smp_load_acquire(ring->cq.khead) in __io_uring_peek_cqe() for

 consistent dereferencing

__io_uring_peek_cqe() is on the critical path for the user to consume
completion-queue entries. It load_acquires the tail, loads the head,
uses the head to index into the cq ring.

The C memory consistency model does not enforce ordering for address
dependencies, like the one seen in:

```
LD1: unsigned head = *ring->cq.khead;
...
LD2: cqe = &ring->cq.cqes[(head & mask) << shift];
```
where LD2 is address-dependent on LD1. This means that LD2 could
load a stale cqe due to LD1 being ordered after LD2. If instead,
LD1 was a smp_load_acquire, the ordering would be enforced and
correct cqes would be loaded.

Signed-off by: Soham Bagchi <soham.bagchi@utah.edu>
Co-authored by: Marco Elver <elver@google.com>
Co-authored by: Vijay Nagarajan <vijay@cs.utah.edu>
Co-authored by: Ryan Stutsman <stutsman@cs.utah.edu>

Author: sohambagchi

src/include/liburing.h

@@ -1576,7 +1576,12 @@ IOURINGINLINE int __io_uring_peek_cqe(struct io_uring *ring,
 
 	do {
 		unsigned tail = io_uring_smp_load_acquire(ring->cq.ktail);
-		unsigned head = *ring->cq.khead;
+		
+		/**
+		 * A load_acquire on the head prevents reordering with the
+		 * cqe load below, ensuring that we see the correct cq entry.
+		 */
+		unsigned head = io_uring_smp_load_acquire(ring->cq.khead);
 
 		cqe = NULL;
 		available = tail - head;