDentryUnlink.h
@@ -20,7 +20,7 @@
 
 #include "msg/Message.h"
 
-class MDentryUnlink : public Message {
+class MDentryUnlink : public SafeMessage {
 private:
   static const int HEAD_VERSION = 1;
   static const int COMPAT_VERSION = 1;
@@ -37,9 +37,9 @@ private:
 
 protected:
   MDentryUnlink() :
-    Message(MSG_MDS_DENTRYUNLINK, HEAD_VERSION, COMPAT_VERSION) { }
+    SafeMessage(MSG_MDS_DENTRYUNLINK, HEAD_VERSION, COMPAT_VERSION) { }
   MDentryUnlink(dirfrag_t df, std::string_view n) :
-    Message(MSG_MDS_DENTRYUNLINK, HEAD_VERSION, COMPAT_VERSION),
+    SafeMessage(MSG_MDS_DENTRYUNLINK, HEAD_VERSION, COMPAT_VERSION),
     dirfrag(df),
     dn(n) {}
   ~MDentryUnlink() override {}
diff --git a/src/messages/MDirUpdate.h b/src/messages/MDirUpdate.h
index e5f97f3847d2..46036ad03e6c 100644
--- a/src/messages/MDirUpdate.h
+++ b/src/messages/MDirUpdate.h
@@ -18,7 +18,7 @@
 
 #include "msg/Message.h"
 
-class MDirUpdate : public Message {
+class MDirUpdate : public SafeMessage {
 public:
   mds_rank_t get_source_mds() const { return from_mds; }
   dirfrag_t get_dirfrag() const { return dirfrag; }
@@ -57,19 +57,19 @@ public:
 
 protected:
   ~MDirUpdate() {}
-  MDirUpdate() : Message(MSG_MDS_DIRUPDATE, HEAD_VERSION, COMPAT_VERSION) {}
+  MDirUpdate() : SafeMessage(MSG_MDS_DIRUPDATE, HEAD_VERSION, COMPAT_VERSION) {}
   MDirUpdate(mds_rank_t f,
 	     dirfrag_t dirfrag,
              int dir_rep,
              const std::set<int32_t>& dir_rep_by,
              filepath& path,
              bool discover = false) :
-    Message(MSG_MDS_DIRUPDATE, HEAD_VERSION, COMPAT_VERSION), from_mds(f), dirfrag(dirfrag),
+    SafeMessage(MSG_MDS_DIRUPDATE, HEAD_VERSION, COMPAT_VERSION), from_mds(f), dirfrag(dirfrag),
     dir_rep(dir_rep), dir_rep_by(dir_rep_by), path(path) {
     this->discover = discover ? 5 : 0;
   }
   MDirUpdate(const MDirUpdate& m)
-  : Message{MSG_MDS_DIRUPDATE},
+  : SafeMessage{MSG_MDS_DIRUPDATE},
     from_mds(m.from_mds),
     dirfrag(m.dirfrag),
     dir_rep(m.dir_rep),
diff --git a/src/messages/MDiscover.h b/src/messages/MDiscover.h
index 0b54ad3e6f4b..e60ad738aa16 100644
--- a/src/messages/MDiscover.h
+++ b/src/messages/MDiscover.h
@@ -22,7 +22,7 @@
 #include <string>
 
 
-class MDiscover : public Message {
+class MDiscover : public SafeMessage {
 private:
   static constexpr int HEAD_VERSION = 1;
   static constexpr int COMPAT_VERSION = 1;
@@ -50,14 +50,14 @@ private:
   void set_base_dir_frag(frag_t f) { base_dir_frag = f; }
 
 protected:
-  MDiscover() : Message(MSG_MDS_DISCOVER, HEAD_VERSION, COMPAT_VERSION) { }
+  MDiscover() : SafeMessage(MSG_MDS_DISCOVER, HEAD_VERSION, COMPAT_VERSION) { }
   MDiscover(inodeno_t base_ino_,
 	    frag_t base_frag_,
 	    snapid_t s,
             filepath& want_path_,
             bool want_base_dir_ = true,
 	    bool discover_xlocks_ = false) :
-    Message{MSG_MDS_DISCOVER},
+    SafeMessage{MSG_MDS_DISCOVER},
     base_ino(base_ino_),
     base_dir_frag(base_frag_),
     snapid(s),
diff --git a/src/messages/MDiscoverReply.h b/src/messages/MDiscoverReply.h
index 8010320bdf7c..70d417cb8c97 100644
--- a/src/messages/MDiscoverReply.h
+++ b/src/messages/MDiscoverReply.h
@@ -63,7 +63,7 @@
  * 
  */
 
