1 files changed, 10 insertions, 0 deletions

diff --git a/drivers/scsi/ibmvscsi/ibmvscsi.c b/drivers/scsi/ibmvscsi/ibmvscsi.c
index 9caf9a979659..7b23f21f22f1 100644
--- a/drivers/scsi/ibmvscsi/ibmvscsi.c
+++ b/drivers/scsi/ibmvscsi/ibmvscsi.c
@@ -185,6 +185,11 @@ static struct viosrp_crq *crq_queue_next_crq(struct crq_queue *queue)
         if (crq->valid & 0x80) {
                 if (++queue->cur == queue->size)
                         queue->cur = 0;
+
+                /* Ensure the read of the valid bit occurs before reading any
+                 * other bits of the CRQ entry
+                 */
+                rmb();
         } else
                 crq = NULL;
         spin_unlock_irqrestore(&queue->lock, flags);
@@ -203,6 +208,11 @@ static int ibmvscsi_send_crq(struct ibmvscsi_host_data *hostdata,
 {
         struct vio_dev *vdev = to_vio_dev(hostdata->dev);
 
+        /*
+         * Ensure the command buffer is flushed to memory before handing it
+         * over to the VIOS to prevent it from fetching any stale data.
+         */
+        mb();
         return plpar_hcall_norets(H_SEND_CRQ, vdev->unit_address, word1, word2);
 }