Commit 17c4476dbb9c for kernel

commit 17c4476dbb9c3bfd34193a6c22f2c3da8747134a
Author: Allison Henderson <achender@kernel.org>
Date:   Fri Aug 28 15:39:16 2026 -0700

    net/rds: use clear_bit_unlock() in release_refill()

    release_refill() drops the RDS_RECV_REFILL bit with a plain
    clear_bit().  clear_bit() has no ordering semantics, and the
    smp_mb__after_atomic() that follows it sits on the wrong side for a
    lock release: it orders the clear against the waitqueue_active() load
    below it, but does nothing to order the refill critical section's ring
    and descriptor stores before the clear itself.

    That matters once connection teardown owns RDS_RECV_REFILL as a lock
    across the transport shutdown and path reset, rather than sampling it
    clear, which "net/rds: acquire the fastpath locks in
    rds_conn_shutdown()" later in this series arranges: on a weakly
    ordered architecture the teardown can win the bit and start the
    shutdown and reset while some of the refill's stores are not yet
    visible to it.  The same gap existed under the sample-based scheme - a
    waiter that saw the bit clear had no guarantee it also observed the
    refill's stores - but taking the bit as a lock makes the missing
    release pairing load-bearing.

    Switch to clear_bit_unlock(), which orders the critical section before
    the release, and replace the open-coded barrier-plus-waitqueue_active()
    with wq_has_sleeper(), whose internal full barrier keeps the
    store-buffering guarantee between clearing the bit and checking for
    sleepers.  This mirrors what "net/rds: use wq_has_sleeper() in
    release_in_xmit()" does for RDS_IN_XMIT.

    The fast-path acquire side, acquire_refill(), uses test_and_set_bit(),
    a full-barrier RMW that pairs with this release.  The teardown at this
    point in the series still samples the bit, so on its own this change
    is release-side hardening; the shutdown-conversion patch named above
    makes the teardown acquire the bit with the same RMW, completing the
    pairing at the end of the series.

    Fixes: 73ce4317bf98 ("RDS: make sure we post recv buffers")
    Signed-off-by: Allison Henderson <achender@kernel.org>
    Link: https://patch.msgid.link/20260828223921.202913-3-achender@kernel.org
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/rds/ib_recv.c b/net/rds/ib_recv.c
index 357128d34a54..a6983861eec7 100644
--- a/net/rds/ib_recv.c
+++ b/net/rds/ib_recv.c
@@ -363,15 +363,14 @@ static int acquire_refill(struct rds_connection *conn)

 static void release_refill(struct rds_connection *conn)
 {
-	clear_bit(RDS_RECV_REFILL, &conn->c_flags);
-	smp_mb__after_atomic();
+	clear_bit_unlock(RDS_RECV_REFILL, &conn->c_flags);

 	/* We don't use wait_on_bit()/wake_up_bit() because our waking is in a
 	 * hot path and finding waiters is very rare.  We don't want to walk
 	 * the system-wide hashed waitqueue buckets in the fast path only to
 	 * almost never find waiters.
 	 */
-	if (waitqueue_active(&conn->c_waitq))
+	if (wq_has_sleeper(&conn->c_waitq))
 		wake_up_all(&conn->c_waitq);
 }