-class MDiscoverReply : public Message {
+class MDiscoverReply : public SafeMessage {
 private:
   static constexpr int HEAD_VERSION = 2;
   static constexpr int COMPAT_VERSION = 2;
@@ -110,9 +110,9 @@ private:
   void set_base_dir_frag(frag_t df) { base_dir_frag = df; }
 
 protected:
-  MDiscoverReply() : Message{MSG_MDS_DISCOVERREPLY, HEAD_VERSION, COMPAT_VERSION} { }
+  MDiscoverReply() : SafeMessage{MSG_MDS_DISCOVERREPLY, HEAD_VERSION, COMPAT_VERSION} { }
   MDiscoverReply(const MDiscover &dis) :
-    Message{MSG_MDS_DISCOVERREPLY, HEAD_VERSION, COMPAT_VERSION},
+    SafeMessage{MSG_MDS_DISCOVERREPLY, HEAD_VERSION, COMPAT_VERSION},
     base_ino(dis.get_base_ino()),
     base_dir_frag(dis.get_base_dir_frag()),
     wanted_base_dir(dis.wants_base_dir()),
@@ -127,7 +127,7 @@ protected:
     header.tid = dis.get_tid();
   }
   MDiscoverReply(dirfrag_t df) :
-    Message{MSG_MDS_DISCOVERREPLY, HEAD_VERSION, COMPAT_VERSION},
+    SafeMessage{MSG_MDS_DISCOVERREPLY, HEAD_VERSION, COMPAT_VERSION},
     base_ino(df.ino),
     base_dir_frag(df.frag),
     wanted_base_dir(false),
diff --git a/src/messages/MExportCaps.h b/src/messages/MExportCaps.h
index c05836efe6a4..90f9864a5f83 100644
--- a/src/messages/MExportCaps.h
+++ b/src/messages/MExportCaps.h
@@ -19,7 +19,7 @@
 #include "msg/Message.h"
 
 
-class MExportCaps : public Message {
+class MExportCaps : public SafeMessage {
 private:
   static constexpr int HEAD_VERSION = 2;
   static constexpr int COMPAT_VERSION = 1;
@@ -32,7 +32,7 @@ public:
 
 protected:
   MExportCaps() :
-    Message{MSG_MDS_EXPORTCAPS, HEAD_VERSION, COMPAT_VERSION} {}
+    SafeMessage{MSG_MDS_EXPORTCAPS, HEAD_VERSION, COMPAT_VERSION} {}
   ~MExportCaps() override {}
 
 public:
diff --git a/src/messages/MExportCapsAck.h b/src/messages/MExportCapsAck.h
index 2382ba60d5b2..75ec3da37d71 100644
--- a/src/messages/MExportCapsAck.h
+++ b/src/messages/MExportCapsAck.h
@@ -19,7 +19,7 @@
 #include "msg/Message.h"
 
 
-class MExportCapsAck : public Message {
+class MExportCapsAck : public SafeMessage {
  static constexpr int HEAD_VERSION = 1;
  static constexpr int COMPAT_VERSION = 1;
 
@@ -29,9 +29,9 @@ public:
 
 protected:
   MExportCapsAck() :
-    Message{MSG_MDS_EXPORTCAPSACK, HEAD_VERSION, COMPAT_VERSION} {}
+    SafeMessage{MSG_MDS_EXPORTCAPSACK, HEAD_VERSION, COMPAT_VERSION} {}
   MExportCapsAck(inodeno_t i) :
-    Message{MSG_MDS_EXPORTCAPSACK, HEAD_VERSION, COMPAT_VERSION}, ino(i) {}
+    SafeMessage{MSG_MDS_EXPORTCAPSACK, HEAD_VERSION, COMPAT_VERSION}, ino(i) {}
   ~MExportCapsAck() override {}
 
 public:
diff --git a/src/messages/MExportDir.h b/src/messages/MExportDir.h
index 3bd98a338731..b9e18188b36f 100644
--- a/src/messages/MExportDir.h
+++ b/src/messages/MExportDir.h
@@ -19,7 +19,7 @@
 #include "msg/Message.h"
 
 
-class MExportDir : public Message {
+class MExportDir : public SafeMessage {
 public:
   dirfrag_t dirfrag;
   bufferlist export_data;
@@ -27,9 +27,9 @@ public:
   bufferlist client_map;
 
 protected:
-  MExportDir() : Message{MSG_MDS_EXPORTDIR} {}
+  MExportDir() : SafeMessage{MSG_MDS_EXPORTDIR} {}
   MExportDir(dirfrag_t df, uint64_t tid) :
-    Message{MSG_MDS_EXPORTDIR}, dirfrag(df) {
+    SafeMessage{MSG_MDS_EXPORTDIR}, dirfrag(df) {
     set_tid(tid);
   }
   ~MExportDir() override {}
diff --git a/src/messages/MExportDirAck.h b/src/messages/MExportDirAck.h
index d0ffd01b9c9a..8e3548cd3974 100644
--- a/src/messages/MExportDirAck.h
+++ b/src/messages/MExportDirAck.h
@@ -18,7 +18,7 @@
 #include "MExportDir.h"
 #include "msg/Message.h"
 
-class MExportDirAck : public Message {
+class MExportDirAck : public SafeMessage {
 public:
   dirfrag_t dirfrag;
   bufferlist imported_caps;
@@ -26,9 +26,9 @@ public:
   dirfrag_t get_dirfrag() const { return dirfrag; }
   
 protected:
-  MExportDirAck() : Message{MSG_MDS_EXPORTDIRACK} {}
+  MExportDirAck() : SafeMessage{MSG_MDS_EXPORTDIRACK} {}
   MExportDirAck(dirfrag_t df, uint64_t tid) :
-    Message{MSG_MDS_EXPORTDIRACK}, dirfrag(df) {
+    SafeMessage{MSG_MDS_EXPORTDIRACK}, dirfrag(df) {
     set_tid(tid);
   }
   ~MExportDirAck() override {}
diff --git a/src/messages/MExportDirCancel.h b/src/messages/MExportDirCancel.h
index 7e31c103d3df..b26c3c0f37b6 100644
--- a/src/messages/MExportDirCancel.h
+++ b/src/messages/MExportDirCancel.h
@@ -18,7 +18,7 @@
 #include "msg/Message.h"
 #include "include/types.h"
 
