Mark timer as running in the timer base _before_ we clear the pending

flag (and order it on SMP), so that del_timer_sync() always sees the
timer either pending or running if it is active.

kernel/timer.c

@@ -418,8 +418,9 @@ static inline void __run_timers(tvec_base_t *base)
  			data = timer->data;
 
 			list_del(&timer->entry);
-			timer->base = NULL;
 			set_running_timer(base, timer);
+			smp_wmb();
+			timer->base = NULL;
 			spin_unlock_irq(&base->lock);
 			fn(data);
 			spin_lock_irq(&base->lock);