sunrpc: Fix misplaced barrier in call_decode

[ Upstream commit f8f7e0fb22b2e75be55f2f0c13e229e75b0eac07 ]

Fix a misplaced barrier in call_decode. The struct rpc_rqst is modified
as follows by xprt_complete_rqst:

req->rq_private_buf.len = copied;
/* Ensure all writes are done before we update */
/* req->rq_reply_bytes_recvd */
smp_wmb();
req->rq_reply_bytes_recvd = copied;

And currently read as follows by call_decode:

smp_rmb(); // misplaced
if (!req->rq_reply_bytes_recvd)
   goto out;
req->rq_rcv_buf.len = req->rq_private_buf.len;

This patch places the smp_rmb after the if to ensure that
rq_reply_bytes_recvd and rq_private_buf.len are read in order.

Fixes: 9ba828861c56a ("SUNRPC: Don't try to parse incomplete RPC messages")
Signed-off-by: Baptiste Lepers <baptiste.lepers@gmail.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index 69d8843..4a0e8e4 100644 (file)
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -2460,12 +2460,6 @@ call_decode(struct rpc_task *task)
        }
 
        /*
-        * Ensure that we see all writes made by xprt_complete_rqst()
-        * before it changed req->rq_reply_bytes_recvd.
-        */
-       smp_rmb();
-
-       /*
         * Did we ever call xprt_complete_rqst()? If not, we should assume
         * the message is incomplete.
         */
@@ -2473,6 +2467,11 @@ call_decode(struct rpc_task *task)
        if (!req->rq_reply_bytes_recvd)
                goto out;
 
+       /* Ensure that we see all writes made by xprt_complete_rqst()
+        * before it changed req->rq_reply_bytes_recvd.
+        */
+       smp_rmb();
+
        req->rq_rcv_buf.len = req->rq_private_buf.len;
        trace_rpc_xdr_recvfrom(task, &req->rq_rcv_buf);