-class MExportDirCancel : public Message {
+class MExportDirCancel : public SafeMessage {
 private:
   static const int HEAD_VERSION = 1;
   static const int COMPAT_VERSION = 1;
@@ -28,9 +28,9 @@ private:
   dirfrag_t get_dirfrag() const { return dirfrag; }
 
 protected:
-  MExportDirCancel() : Message{MSG_MDS_EXPORTDIRCANCEL, HEAD_VERSION, COMPAT_VERSION} {}
+  MExportDirCancel() : SafeMessage{MSG_MDS_EXPORTDIRCANCEL, HEAD_VERSION, COMPAT_VERSION} {}
   MExportDirCancel(dirfrag_t df, uint64_t tid) :
-    Message{MSG_MDS_EXPORTDIRCANCEL, HEAD_VERSION, COMPAT_VERSION}, dirfrag(df) {
+    SafeMessage{MSG_MDS_EXPORTDIRCANCEL, HEAD_VERSION, COMPAT_VERSION}, dirfrag(df) {
     set_tid(tid);
   }
   ~MExportDirCancel() override {}
diff --git a/src/messages/MExportDirDiscover.h b/src/messages/MExportDirDiscover.h
index 2de45c7140dd..d6f9cad1a039 100644
--- a/src/messages/MExportDirDiscover.h
+++ b/src/messages/MExportDirDiscover.h
@@ -18,7 +18,7 @@
 #include "msg/Message.h"
 #include "include/types.h"
 
-class MExportDirDiscover : public Message {
+class MExportDirDiscover : public SafeMessage {
 private:
   static const int HEAD_VERSION = 1;
   static const int COMPAT_VERSION = 1;
@@ -36,10 +36,10 @@ private:
 
 protected:
   MExportDirDiscover() :     
-    Message{MSG_MDS_EXPORTDIRDISCOVER, HEAD_VERSION, COMPAT_VERSION},
+    SafeMessage{MSG_MDS_EXPORTDIRDISCOVER, HEAD_VERSION, COMPAT_VERSION},
     started(false) { }
   MExportDirDiscover(dirfrag_t df, filepath& p, mds_rank_t f, uint64_t tid) :
-    Message{MSG_MDS_EXPORTDIRDISCOVER, HEAD_VERSION, COMPAT_VERSION},
+    SafeMessage{MSG_MDS_EXPORTDIRDISCOVER, HEAD_VERSION, COMPAT_VERSION},
     from(f), dirfrag(df), path(p), started(false) {
     set_tid(tid);
   }
diff --git a/src/messages/MExportDirDiscoverAck.h b/src/messages/MExportDirDiscoverAck.h
index 09633b4cfaf0..e71e2898bd60 100644
--- a/src/messages/MExportDirDiscoverAck.h
+++ b/src/messages/MExportDirDiscoverAck.h
@@ -18,7 +18,7 @@
 #include "msg/Message.h"
 #include "include/types.h"
 
-class MExportDirDiscoverAck : public Message {
+class MExportDirDiscoverAck : public SafeMessage {
 private:
   static const int HEAD_VERSION = 1;
   static const int COMPAT_VERSION = 1;
@@ -32,9 +32,9 @@ private:
   bool is_success() const { return success; }
 
 protected:
-  MExportDirDiscoverAck() : Message{MSG_MDS_EXPORTDIRDISCOVERACK, HEAD_VERSION, COMPAT_VERSION} {}
+  MExportDirDiscoverAck() : SafeMessage{MSG_MDS_EXPORTDIRDISCOVERACK, HEAD_VERSION, COMPAT_VERSION} {}
   MExportDirDiscoverAck(dirfrag_t df, uint64_t tid, bool s=true) :
-    Message{MSG_MDS_EXPORTDIRDISCOVERACK, HEAD_VERSION, COMPAT_VERSION},
+    SafeMessage{MSG_MDS_EXPORTDIRDISCOVERACK, HEAD_VERSION, COMPAT_VERSION},
     dirfrag(df), success(s) {
     set_tid(tid);
   }
diff --git a/src/messages/MExportDirFinish.h b/src/messages/MExportDirFinish.h
index 8a73c40de5f6..579f34bd74fb 100644
--- a/src/messages/MExportDirFinish.h
+++ b/src/messages/MExportDirFinish.h
@@ -17,7 +17,7 @@
 
 #include "msg/Message.h"
 
