doc: Update list_for_each_entry_rcu() documentation

to use rcu_dereference_protected() if either the RCU-protected pointer

or the RCU-protected data that it points to can change concurrently.

There are currently only "universal" versions of the rcu_assign_pointer()

and RCU list-/tree-traversal primitives, which do not (yet) check for

being in an RCU read-side critical section.  In the future, separate

versions of these primitives might be created.

Like rcu_dereference(), when lockdep is enabled, RCU list and hlist

traversal primitives check for being called from within an RCU read-side

critical section.  However, a lockdep expression can be passed to them

as a additional optional argument.  With this lockdep expression, these

traversal primitives will complain only if the lockdep expression is

false and they are called from outside any RCU read-side critical section.

For example, the workqueue for_each_pwq() macro is intended to be used

either within an RCU read-side critical section or with wq->mutex held.

It is thus implemented as follows:

	#define for_each_pwq(pwq, wq)

		list_for_each_entry_rcu((pwq), &(wq)->pwqs, pwqs_node,

					lock_is_held(&(wq->mutex).dep_map))

	at any time, including immediately after the rcu_dereference().

	And, again like rcu_assign_pointer(), rcu_dereference() is

	typically used indirectly, via the _rcu list-manipulation

	primitives, such as list_for_each_entry_rcu().

	primitives, such as list_for_each_entry_rcu() [2].

	[1] The variant rcu_dereference_protected() can be used outside

	of an RCU read-side critical section as long as the usage is

	a lockdep splat is emitted.  See Documentation/RCU/Design/Requirements/Requirements.rst

	and the API's code comments for more details and example usage.

	[2] If the list_for_each_entry_rcu() instance might be used by

	update-side code as well as by RCU readers, then an additional

	lockdep expression can be added to its list of arguments.

	For example, given an additional "lock_is_held(&mylock)" argument,

	the RCU lockdep code would complain only if this instance was

	invoked outside of an RCU read-side critical section and without

	the protection of mylock.

The following diagram shows how each API communicates among the

reader, updater, and reclaimer.