2 files changed, 5 insertions, 4 deletions

diff --git a/net/rxrpc/ar-ack.c b/net/rxrpc/ar-ack.c
index 2714da167fb8..b6ffe4e1b84a 100644
--- a/net/rxrpc/ar-ack.c
+++ b/net/rxrpc/ar-ack.c
@@ -245,6 +245,9 @@ static void rxrpc_resend_timer(struct rxrpc_call *call)
         _enter("%d,%d,%d",
                call->acks_tail, call->acks_unacked, call->acks_head);
 
+        if (call->state >= RXRPC_CALL_COMPLETE)
+                return;
+
         resend = 0;
         resend_at = 0;
 
diff --git a/net/rxrpc/ar-call.c b/net/rxrpc/ar-call.c
index 909d092de9f4..bf656c230ba9 100644
--- a/net/rxrpc/ar-call.c
+++ b/net/rxrpc/ar-call.c
@@ -786,6 +786,7 @@ static void rxrpc_call_life_expired(unsigned long _call)
 
 /*
  * handle resend timer expiry
+ * - may not take call->state_lock as this can deadlock against del_timer_sync()
  */
 static void rxrpc_resend_time_expired(unsigned long _call)
 {
@@ -796,12 +797,9 @@ static void rxrpc_resend_time_expired(unsigned long _call)
         if (call->state >= RXRPC_CALL_COMPLETE)
                 return;
 
-        read_lock_bh(&call->state_lock);
         clear_bit(RXRPC_CALL_RUN_RTIMER, &call->flags);
-        if (call->state < RXRPC_CALL_COMPLETE &&
-            !test_and_set_bit(RXRPC_CALL_RESEND_TIMER, &call->events))
+        if (!test_and_set_bit(RXRPC_CALL_RESEND_TIMER, &call->events))
                 rxrpc_queue_call(call);
-        read_unlock_bh(&call->state_lock);
 }
 
 /*