-class MExportDirFinish : public Message {
+class MExportDirFinish : public SafeMessage {
 private:
   static const int HEAD_VERSION = 1;
   static const int COMPAT_VERSION = 1;
@@ -31,9 +31,9 @@ private:
   
 protected:
   MExportDirFinish() :
-    Message{MSG_MDS_EXPORTDIRFINISH, HEAD_VERSION, COMPAT_VERSION}, last(false) {}
+    SafeMessage{MSG_MDS_EXPORTDIRFINISH, HEAD_VERSION, COMPAT_VERSION}, last(false) {}
   MExportDirFinish(dirfrag_t df, bool l, uint64_t tid) :
-    Message{MSG_MDS_EXPORTDIRFINISH, HEAD_VERSION, COMPAT_VERSION}, dirfrag(df), last(l) {
+    SafeMessage{MSG_MDS_EXPORTDIRFINISH, HEAD_VERSION, COMPAT_VERSION}, dirfrag(df), last(l) {
     set_tid(tid);
   }
   ~MExportDirFinish() override {}
diff --git a/src/messages/MExportDirNotify.h b/src/messages/MExportDirNotify.h
index 10962afe818d..a33881882ce9 100644
--- a/src/messages/MExportDirNotify.h
+++ b/src/messages/MExportDirNotify.h
@@ -17,7 +17,7 @@
 
 #include "msg/Message.h"
 
-class MExportDirNotify : public Message {
+class MExportDirNotify : public SafeMessage {
 private:
   static const int HEAD_VERSION = 1;
   static const int COMPAT_VERSION = 1;
@@ -37,9 +37,9 @@ private:
 
 protected:
   MExportDirNotify() :
-    Message{MSG_MDS_EXPORTDIRNOTIFY, HEAD_VERSION, COMPAT_VERSION} {}
+    SafeMessage{MSG_MDS_EXPORTDIRNOTIFY, HEAD_VERSION, COMPAT_VERSION} {}
   MExportDirNotify(dirfrag_t i, uint64_t tid, bool a, pair<__s32,__s32> oa, pair<__s32,__s32> na) :
-    Message{MSG_MDS_EXPORTDIRNOTIFY, HEAD_VERSION, COMPAT_VERSION},
+    SafeMessage{MSG_MDS_EXPORTDIRNOTIFY, HEAD_VERSION, COMPAT_VERSION},
     base(i), ack(a), old_auth(oa), new_auth(na) {
     set_tid(tid);
   }
diff --git a/src/messages/MExportDirNotifyAck.h b/src/messages/MExportDirNotifyAck.h
index 06796fc15108..5bb6616fd34c 100644
--- a/src/messages/MExportDirNotifyAck.h
+++ b/src/messages/MExportDirNotifyAck.h
@@ -17,7 +17,7 @@
 
 #include "msg/Message.h"
 
-class MExportDirNotifyAck : public Message {
+class MExportDirNotifyAck : public SafeMessage {
 private:
   static const int HEAD_VERSION = 1;
   static const int COMPAT_VERSION = 1;
@@ -31,9 +31,9 @@ private:
   
 protected:
   MExportDirNotifyAck() :
-    Message{MSG_MDS_EXPORTDIRNOTIFYACK, HEAD_VERSION, COMPAT_VERSION} {}
+    SafeMessage{MSG_MDS_EXPORTDIRNOTIFYACK, HEAD_VERSION, COMPAT_VERSION} {}
   MExportDirNotifyAck(dirfrag_t df, uint64_t tid, pair<__s32,__s32> na) :
-    Message{MSG_MDS_EXPORTDIRNOTIFYACK, HEAD_VERSION, COMPAT_VERSION}, dirfrag(df), new_auth(na) {
+    SafeMessage{MSG_MDS_EXPORTDIRNOTIFYACK, HEAD_VERSION, COMPAT_VERSION}, dirfrag(df), new_auth(na) {
     set_tid(tid);
   }
   ~MExportDirNotifyAck() override {}
diff --git a/src/messages/MExportDirPrep.h b/src/messages/MExportDirPrep.h
index f98fbc385d1b..7500c5ab070b 100644
--- a/src/messages/MExportDirPrep.h
+++ b/src/messages/MExportDirPrep.h
@@ -19,7 +19,7 @@
 #include "msg/Message.h"
 #include "include/types.h"
 
-class MExportDirPrep : public Message {
+class MExportDirPrep : public SafeMessage {
 private:
   static const int HEAD_VERSION = 1;
   static const int COMPAT_VERSION = 1;
@@ -44,7 +44,7 @@ public:
 protected:
   MExportDirPrep() = default;
   MExportDirPrep(dirfrag_t df, uint64_t tid) :
-    Message{MSG_MDS_EXPORTDIRPREP, HEAD_VERSION, COMPAT_VERSION},
+    SafeMessage{MSG_MDS_EXPORTDIRPREP, HEAD_VERSION, COMPAT_VERSION},
     dirfrag(df)
   {
     set_tid(tid);
diff --git a/src/messages/MExportDirPrepAck.h b/src/messages/MExportDirPrepAck.h
index 217d13e4ac46..1792185e95b3 100644
--- a/src/messages/MExportDirPrepAck.h
+++ b/src/messages/MExportDirPrepAck.h
@@ -18,7 +18,7 @@
 #include "msg/Message.h"
 #include "include/types.h"
 
