1 files changed, 9 insertions, 3 deletions

diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c
index 3bac94269a98..4adf32067862 100644
--- a/kernel/time/hrtimer.c
+++ b/kernel/time/hrtimer.c
@@ -799,6 +799,9 @@ u64 hrtimer_forward(struct hrtimer *timer, ktime_t now, ktime_t interval)
         if (delta.tv64 < 0)
                 return 0;
 
+        if (WARN_ON(timer->state & HRTIMER_STATE_ENQUEUED))
+                return 0;
+
         if (interval.tv64 < hrtimer_resolution)
                 interval.tv64 = hrtimer_resolution;
 
@@ -1139,11 +1142,14 @@ static void __run_hrtimer(struct hrtimer_cpu_base *cpu_base,
          * Note: We clear the CALLBACK bit after enqueue_hrtimer and
          * we do not reprogramm the event hardware. Happens either in
          * hrtimer_start_range_ns() or in hrtimer_interrupt()
+         *
+         * Note: Because we dropped the cpu_base->lock above,
+         * hrtimer_start_range_ns() can have popped in and enqueued the timer
+         * for us already.
          */
-        if (restart != HRTIMER_NORESTART) {
-                BUG_ON(timer->state != HRTIMER_STATE_CALLBACK);
+        if (restart != HRTIMER_NORESTART &&
+            !(timer->state & HRTIMER_STATE_ENQUEUED))
                 enqueue_hrtimer(timer, base);
-        }
 
         WARN_ON_ONCE(!(timer->state & HRTIMER_STATE_CALLBACK));