1 files changed, 3 insertions, 0 deletions

diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index 02833af8a0b1..5cc39ed289c6 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -3454,6 +3454,7 @@ static bool e1000_clean_tx_irq(struct e1000_adapter *adapter,
         while ((eop_desc->upper.data & cpu_to_le32(E1000_TXD_STAT_DD)) &&
                (count < tx_ring->count)) {
                 bool cleaned = false;
+                rmb();  /* read buffer_info after eop_desc */
                 for ( ; !cleaned; count++) {
                         tx_desc = E1000_TX_DESC(*tx_ring, i);
                         buffer_info = &tx_ring->buffer_info[i];
@@ -3643,6 +3644,7 @@ static bool e1000_clean_jumbo_rx_irq(struct e1000_adapter *adapter,
                 if (*work_done >= work_to_do)
                         break;
                 (*work_done)++;
+                rmb(); /* read descriptor and rx_buffer_info after status DD */
 
                 status = rx_desc->status;
                 skb = buffer_info->skb;
@@ -3849,6 +3851,7 @@ static bool e1000_clean_rx_irq(struct e1000_adapter *adapter,
                 if (*work_done >= work_to_do)
                         break;
                 (*work_done)++;
+                rmb(); /* read descriptor and rx_buffer_info after status DD */
 
                 status = rx_desc->status;
                 skb = buffer_info->skb;