-class MExportDirPrepAck : public Message {
+class MExportDirPrepAck : public SafeMessage {
 private:
   static const int HEAD_VERSION = 1;
   static const int COMPAT_VERSION = 1;
@@ -31,9 +31,9 @@ private:
 
 protected:
   MExportDirPrepAck() :
-    Message{MSG_MDS_EXPORTDIRPREPACK, HEAD_VERSION, COMPAT_VERSION} {}
+    SafeMessage{MSG_MDS_EXPORTDIRPREPACK, HEAD_VERSION, COMPAT_VERSION} {}
   MExportDirPrepAck(dirfrag_t df, bool s, uint64_t tid) :
-    Message{MSG_MDS_EXPORTDIRPREPACK, HEAD_VERSION, COMPAT_VERSION}, dirfrag(df), success(s) {
+    SafeMessage{MSG_MDS_EXPORTDIRPREPACK, HEAD_VERSION, COMPAT_VERSION}, dirfrag(df), success(s) {
     set_tid(tid);
   }
   ~MExportDirPrepAck() override {}
diff --git a/src/messages/MInodeFileCaps.h b/src/messages/MInodeFileCaps.h
index ab02f66286e2..506594d34ae1 100644
--- a/src/messages/MInodeFileCaps.h
+++ b/src/messages/MInodeFileCaps.h
@@ -18,7 +18,7 @@
 
 #include "msg/Message.h"
 
-class MInodeFileCaps : public Message {
+class MInodeFileCaps : public SafeMessage {
 private:
   static constexpr int HEAD_VERSION = 1;
   static constexpr int COMPAT_VERSION = 1;
@@ -30,9 +30,9 @@ public:
   int       get_caps() const { return caps; }
 
 protected:
-  MInodeFileCaps() : Message(MSG_MDS_INODEFILECAPS, HEAD_VERSION, COMPAT_VERSION) {}
+  MInodeFileCaps() : SafeMessage(MSG_MDS_INODEFILECAPS, HEAD_VERSION, COMPAT_VERSION) {}
   MInodeFileCaps(inodeno_t ino, int caps) :
-    Message(MSG_MDS_INODEFILECAPS, HEAD_VERSION, COMPAT_VERSION) {
+    SafeMessage(MSG_MDS_INODEFILECAPS, HEAD_VERSION, COMPAT_VERSION) {
     this->ino = ino;
     this->caps = caps;
   }
diff --git a/src/messages/MLock.h b/src/messages/MLock.h
index 1b284cdb2d29..76a57feaa849 100644
--- a/src/messages/MLock.h
+++ b/src/messages/MLock.h
@@ -20,7 +20,7 @@
 #include "mds/locks.h"
 #include "mds/SimpleLock.h"
 
-class MLock : public Message {
+class MLock : public SafeMessage {
 private:
   static const int HEAD_VERSION = 1;
   static const int COMPAT_VERSION = 1;
@@ -46,19 +46,19 @@ public:
   MDSCacheObjectInfo &get_object_info() { return object_info; }
 
 protected:
-  MLock() : Message{MSG_MDS_LOCK, HEAD_VERSION, COMPAT_VERSION} {}
+  MLock() : SafeMessage{MSG_MDS_LOCK, HEAD_VERSION, COMPAT_VERSION} {}
   MLock(int ac, mds_rank_t as) :
-    Message{MSG_MDS_LOCK, HEAD_VERSION, COMPAT_VERSION},
+    SafeMessage{MSG_MDS_LOCK, HEAD_VERSION, COMPAT_VERSION},
     action(ac), asker(as),
     lock_type(0) { }
   MLock(SimpleLock *lock, int ac, mds_rank_t as) :
-    Message{MSG_MDS_LOCK, HEAD_VERSION, COMPAT_VERSION},
+    SafeMessage{MSG_MDS_LOCK, HEAD_VERSION, COMPAT_VERSION},
     action(ac), asker(as),
     lock_type(lock->get_type()) {
     lock->get_parent()->set_object_info(object_info);
   }
   MLock(SimpleLock *lock, int ac, mds_rank_t as, bufferlist& bl) :
-    Message{MSG_MDS_LOCK, HEAD_VERSION, COMPAT_VERSION},
+    SafeMessage{MSG_MDS_LOCK, HEAD_VERSION, COMPAT_VERSION},
     action(ac), asker(as), lock_type(lock->get_type()) {
     lock->get_parent()->set_object_info(object_info);
     lockdata.claim(bl);
diff --git a/src/messages/MMDSCacheRejoin.h b/src/messages/MMDSCacheRejoin.h
index a41711832567..8a8f35a886d0 100644
--- a/src/messages/MMDSCacheRejoin.h
+++ b/src/messages/MMDSCacheRejoin.h
@@ -27,7 +27,7 @@
 
 // sent from replica to auth
 
-class MMDSCacheRejoin : public Message {
+class MMDSCacheRejoin : public SafeMessage {
 public:
   static constexpr int OP_WEAK    = 1;  // replica -> auth, i exist, + maybe open files.
   static constexpr int OP_STRONG  = 2;  // replica -> auth, i exist, + open files and lock state.
@@ -348,7 +348,7 @@ private:
   static constexpr int COMPAT_VERSION = 1;
 
