1 files changed, 9 insertions, 4 deletions

diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c
index 94f643484300..e354cc6446ab 100644
--- a/arch/x86/kernel/kvm.c
+++ b/arch/x86/kernel/kvm.c
@@ -609,7 +609,7 @@ static inline void check_zero(void)
         u8 ret;
         u8 old;
 
-        old = ACCESS_ONCE(zero_stats);
+        old = READ_ONCE(zero_stats);
         if (unlikely(old)) {
                 ret = cmpxchg(&zero_stats, old, 0);
                 /* This ensures only one fellow resets the stat */
@@ -727,6 +727,7 @@ __visible void kvm_lock_spinning(struct arch_spinlock *lock, __ticket_t want)
         int cpu;
         u64 start;
         unsigned long flags;
+        __ticket_t head;
 
         if (in_nmi())
                 return;
@@ -768,11 +769,15 @@ __visible void kvm_lock_spinning(struct arch_spinlock *lock, __ticket_t want)
          */
         __ticket_enter_slowpath(lock);
 
+        /* make sure enter_slowpath, which is atomic does not cross the read */
+        smp_mb__after_atomic();
+
         /*
          * check again make sure it didn't become free while
          * we weren't looking.
          */
-        if (ACCESS_ONCE(lock->tickets.head) == want) {
+        head = READ_ONCE(lock->tickets.head);
+        if (__tickets_equal(head, want)) {
                 add_stats(TAKEN_SLOW_PICKUP, 1);
                 goto out;
         }
@@ -803,8 +808,8 @@ static void kvm_unlock_kick(struct arch_spinlock *lock, __ticket_t ticket)
         add_stats(RELEASED_SLOW, 1);
         for_each_cpu(cpu, &waiting_cpus) {
                 const struct kvm_lock_waiting *w = &per_cpu(klock_waiting, cpu);
-                if (ACCESS_ONCE(w->lock) == lock &&
-                    ACCESS_ONCE(w->want) == ticket) {
+                if (READ_ONCE(w->lock) == lock &&
+                    READ_ONCE(w->want) == ticket) {
                         add_stats(RELEASED_SLOW_KICKED, 1);
                         kvm_kick_cpu(cpu);
                         break;