2 files changed, 5 insertions, 1 deletions

diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 59c8a027721b..8c5cd9efebbc 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -520,8 +520,10 @@ unsigned int tcp_poll(struct file *file, struct socket *sock, poll_table *wait)
 
                                 /* Race breaker. If space is freed after
                                  * wspace test but before the flags are set,
-                                 * IO signal will be lost.
+                                 * IO signal will be lost. Memory barrier
+                                 * pairs with the input side.
                                  */
+                                smp_mb__after_atomic();
                                 if (sk_stream_is_writeable(sk))
                                         mask |= POLLOUT | POLLWRNORM;
                         }
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index a7ef679dd3ea..3a4d9b34bed4 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -4845,6 +4845,8 @@ static void tcp_check_space(struct sock *sk)
 {
         if (sock_flag(sk, SOCK_QUEUE_SHRUNK)) {
                 sock_reset_flag(sk, SOCK_QUEUE_SHRUNK);
+                /* pairs with tcp_poll() */
+                smp_mb__after_atomic();
                 if (sk->sk_socket &&
                     test_bit(SOCK_NOSPACE, &sk->sk_socket->flags))
                         tcp_new_space(sk);