2 files changed, 7 insertions, 1 deletions

diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index 9f775302d1df..6e71d6ace5a3 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -1069,6 +1069,11 @@ call_decode(struct rpc_task *task)
                 return;
         }
 
+        /*
+         * Ensure that we see all writes made by xprt_complete_rqst()
+         * before it changed req->rq_received.
+         */
+        smp_rmb();
         req->rq_rcv_buf.len = req->rq_private_buf.len;
 
         /* Check that the softirq receive buffer is valid */
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index 940dba965bb9..4dd5b3cfe754 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -651,6 +651,8 @@ void xprt_complete_rqst(struct rpc_task *task, int copied)
         task->tk_rtt = (long)jiffies - req->rq_xtime;
 
         list_del_init(&req->rq_list);
+        /* Ensure all writes are done before we update req->rq_received */
+        smp_wmb();
         req->rq_received = req->rq_private_buf.len = copied;
         rpc_wake_up_task(task);
 }
@@ -727,7 +729,6 @@ void xprt_transmit(struct rpc_task *task)
 
         dprintk("RPC: %4d xprt_transmit(%u)\n", task->tk_pid, req->rq_slen);
 
-        smp_rmb();
         if (!req->rq_received) {
                 if (list_empty(&req->rq_list)) {
                         spin_lock_bh(&xprt->transport_lock);