2 files changed, 11 insertions, 1 deletions

diff --git a/kernel/rcuclassic.c b/kernel/rcuclassic.c
index 18369e3386e2..ce0cf16cab67 100644
--- a/kernel/rcuclassic.c
+++ b/kernel/rcuclassic.c
@@ -371,9 +371,9 @@ static void __rcu_offline_cpu(struct rcu_data *this_rdp,
         if (rcp->cur != rcp->completed)
                 cpu_quiet(rdp->cpu, rcp);
         spin_unlock_bh(&rcp->lock);
+        rcu_move_batch(this_rdp, rdp->donelist, rdp->donetail);
         rcu_move_batch(this_rdp, rdp->curlist, rdp->curtail);
         rcu_move_batch(this_rdp, rdp->nxtlist, rdp->nxttail);
-        rcu_move_batch(this_rdp, rdp->donelist, rdp->donetail);
 }
 
 static void rcu_offline_cpu(int cpu)
diff --git a/kernel/rcupdate.c b/kernel/rcupdate.c
index 0ccd0095ebdc..760dfc233a00 100644
--- a/kernel/rcupdate.c
+++ b/kernel/rcupdate.c
@@ -115,7 +115,17 @@ void rcu_barrier(void)
         mutex_lock(&rcu_barrier_mutex);
         init_completion(&rcu_barrier_completion);
         atomic_set(&rcu_barrier_cpu_count, 0);
+        /*
+         * The queueing of callbacks in all CPUs must be atomic with
+         * respect to RCU, otherwise one CPU may queue a callback,
+         * wait for a grace period, decrement barrier count and call
+         * complete(), while other CPUs have not yet queued anything.
+         * So, we need to make sure that grace periods cannot complete
+         * until all the callbacks are queued.
+         */
+        rcu_read_lock();
         on_each_cpu(rcu_barrier_func, NULL, 0, 1);
+        rcu_read_unlock();
         wait_for_completion(&rcu_barrier_completion);
         mutex_unlock(&rcu_barrier_mutex);
 }