linux/drivers/rpmsg
Chunkai Deng 786439ad58 rpmsg: glink: smem: order FIFO read after availability check
glink_smem_rx_peek() reads the RX FIFO payload after the caller has
determined data is available via glink_smem_rx_avail(), which reads the
remote-updated head index. A control dependency between the head read
and the subsequent payload read does not order the two loads, so the
CPU may speculatively read the FIFO before observing the head update
and consume stale data the remote has not yet published.

Add rmb() in glink_smem_rx_peek() before the memcpy_fromio() so the
availability (head) read is ordered ahead of the FIFO payload read,
matching the consumer pattern in
Documentation/core-api/circular-buffers.rst.

Fixes: caf989c350 ("rpmsg: glink: Introduce glink smem based transport")
Cc: stable@vger.kernel.org
Signed-off-by: Chunkai Deng <chunkai.deng@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260618-rpmsg-glink-smem-mb-v1-1-68a026453a69@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-13 22:11:52 -05:00
..
Kconfig rpmsg: Move the rpmsg control device from rpmsg_char to rpmsg_ctrl 2022-03-13 11:49:53 -05:00
Makefile rpmsg: glink: Introduce packet tracepoints 2024-08-12 15:26:28 -07:00
mtk_rpmsg.c rpmsg: Constify buffer passed to send API 2026-04-06 09:37:51 -05:00
qcom_glink_native.c rpmsg: glink: fix deadlock in endpoint destroy during driver detach 2026-07-13 21:55:29 -05:00
qcom_glink_native.h rpmsg: glink: Fix spelling of peek 2023-02-14 20:28:48 -08:00
qcom_glink_rpm.c Get rid of 'remove_new' relic from platform driver struct 2024-12-01 15:12:43 -08:00
qcom_glink_smem.c rpmsg: glink: smem: order FIFO read after availability check 2026-07-13 22:11:52 -05:00
qcom_glink_ssr.c rpmsg: qcom_glink_ssr: fix module autoloading 2024-05-06 19:26:28 -07:00
qcom_glink_trace.h rpmsg: glink: Introduce packet tracepoints 2024-08-12 15:26:28 -07:00
qcom_smd.c rpmsg: Replace sprintf() with sysfs_emit() in sysfs show 2026-07-09 14:45:34 -05:00
rpmsg_char.c rpmsg: char: Check for ongoing chrdev destroy 2026-07-09 15:11:17 -05:00
rpmsg_char.h rpmsg: char: Export eptdev create and destroy functions 2022-03-13 11:49:53 -05:00
rpmsg_core.c rpmsg: core: Fix incorrect return value documentation 2026-07-09 14:45:37 -05:00
rpmsg_ctrl.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
rpmsg_internal.h rpmsg: Constify buffer passed to send API 2026-04-06 09:37:51 -05:00
rpmsg_ns.c rpmsg: Replace deprecated strncpy with strscpy_pad 2023-10-23 11:57:57 -06:00
virtio_rpmsg_bus.c rpmsg: use generic driver_override infrastructure 2026-05-30 22:25:45 +02:00