Commit aa88278693cb for kernel

commit aa88278693cbfaf7a2acf961379973fbb63b165c
Author: Gui-Dong Han <hanguidong02@gmail.com>
Date:   Fri May 29 15:54:41 2026 +0800

    9p: Add missing read barrier in virtio zero-copy path

    Commit 2b6e72ed747f ("9P: Add memory barriers to protect request
    fields over cb/rpc threads handoff") added a read barrier after
    p9_client_rpc() waits for req->status, pairing with the write barrier in
    p9_client_cb(). The virtio zero-copy wait path was missed.

    Add the same read barrier after the zero-copy wait before reading the
    completed request.

    Fixes: 2b6e72ed747f ("9P: Add memory barriers to protect request fields over cb/rpc threads handoff")
    Signed-off-by: Gui-Dong Han <hanguidong02@gmail.com>
    Message-ID: <20260529075441.233369-1-hanguidong02@gmail.com>
    Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>

diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
index 4cdab7094b27..b0d0094ec8e2 100644
--- a/net/9p/trans_virtio.c
+++ b/net/9p/trans_virtio.c
@@ -532,6 +532,11 @@ p9_virtio_zc_request(struct p9_client *client, struct p9_req_t *req,
 	p9_debug(P9_DEBUG_TRANS, "virtio request kicked\n");
 	err = io_wait_event_killable(req->wq,
 				     READ_ONCE(req->status) >= REQ_STATUS_RCVD);
+	/*
+	 * Make sure our req is coherent with regard to updates in other
+	 * threads - echoes to wmb() in the callback
+	 */
+	smp_rmb();
 	// RERROR needs reply (== error string) in static data
 	if (READ_ONCE(req->status) == REQ_STATUS_RCVD &&
 	    unlikely(req->rc.sdata[4] == P9_RERROR))