[PATCH net-next v4 03/10] NTB: ntb_transport: Order RX entry completion
flat view
COOLING4d
From: Koichiro Den <hidden>
Date: 2026-09-14 08:48:51
Also in:
lkml
Subsystem:
ntb driver core, the rest · Maintainers:
Jon Mason, Dave Jiang, Allen Hubbe, Linus Torvalds
Revision v4 of 3 in this series.
Revisions (3)
- v2 [diff vs current]
- v3 [diff vs current]
- v4 current
RX entries are added to rx_post_q before their fields are filled in.
The overflow path sets DONE without a write barrier, and
ntb_complete_rxc() has no read barrier after checking DONE. A concurrent
completion can therefore consume stale entry fields.
Publish DONE with release ordering and check it with acquire ordering in
ntb_complete_rxc(). Use the same publication rule in the copy callback.
Fixes: da2e5ae56164 ("NTB: Fix ntb_transport out-of-order RX update")
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260904052134.2970111-1-den%40valinux.co.jp?part=3
Signed-off-by: Koichiro Den <redacted>
---
Changes in v4:
- New patch (Sashiko)
drivers/ntb/ntb_transport.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/ntb/ntb_transport.c b/drivers/ntb/ntb_transport.c
index 3f497a62673f..b69e8ac8047d 100644
--- a/drivers/ntb/ntb_transport.c
+++ b/drivers/ntb/ntb_transport.c@@ -1443,7 +1443,8 @@ static void ntb_complete_rxc(struct ntb_transport_qp *qp) while (!list_empty(&qp->rx_post_q)) { entry = list_first_entry(&qp->rx_post_q, struct ntb_queue_entry, entry); - if (!(entry->flags & DESC_DONE_FLAG)) + /* DONE publishes the entry fields and copied data. */ + if (!(smp_load_acquire(&entry->flags) & DESC_DONE_FLAG)) break; entry->rx_hdr->flags = cpu_to_le32(0);
@@ -1496,7 +1497,8 @@ static void ntb_rx_copy_callback(void *data, } } - entry->flags |= DESC_DONE_FLAG; + /* Pair with the acquire load in ntb_complete_rxc(). */ + smp_store_release(&entry->flags, entry->flags | DESC_DONE_FLAG); ntb_complete_rxc(entry->qp); }
@@ -1664,7 +1666,8 @@ static int ntb_process_rxc(struct ntb_transport_qp *qp) qp->rx_err_oflow++; entry->len = -EIO; - entry->flags |= DESC_DONE_FLAG; + /* Pair with the acquire load in ntb_complete_rxc(). */ + smp_store_release(&entry->flags, entry->flags | DESC_DONE_FLAG); ntb_complete_rxc(qp); } else {
--
2.51.0