--- /dev/null
+From 8f17fc20bfb75bcec4cfeda789738979c8338fdc Mon Sep 17 00:00:00 2001
+From: Oleg Nesterov <oleg@tv-sign.ru>
+Date: Thu, 15 Jun 2006 20:11:15 +0400
+Subject: check_process_timers: fix possible lockup
+
+If the local timer interrupt happens just after do_exit() sets PF_EXITING
+(and before it clears ->it_xxx_expires) run_posix_cpu_timers() will call
+check_process_timers() with tasklist_lock + ->siglock held and
+
+ check_process_timers:
+
+ t = tsk;
+ do {
+ ....
+
+ do {
+ t = next_thread(t);
+ } while (unlikely(t->flags & PF_EXITING));
+ } while (t != tsk);
+
+the outer loop will never stop.
+
+Actually, the window is bigger. Another process can attach the timer
+after ->it_xxx_expires was cleared (see the next commit) and the 'if
+(PF_EXITING)' check in arm_timer() is racy (see the one after that).
+
+Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
+Signed-off-by: Linus Torvalds <torvalds@osdl.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ kernel/posix-cpu-timers.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+--- linux-2.6.16.20.orig/kernel/posix-cpu-timers.c
++++ linux-2.6.16.20/kernel/posix-cpu-timers.c
+@@ -1173,6 +1173,9 @@ static void check_process_timers(struct
+ }
+ t = tsk;
+ do {
++ if (unlikely(t->flags & PF_EXITING))
++ continue;
++
+ ticks = cputime_add(cputime_add(t->utime, t->stime),
+ prof_left);
+ if (!cputime_eq(prof_expires, cputime_zero) &&
+@@ -1193,11 +1196,7 @@ static void check_process_timers(struct
+ t->it_sched_expires > sched)) {
+ t->it_sched_expires = sched;
+ }
+-
+- do {
+- t = next_thread(t);
+- } while (unlikely(t->flags & PF_EXITING));
+- } while (t != tsk);
++ } while ((t = next_thread(t)) != tsk);
+ }
+ }
+