[PATCH] More timer race fixes

Patch from Julie DeWandel.

This patch has solved the crashes observed during TPC-C runs on the
16-way box.  (I'm confident it will fix the other reported cases as
well.)

The race is the setting of timer->base to NULL, by del_timer() or
__run_timers().  If new_base == old_base in __mod_timer() then we do not
re-check timer->base after getting the lock.  (the only case where we do
not have to re-check the base is in the !old_base case, but the else
branch also includes the old_base==new_base case.)

The __run_timers() case made the lock_timer() patch not work fully - we
cannot use lock_timer() in __run_timers() due to lock ordering.

kernel/timer.c

@@ -179,8 +179,13 @@ int __mod_timer(struct timer_list *timer, unsigned long expires)
 			spin_unlock(&old_base->lock);
 			goto repeat;
 		}
-	} else
+	} else {
 		spin_lock(&new_base->lock);
+		if (timer->base != old_base) {
+			spin_unlock(&new_base->lock);
+			goto repeat;
+		}
+	}
 
 	/*
 	 * Delete the previous timeout (if there was any), and install