   MMDSCacheRejoin(int o) : MMDSCacheRejoin() { op = o; }
-  MMDSCacheRejoin() : Message{MSG_MDS_CACHEREJOIN, HEAD_VERSION, COMPAT_VERSION} {}
+  MMDSCacheRejoin() : SafeMessage{MSG_MDS_CACHEREJOIN, HEAD_VERSION, COMPAT_VERSION} {}
   ~MMDSCacheRejoin() override {}
 };
 
diff --git a/src/messages/MMDSFindIno.h b/src/messages/MMDSFindIno.h
index 49737ee2191f..1c14f5be7cb3 100644
--- a/src/messages/MMDSFindIno.h
+++ b/src/messages/MMDSFindIno.h
@@ -18,7 +18,7 @@
 #include "msg/Message.h"
 #include "include/filepath.h"
 
-class MMDSFindIno : public Message {
+class MMDSFindIno : public SafeMessage {
   static const int HEAD_VERSION = 1;
   static const int COMPAT_VERSION = 1;
 public:
@@ -26,8 +26,8 @@ public:
   inodeno_t ino;
 
 protected:
-  MMDSFindIno() : Message{MSG_MDS_FINDINO, HEAD_VERSION, COMPAT_VERSION} {}
-  MMDSFindIno(ceph_tid_t t, inodeno_t i) : Message{MSG_MDS_FINDINO, HEAD_VERSION, COMPAT_VERSION}, tid(t), ino(i) {}
+  MMDSFindIno() : SafeMessage{MSG_MDS_FINDINO, HEAD_VERSION, COMPAT_VERSION} {}
+  MMDSFindIno(ceph_tid_t t, inodeno_t i) : SafeMessage{MSG_MDS_FINDINO, HEAD_VERSION, COMPAT_VERSION}, tid(t), ino(i) {}
   ~MMDSFindIno() override {}
 
 public:
diff --git a/src/messages/MMDSFindInoReply.h b/src/messages/MMDSFindInoReply.h
index dfb2202e4cc9..7fe13bb5cd2e 100644
--- a/src/messages/MMDSFindInoReply.h
+++ b/src/messages/MMDSFindInoReply.h
@@ -18,7 +18,7 @@
 #include "msg/Message.h"
 #include "include/filepath.h"
 
-class MMDSFindInoReply : public Message {
+class MMDSFindInoReply : public SafeMessage {
   static const int HEAD_VERSION = 1;
   static const int COMPAT_VERSION = 1;
 public:
@@ -26,8 +26,8 @@ public:
   filepath path;
 
 protected:
-  MMDSFindInoReply() : Message{MSG_MDS_FINDINOREPLY, HEAD_VERSION, COMPAT_VERSION} {}
-  MMDSFindInoReply(ceph_tid_t t) : Message{MSG_MDS_FINDINOREPLY, HEAD_VERSION, COMPAT_VERSION}, tid(t) {}
+  MMDSFindInoReply() : SafeMessage{MSG_MDS_FINDINOREPLY, HEAD_VERSION, COMPAT_VERSION} {}
+  MMDSFindInoReply(ceph_tid_t t) : SafeMessage{MSG_MDS_FINDINOREPLY, HEAD_VERSION, COMPAT_VERSION}, tid(t) {}
   ~MMDSFindInoReply() override {}
 
 public:
diff --git a/src/messages/MMDSFragmentNotify.h b/src/messages/MMDSFragmentNotify.h
index 3a12ccb11e3e..9a896f1177d8 100644
--- a/src/messages/MMDSFragmentNotify.h
+++ b/src/messages/MMDSFragmentNotify.h
@@ -17,7 +17,7 @@
 
 #include "msg/Message.h"
 
-class MMDSFragmentNotify : public Message {
+class MMDSFragmentNotify : public SafeMessage {
 private:
   static constexpr int HEAD_VERSION = 2;
   static constexpr int COMPAT_VERSION = 1;
@@ -38,9 +38,9 @@ private:
 
 protected:
   MMDSFragmentNotify() :
-    Message{MSG_MDS_FRAGMENTNOTIFY, HEAD_VERSION, COMPAT_VERSION} {}
+    SafeMessage{MSG_MDS_FRAGMENTNOTIFY, HEAD_VERSION, COMPAT_VERSION} {}
   MMDSFragmentNotify(dirfrag_t df, int b, uint64_t tid) :
-    Message{MSG_MDS_FRAGMENTNOTIFY, HEAD_VERSION, COMPAT_VERSION},
+    SafeMessage{MSG_MDS_FRAGMENTNOTIFY, HEAD_VERSION, COMPAT_VERSION},
     base_dirfrag(df), bits(b) {
     set_tid(tid);
   }
diff --git a/src/messages/MMDSFragmentNotifyAck.h b/src/messages/MMDSFragmentNotifyAck.h
index a067dfc36d2e..e78a0f2df261 100644
--- a/src/messages/MMDSFragmentNotifyAck.h
+++ b/src/messages/MMDSFragmentNotifyAck.h
@@ -17,7 +17,7 @@
 
 #include "msg/Message.h"
 
