[PATCH] 9p: Add missing read barrier in virtio zero-copy path

[PATCH] 9p: Add missing read barrier in virtio zero-copy path

[Gui-Dong Han]

Commit 2b6e72ed747f ("9P: Add memory barriers to protect request
fields over cb/rpc threads handoff") added a read barrier after
p9_client_rpc() waits for req->status, pairing with the write barrier in
p9_client_cb(). The virtio zero-copy wait path was missed.

Add the same read barrier after the zero-copy wait before reading the
completed request.

Fixes: abfa034e4b8e ("fs/9p: Update zero-copy implementation in 9p")
Signed-off-by: Gui-Dong Han <hanguidong02@gmail.com>
---
Found by auditing READ_ONCE() used for synchronization.
A similar fix can be found in 8df672bfe3ec.
---
 net/9p/trans_virtio.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
index 4cdab7094b27..b0d0094ec8e2 100644
--- a/net/9p/trans_virtio.c
+++ b/net/9p/trans_virtio.c
@@ -532,6 +532,11 @@ p9_virtio_zc_request(struct p9_client *client, struct p9_req_t *req,
 	p9_debug(P9_DEBUG_TRANS, "virtio request kicked\n");
 	err = io_wait_event_killable(req->wq,
 				     READ_ONCE(req->status) >= REQ_STATUS_RCVD);
+	/*
+	 * Make sure our req is coherent with regard to updates in other
+	 * threads - echoes to wmb() in the callback
+	 */
+	smp_rmb();
 	// RERROR needs reply (== error string) in static data
 	if (READ_ONCE(req->status) == REQ_STATUS_RCVD &&
 	    unlikely(req->rc.sdata[4] == P9_RERROR))
-- 
2.34.1

Re: [PATCH] 9p: Add missing read barrier in virtio zero-copy path

[Dominique Martinet]

Gui-Dong Han wrote on Fri, May 29, 2026 at 03:54:41PM +0800:
> Commit 2b6e72ed747f ("9P: Add memory barriers to protect request
> fields over cb/rpc threads handoff") added a read barrier after
> p9_client_rpc() waits for req->status, pairing with the write barrier in
> p9_client_cb(). The virtio zero-copy wait path was missed.
> 
> Add the same read barrier after the zero-copy wait before reading the
> completed request.
> 
> Fixes: abfa034e4b8e ("fs/9p: Update zero-copy implementation in 9p")

This doesn't make sense, the wmb was added a few years later, so I guess
this should be
Fixes: 2b6e72ed747f ("9P: Add memory barriers to protect request fields over cb/rpc threads handoff")

With that said, a rmb here makes sense, so picking up (with fix tag
fixed up)

-- 
Dominique