4 files changed, 27 insertions, 5 deletions

diff --git a/kernel/irq/internals.h b/kernel/irq/internals.h
index 05c2188271b8..fcab63c66905 100644
--- a/kernel/irq/internals.h
+++ b/kernel/irq/internals.h
@@ -199,6 +199,11 @@ static inline int irq_desc_get_node(struct irq_desc *desc)
         return irq_common_data_get_node(&desc->irq_common_data);
 }
 
+static inline int irq_desc_is_chained(struct irq_desc *desc)
+{
+        return (desc->action && desc->action == &chained_action);
+}
+
 #ifdef CONFIG_PM_SLEEP
 bool irq_pm_check_wakeup(struct irq_desc *desc);
 void irq_pm_install_action(struct irq_desc *desc, struct irqaction *action);
diff --git a/kernel/irq/pm.c b/kernel/irq/pm.c
index e80c4400118a..cea1de0161f1 100644
--- a/kernel/irq/pm.c
+++ b/kernel/irq/pm.c
@@ -70,7 +70,8 @@ void irq_pm_remove_action(struct irq_desc *desc, struct irqaction *action)
 
 static bool suspend_device_irq(struct irq_desc *desc)
 {
-        if (!desc->action || desc->no_suspend_depth)
+        if (!desc->action || irq_desc_is_chained(desc) ||
+            desc->no_suspend_depth)
                 return false;
 
         if (irqd_is_wakeup_set(&desc->irq_data)) {
diff --git a/kernel/irq/proc.c b/kernel/irq/proc.c
index a916cf144b65..a2c02fd5d6d0 100644
--- a/kernel/irq/proc.c
+++ b/kernel/irq/proc.c
@@ -475,7 +475,7 @@ int show_interrupts(struct seq_file *p, void *v)
         for_each_online_cpu(j)
                 any_count |= kstat_irqs_cpu(i, j);
         action = desc->action;
-        if ((!action || action == &chained_action) && !any_count)
+        if ((!action || irq_desc_is_chained(desc)) && !any_count)
                 goto out;
 
         seq_printf(p, "%*d: ", prec, i);
diff --git a/kernel/time/timer.c b/kernel/time/timer.c
index 74591ba9474f..bbc5d1114583 100644
--- a/kernel/time/timer.c
+++ b/kernel/time/timer.c
@@ -977,13 +977,29 @@ EXPORT_SYMBOL(add_timer);
  */
 void add_timer_on(struct timer_list *timer, int cpu)
 {
-        struct tvec_base *base = per_cpu_ptr(&tvec_bases, cpu);
+        struct tvec_base *new_base = per_cpu_ptr(&tvec_bases, cpu);
+        struct tvec_base *base;
         unsigned long flags;
 
         timer_stats_timer_set_start_info(timer);
         BUG_ON(timer_pending(timer) || !timer->function);
-        spin_lock_irqsave(&base->lock, flags);
-        timer->flags = (timer->flags & ~TIMER_BASEMASK) | cpu;
+
+        /*
+         * If @timer was on a different CPU, it should be migrated with the
+         * old base locked to prevent other operations proceeding with the
+         * wrong base locked.  See lock_timer_base().
+         */
+        base = lock_timer_base(timer, &flags);
+        if (base != new_base) {
+                timer->flags |= TIMER_MIGRATING;
+
+                spin_unlock(&base->lock);
+                base = new_base;
+                spin_lock(&base->lock);
+                WRITE_ONCE(timer->flags,
+                           (timer->flags & ~TIMER_BASEMASK) | cpu);
+        }
+
         debug_activate(timer, timer->expires);
         internal_add_timer(base, timer);
         spin_unlock_irqrestore(&base->lock, flags);