-class MMDSFragmentNotifyAck : public Message {
+class MMDSFragmentNotifyAck : public SafeMessage {
 private:
   dirfrag_t base_dirfrag;
   int8_t bits = 0;
@@ -29,9 +29,9 @@ private:
   bufferlist basebl;
 
 protected:
-  MMDSFragmentNotifyAck() : Message{MSG_MDS_FRAGMENTNOTIFYACK} {}
+  MMDSFragmentNotifyAck() : SafeMessage{MSG_MDS_FRAGMENTNOTIFYACK} {}
   MMDSFragmentNotifyAck(dirfrag_t df, int b, uint64_t tid) :
-    Message{MSG_MDS_FRAGMENTNOTIFYACK},
+    SafeMessage{MSG_MDS_FRAGMENTNOTIFYACK},
     base_dirfrag(df), bits(b) {
     set_tid(tid);
   }
diff --git a/src/messages/MMDSMap.h b/src/messages/MMDSMap.h
index ed10459ef62b..31bff0066295 100644
--- a/src/messages/MMDSMap.h
+++ b/src/messages/MMDSMap.h
@@ -20,7 +20,7 @@
 #include "mds/MDSMap.h"
 #include "include/ceph_features.h"
 
-class MMDSMap : public Message {
+class MMDSMap : public SafeMessage {
 private:
   static constexpr int HEAD_VERSION = 1;
   static constexpr int COMPAT_VERSION = 1;
@@ -34,9 +34,9 @@ public:
 
 protected:
   MMDSMap() : 
-    Message{CEPH_MSG_MDS_MAP, HEAD_VERSION, COMPAT_VERSION} {}
+    SafeMessage{CEPH_MSG_MDS_MAP, HEAD_VERSION, COMPAT_VERSION} {}
   MMDSMap(const uuid_d &f, const MDSMap &mm) :
-    Message{CEPH_MSG_MDS_MAP, HEAD_VERSION, COMPAT_VERSION},
+    SafeMessage{CEPH_MSG_MDS_MAP, HEAD_VERSION, COMPAT_VERSION},
     fsid(f) {
     epoch = mm.get_epoch();
     mm.encode(encoded, -1);  // we will reencode with fewer features as necessary
diff --git a/src/messages/MMDSOpenIno.h b/src/messages/MMDSOpenIno.h
index 7182c8055521..e37f070eb5df 100644
--- a/src/messages/MMDSOpenIno.h
+++ b/src/messages/MMDSOpenIno.h
@@ -17,7 +17,7 @@
 
 #include "msg/Message.h"
 
-class MMDSOpenIno : public Message {
+class MMDSOpenIno : public SafeMessage {
   static const int HEAD_VERSION = 1;
   static const int COMPAT_VERSION = 1;
 public:
@@ -25,9 +25,9 @@ public:
   vector<inode_backpointer_t> ancestors;
 
 protected:
-  MMDSOpenIno() : Message{MSG_MDS_OPENINO, HEAD_VERSION, COMPAT_VERSION} {}
+  MMDSOpenIno() : SafeMessage{MSG_MDS_OPENINO, HEAD_VERSION, COMPAT_VERSION} {}
   MMDSOpenIno(ceph_tid_t t, inodeno_t i, vector<inode_backpointer_t>* pa) :
-    Message{MSG_MDS_OPENINO, HEAD_VERSION, COMPAT_VERSION}, ino(i) {
+    SafeMessage{MSG_MDS_OPENINO, HEAD_VERSION, COMPAT_VERSION}, ino(i) {
     header.tid = t;
     if (pa)
       ancestors = *pa;
diff --git a/src/messages/MMDSOpenInoReply.h b/src/messages/MMDSOpenInoReply.h
index 521065ea3928..37eae8285254 100644
--- a/src/messages/MMDSOpenInoReply.h
+++ b/src/messages/MMDSOpenInoReply.h
@@ -17,7 +17,7 @@
 
 #include "msg/Message.h"
 
-class MMDSOpenInoReply : public Message {
+class MMDSOpenInoReply : public SafeMessage {
 public:
   static const int HEAD_VERSION = 1;
   static const int COMPAT_VERSION = 1;
@@ -27,9 +27,9 @@ public:
   int32_t error;
 
 protected:
-  MMDSOpenInoReply() : Message{MSG_MDS_OPENINOREPLY, HEAD_VERSION, COMPAT_VERSION}, error(0) {}
+  MMDSOpenInoReply() : SafeMessage{MSG_MDS_OPENINOREPLY, HEAD_VERSION, COMPAT_VERSION}, error(0) {}
   MMDSOpenInoReply(ceph_tid_t t, inodeno_t i, mds_rank_t h=MDS_RANK_NONE, int e=0) :
-    Message{MSG_MDS_OPENINOREPLY, HEAD_VERSION, COMPAT_VERSION}, ino(i), hint(h), error(e) {
+    SafeMessage{MSG_MDS_OPENINOREPLY, HEAD_VERSION, COMPAT_VERSION}, ino(i), hint(h), error(e) {
     header.tid = t;
   }
 
diff --git a/src/messages/MMDSResolve.h b/src/messages/MMDSResolve.h
index bd1148c337c6..ec03c22922ca 100644
--- a/src/messages/MMDSResolve.h
+++ b/src/messages/MMDSResolve.h
@@ -21,7 +21,7 @@
 
 #include "mds/Capability.h"
 
-class MMDSResolve : public Message {
+class MMDSResolve : public SafeMessage {
   static const int HEAD_VERSION = 1;
   static const int COMPAT_VERSION = 1;
 
