[PATCH net 1/2] ionic: add missing dma_rmb() after the completion publish check
From: Eric Joyner <hidden>
Date: 2026-08-11 19:51:08
Subsystem:
networking drivers, pensando ethernet drivers, the rest · Maintainers:
Andrew Lunn, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Brett Creeley, Linus Torvalds
Each completion service routine tests a device-written publish flag and
then reads the rest of the descriptor with nothing ordering those loads.
A control dependency does not order loads, so a weakly ordered CPU may
satisfy the payload reads from a cache line state observed before the
flag became valid. Add the barrier to all four completion paths.
Fixes: 1d062b7b6f64 ("ionic: Add basic adminq support")
Fixes: 0f3154e6bcb3 ("ionic: Add Tx and Rx handling")
Fixes: 77ceb68e29cc ("ionic: Add notifyq support")
Assisted-by: Claude:claude-opus-5
Signed-off-by: Eric Joyner <redacted>
Reviewed-by: Brett Creeley <brett.creeley@amd.com>
---
drivers/net/ethernet/pensando/ionic/ionic_main.c | 4 ++++
drivers/net/ethernet/pensando/ionic/ionic_txrx.c | 4 ++++
2 files changed, 8 insertions(+)
diff --git a/drivers/net/ethernet/pensando/ionic/ionic_main.c b/drivers/net/ethernet/pensando/ionic/ionic_main.c
index 6e6f3ed07271..10501be9ef95 100644
--- a/drivers/net/ethernet/pensando/ionic/ionic_main.c
+++ b/drivers/net/ethernet/pensando/ionic/ionic_main.c@@ -269,6 +269,8 @@ bool ionic_notifyq_service(struct ionic_cq *cq) if ((s64)(eid - lif->last_eid) <= 0) return false; + dma_rmb(); + lif->last_eid = eid; dev_dbg(lif->ionic->dev, "notifyq event:\n");
@@ -314,6 +316,8 @@ bool ionic_adminq_service(struct ionic_cq *cq) if (!color_match(comp->color, cq->done_color)) return false; + dma_rmb(); + /* check for empty queue */ if (q->tail_idx == q->head_idx) return false;
diff --git a/drivers/net/ethernet/pensando/ionic/ionic_txrx.c b/drivers/net/ethernet/pensando/ionic/ionic_txrx.c
index 301ebee2fdc5..5b58460350be 100644
--- a/drivers/net/ethernet/pensando/ionic/ionic_txrx.c
+++ b/drivers/net/ethernet/pensando/ionic/ionic_txrx.c@@ -734,6 +734,8 @@ static bool __ionic_rx_service(struct ionic_cq *cq, struct bpf_prog *xdp_prog) if (!color_match(comp->pkt_type_color, cq->done_color)) return false; + dma_rmb(); + /* check for empty queue */ if (q->tail_idx == q->head_idx) return false;
@@ -1249,6 +1251,8 @@ static bool ionic_tx_service(struct ionic_cq *cq, if (!color_match(comp->color, cq->done_color)) return false; + dma_rmb(); + /* clean the related q entries, there could be * several q entries completed for each cq completion */
--
2.43.0