1 files changed, 18 insertions, 0 deletions

diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index d039d39963a..859554a03a0 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -5559,7 +5559,18 @@ static netdev_tx_t rtl8169_start_xmit(struct sk_buff *skb,
         mmiowb();
 
         if (TX_BUFFS_AVAIL(tp) < MAX_SKB_FRAGS) {
+                /* Avoid wrongly optimistic queue wake-up: rtl_tx thread must
+                 * not miss a ring update when it notices a stopped queue.
+                 */
+                smp_wmb();
                 netif_stop_queue(dev);
+                /* Sync with rtl_tx:
+                 * - publish queue status and cur_tx ring index (write barrier)
+                 * - refresh dirty_tx ring index (read barrier).
+                 * May the current thread have a pessimistic view of the ring
+                 * status and forget to wake up queue, a racing rtl_tx thread
+                 * can't.
+                 */
                 smp_mb();
                 if (TX_BUFFS_AVAIL(tp) >= MAX_SKB_FRAGS)
                         netif_wake_queue(dev);
@@ -5659,6 +5670,13 @@ static void rtl_tx(struct net_device *dev, struct rtl8169_private *tp)
 
         if (tp->dirty_tx != dirty_tx) {
                 tp->dirty_tx = dirty_tx;
+                /* Sync with rtl8169_start_xmit:
+                 * - publish dirty_tx ring index (write barrier)
+                 * - refresh cur_tx ring index and queue status (read barrier)
+                 * May the current thread miss the stopped queue condition,
+                 * a racing xmit thread can only have a right view of the
+                 * ring status.
+                 */
                 smp_mb();
                 if (netif_queue_stopped(dev) &&
                     (TX_BUFFS_AVAIL(tp) >= MAX_SKB_FRAGS)) {