Commit 5c6ce05e4065 for kernel

commit 5c6ce05e406520290c1d89da97fb3cd70c09137d
Author: David Howells <dhowells@redhat.com>
Date:   Thu Jul 2 09:23:02 2026 +0100

    netfs: Fix barriering when walking subrequest list

    Fix the barriering used when walking the subrequest list in retry as
    there's a possibility of seeing a subreq that's just been added by the
    application thread.

    Fixes: ee4cdf7ba857 ("netfs: Speed up buffered reading")
    Fixes: 288ace2f57c9 ("netfs: New writeback implementation")
    Link: https://sashiko.dev/#/patchset/20260608145432.681865-1-dhowells%40redhat.com
    Signed-off-by: David Howells <dhowells@redhat.com>
    Link: https://patch.msgid.link/138807.1782980582@warthog.procyon.org.uk
    Reviewed-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
    cc: Paulo Alcantara <pc@manguebit.org>
    cc: netfs@lists.linux.dev
    cc: linux-fsdevel@vger.kernel.org
    Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>

diff --git a/fs/netfs/read_retry.c b/fs/netfs/read_retry.c
index f59a70f3a086..2b42758e01ec 100644
--- a/fs/netfs/read_retry.c
+++ b/fs/netfs/read_retry.c
@@ -98,7 +98,12 @@ static void netfs_retry_read_subrequests(struct netfs_io_request *rreq)
 			goto abandon;
 		}

-		list_for_each_continue(next, &stream->subrequests) {
+		for (;;) {
+			/* Read pointer to subreq before reading subreq state. */
+			next = smp_load_acquire(&next->next);
+			if (next == &stream->subrequests)
+				break;
+
 			subreq = list_entry(next, struct netfs_io_subrequest, rreq_link);
 			if (subreq->start + subreq->transferred != start + len ||
 			    test_bit(NETFS_SREQ_BOUNDARY, &subreq->flags) ||
diff --git a/fs/netfs/write_retry.c b/fs/netfs/write_retry.c
index 32735abfa03f..058bc7a166a5 100644
--- a/fs/netfs/write_retry.c
+++ b/fs/netfs/write_retry.c
@@ -72,7 +72,12 @@ static void netfs_retry_write_stream(struct netfs_io_request *wreq,
 		    !test_bit(NETFS_SREQ_NEED_RETRY, &from->flags))
 			return;

-		list_for_each_continue(next, &stream->subrequests) {
+		for (;;) {
+			/* Read pointer to subreq before reading subreq state. */
+			next = smp_load_acquire(&next->next);
+			if (next == &stream->subrequests)
+				break;
+
 			subreq = list_entry(next, struct netfs_io_subrequest, rreq_link);
 			if (subreq->start + subreq->transferred != start + len ||
 			    test_bit(NETFS_SREQ_BOUNDARY, &subreq->flags) ||