[PATCH] xen/blkback: Prevent missed completion when draining I/O

[Gui-Dong Han <hanguidong02@xxxxxxxxx>]

xen_blk_drain_io() sets drain before checking inflight.
xen_blkbk_unmap_and_respond_callback() decrements inflight with
atomic_dec_and_test() before checking drain.

The pre-wait condition check was added to avoid missing a completion, but
atomic_set() is unordered. With one I/O in flight, the drain path can set
drain to 1 and read inflight as 1 before the completion decrement. The
completion path then decrements inflight to 0 but can still read drain as
0. It skips complete(), so the drain path waits until the timeout despite
no I/O remaining.

Add a full barrier between setting drain and reading inflight.
atomic_dec_and_test() already provides full ordering on the completion
side.

Fixes: 6927d92091df ("xen/blkback: Fix two races in the handling of barrier 
requests.")
Signed-off-by: Gui-Dong Han <hanguidong02@xxxxxxxxx>
---
Found by auditing atomic operations used for synchronization.
A similar fix can be found in 6df8e84aa6b5.
---
 drivers/block/xen-blkback/blkback.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/block/xen-blkback/blkback.c 
b/drivers/block/xen-blkback/blkback.c
index 7871099bc0d4..88526e349ce1 100644
--- a/drivers/block/xen-blkback/blkback.c
+++ b/drivers/block/xen-blkback/blkback.c
@@ -1021,6 +1021,13 @@ static void xen_blk_drain_io(struct xen_blkif_ring *ring)
        struct xen_blkif *blkif = ring->blkif;
 
        atomic_set(&blkif->drain, 1);
+       /*
+        * Publish drain before checking inflight. Otherwise,
+        * xen_blkbk_unmap_and_respond_callback() can decrement inflight with
+        * atomic_dec_and_test() and still see drain == 0 after this path saw
+        * inflight > 0, missing the completion.
+        */
+       smp_mb();
        do {
                if (atomic_read(&ring->inflight) == 0)
                        break;
-- 
2.34.1