1 files changed, 6 insertions, 1 deletions

diff --git a/kernel/posix-timers.c b/kernel/posix-timers.c
index 495440779ce3..d2818dda736c 100644
--- a/kernel/posix-timers.c
+++ b/kernel/posix-timers.c
@@ -462,6 +462,7 @@ static enum hrtimer_restart posix_timer_fn(struct hrtimer *timer)
 static struct pid *good_sigevent(sigevent_t * event)
 {
         struct task_struct *rtn = current->group_leader;
+        int sig = event->sigev_signo;
 
         if ((event->sigev_notify & SIGEV_THREAD_ID ) &&
                 (!(rtn = find_task_by_vpid(event->sigev_notify_thread_id)) ||
@@ -470,7 +471,8 @@ static struct pid *good_sigevent(sigevent_t * event)
                 return NULL;
 
         if (((event->sigev_notify & ~SIGEV_THREAD_ID) != SIGEV_NONE) &&
-            ((event->sigev_signo <= 0) || (event->sigev_signo > SIGRTMAX)))
+            (sig <= 0 || sig > SIGRTMAX || sig_kernel_only(sig) ||
+             sig_kernel_coredump(sig)))
                 return NULL;
 
         return task_pid(rtn);
@@ -829,6 +831,7 @@ retry:
 
         unlock_timer(timr, flag);
         if (error == TIMER_RETRY) {
+                hrtimer_wait_for_timer(&timr->it.real.timer);
                 rtn = NULL;     // We already got the old time...
                 goto retry;
         }
@@ -867,6 +870,7 @@ retry_delete:
 
         if (timer_delete_hook(timer) == TIMER_RETRY) {
                 unlock_timer(timer, flags);
+                hrtimer_wait_for_timer(&timer->it.real.timer);
                 goto retry_delete;
         }
 
@@ -896,6 +900,7 @@ retry_delete:
 
         if (timer_delete_hook(timer) == TIMER_RETRY) {
                 unlock_timer(timer, flags);
+                hrtimer_wait_for_timer(&timer->it.real.timer);
                 goto retry_delete;
         }
         list_del(&timer->list);