1 files changed, 8 insertions, 1 deletions

diff --git a/kernel/time/timer.c b/kernel/time/timer.c
index 2d47980a1bc4..0d4b91c5a374 100644
--- a/kernel/time/timer.c
+++ b/kernel/time/timer.c
@@ -943,7 +943,14 @@ static struct timer_base *lock_timer_base(struct timer_list *timer,
 {
         for (;;) {
                 struct timer_base *base;
-                u32 tf = timer->flags;
+                u32 tf;
+
+                /*
+                 * We need to use READ_ONCE() here, otherwise the compiler
+                 * might re-read @tf between the check for TIMER_MIGRATING
+                 * and spin_lock().
+                 */
+                tf = READ_ONCE(timer->flags);
 
                 if (!(tf & TIMER_MIGRATING)) {
                         base = get_timer_base(tf);