From 7e38b56bb58365713d773190bb7b9809442ce5f3 Mon Sep 17 00:00:00 2001
From: VinayBhaskar-V <vvarada@redhat.com>
Date: Wed, 16 Apr 2025 21:22:21 +0530
Subject: [PATCH] rbd-mirror: release lock before calling
 m_async_op_tracker.finish_op()

m_async_op_tracker.finish_op() in InstanceReplayer::start_image_replayers
may invoke a completion that re-enters code paths that attempt to acquire
the same mutex (m_lock), violating the non-recursive lock constraint.
This can be fixed by releasing the lock before calling
m_async_op_tracker.finish_op().

Fixes: https://tracker.ceph.com/issues/70951
Signed-off-by: VinayBhaskar-V <vvarada@redhat.com>
(cherry picked from commit 07e44074ae5d18dc1248e557fd1aa2dbe39792c6)
---
 src/tools/rbd_mirror/InstanceReplayer.cc | 15 ++++++++++-----
 src/tools/rbd_mirror/InstanceReplayer.h  |  1 +
 2 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/src/tools/rbd_mirror/InstanceReplayer.cc b/src/tools/rbd_mirror/InstanceReplayer.cc
index 54244b52ceb43..f278ab09bc14d 100644
--- a/src/tools/rbd_mirror/InstanceReplayer.cc
+++ b/src/tools/rbd_mirror/InstanceReplayer.cc
@@ -370,12 +370,9 @@ void InstanceReplayer<I>::queue_start_image_replayers() {
 }
 
 template <typename I>
-void InstanceReplayer<I>::start_image_replayers(int r) {
-  dout(10) << dendl;
-
-  std::lock_guard locker{m_lock};
+void InstanceReplayer<I>::start_image_replayers(
+    const std::unique_lock<ceph::mutex>&) {
   if (m_on_shut_down != nullptr) {
-    m_async_op_tracker.finish_op();
     return;
   }
 
@@ -407,7 +404,15 @@ void InstanceReplayer<I>::start_image_replayers(int r) {
   m_service_daemon->add_or_update_namespace_attribute(
     m_local_io_ctx.get_id(), m_local_io_ctx.get_namespace(),
     SERVICE_DAEMON_ERROR_COUNT_KEY, error_count);
+}
 
+template <typename I>
+void InstanceReplayer<I>::start_image_replayers(int r) {
+  dout(10) << dendl;
+  {
+    std::unique_lock locker{m_lock};
+    start_image_replayers(locker);
+  }
   m_async_op_tracker.finish_op();
 }
 
diff --git a/src/tools/rbd_mirror/InstanceReplayer.h b/src/tools/rbd_mirror/InstanceReplayer.h
index 7a5c79723d3e6..5399c6994a5a6 100644
--- a/src/tools/rbd_mirror/InstanceReplayer.h
+++ b/src/tools/rbd_mirror/InstanceReplayer.h
@@ -118,6 +118,7 @@ private:
 
   void start_image_replayer(ImageReplayer<ImageCtxT> *image_replayer);
   void queue_start_image_replayers();
+  void start_image_replayers(const std::unique_lock<ceph::mutex>&);
   void start_image_replayers(int r);
 
   void stop_image_replayer(ImageReplayer<ImageCtxT> *image_replayer,
-- 
2.39.5