@@ -96,7 +96,7 @@ public:
   list<table_client> table_clients;
 
 protected:
-  MMDSResolve() : Message{MSG_MDS_RESOLVE, HEAD_VERSION, COMPAT_VERSION}
+  MMDSResolve() : SafeMessage{MSG_MDS_RESOLVE, HEAD_VERSION, COMPAT_VERSION}
  {}
   ~MMDSResolve() override {}
 
diff --git a/src/messages/MMDSResolveAck.h b/src/messages/MMDSResolveAck.h
index cea45cb7ee6b..76599d0944fc 100644
--- a/src/messages/MMDSResolveAck.h
+++ b/src/messages/MMDSResolveAck.h
@@ -20,7 +20,7 @@
 #include "include/types.h"
 
 
-class MMDSResolveAck : public Message {
+class MMDSResolveAck : public SafeMessage {
   static const int HEAD_VERSION = 1;
   static const int COMPAT_VERSION = 1;
 public:
@@ -28,7 +28,7 @@ public:
   vector<metareqid_t> abort;
 
 protected:
-  MMDSResolveAck() : Message{MSG_MDS_RESOLVEACK, HEAD_VERSION, COMPAT_VERSION} {}
+  MMDSResolveAck() : SafeMessage{MSG_MDS_RESOLVEACK, HEAD_VERSION, COMPAT_VERSION} {}
   ~MMDSResolveAck() override {}
 
 public:
diff --git a/src/messages/MMDSSlaveRequest.h b/src/messages/MMDSSlaveRequest.h
index ee4a7f55f648..a59a79ac76f4 100644
--- a/src/messages/MMDSSlaveRequest.h
+++ b/src/messages/MMDSSlaveRequest.h
@@ -19,7 +19,7 @@
 #include "msg/Message.h"
 #include "mds/mdstypes.h"
 
-class MMDSSlaveRequest : public Message {
+class MMDSSlaveRequest : public SafeMessage {
   static constexpr int HEAD_VERSION = 1;
   static constexpr int COMPAT_VERSION = 1;
 public:
@@ -158,9 +158,9 @@ public:
   bufferlist& get_lock_data() { return inode_export; }
 
 protected:
-  MMDSSlaveRequest() : Message{MSG_MDS_SLAVE_REQUEST, HEAD_VERSION, COMPAT_VERSION} { }
+  MMDSSlaveRequest() : SafeMessage{MSG_MDS_SLAVE_REQUEST, HEAD_VERSION, COMPAT_VERSION} { }
   MMDSSlaveRequest(metareqid_t ri, __u32 att, int o) : 
-    Message{MSG_MDS_SLAVE_REQUEST, HEAD_VERSION, COMPAT_VERSION},
+    SafeMessage{MSG_MDS_SLAVE_REQUEST, HEAD_VERSION, COMPAT_VERSION},
     reqid(ri), attempt(att), op(o), flags(0), lock_type(0),
     inode_export_v(0), srcdn_auth(MDS_RANK_NONE) { }
   ~MMDSSlaveRequest() override {}
diff --git a/src/messages/MMDSSnapUpdate.h b/src/messages/MMDSSnapUpdate.h
index d63f1a55cc15..13847498ace6 100644
--- a/src/messages/MMDSSnapUpdate.h
+++ b/src/messages/MMDSSnapUpdate.h
@@ -17,7 +17,7 @@
 
 #include "msg/Message.h"
 
-class MMDSSnapUpdate : public Message {
+class MMDSSnapUpdate : public SafeMessage {
 private:
   inodeno_t ino;
   __s16 snap_op;
@@ -29,9 +29,9 @@ public:
   bufferlist snap_blob;
 
 protected:
-  MMDSSnapUpdate() : Message{MSG_MDS_SNAPUPDATE} {}
+  MMDSSnapUpdate() : SafeMessage{MSG_MDS_SNAPUPDATE} {}
   MMDSSnapUpdate(inodeno_t i, version_t tid, int op) :
-    Message{MSG_MDS_SNAPUPDATE}, ino(i), snap_op(op) {
+    SafeMessage{MSG_MDS_SNAPUPDATE}, ino(i), snap_op(op) {
       set_tid(tid);
     }
   ~MMDSSnapUpdate() override {}
diff --git a/src/messages/MMDSTableRequest.h b/src/messages/MMDSTableRequest.h
index 0d929f7961a2..01254d0bbb02 100644
--- a/src/messages/MMDSTableRequest.h
+++ b/src/messages/MMDSTableRequest.h
@@ -19,7 +19,7 @@
 #include "msg/Message.h"
 #include "mds/mds_table_types.h"
 
-class MMDSTableRequest : public Message {
+class MMDSTableRequest : public SafeMessage {
 public:
   __u16 table = 0;
   __s16 op = 0;
@@ -27,9 +27,9 @@ public:
   bufferlist bl;
 
 protected:
-  MMDSTableRequest() : Message{MSG_MDS_TABLE_REQUEST} {}
+  MMDSTableRequest() : SafeMessage{MSG_MDS_TABLE_REQUEST} {}
   MMDSTableRequest(int tab, int o, uint64_t r, version_t v=0) : 
-    Message{MSG_MDS_TABLE_REQUEST},
+    SafeMessage{MSG_MDS_TABLE_REQUEST},
     table(tab), op(o), reqid(r) {
     set_tid(v);
   }