--- kernel/hrtimer.c

+++ kernel/hrtimer.c

@@ -920,6 +920,7 @@ static inline int

remove_hrtimer(struct hrtimer *timer, struct hrtimer_clock_base *base)

{

if (hrtimer_is_queued(timer)) {

+ unsigned long state;

int reprogram;

/*

@@ -933,8 +934,13 @@ remove_hrtimer(struct hrtimer *timer, st

debug_deactivate(timer);

timer_stats_hrtimer_clear_start_info(timer);

reprogram = base->cpu_base == &__get_cpu_var(hrtimer_bases);

- __remove_hrtimer(timer, base, HRTIMER_STATE_INACTIVE,

- reprogram);

+ /*

+ * We must preserve the CALLBACK state flag here,

+ * otherwise we could move the timer base in

+ * switch_hrtimer_base.

+ */

+ state = timer->state & HRTIMER_STATE_CALLBACK;

+ __remove_hrtimer(timer, base, state, reprogram);

return 1;

}

return 0;

@@ -1221,6 +1227,9 @@ static void __run_hrtimer(struct hrtimer

BUG_ON(timer->state != HRTIMER_STATE_CALLBACK);

enqueue_hrtimer(timer, base);

}

+

+ WARN_ON_ONCE(!(timer->state & HRTIMER_STATE_CALLBACK));

+

timer->state &= ~HRTIMER_STATE_CALLBACK;

}