diff --git a/[refs] b/[refs]
index 3f82a120ef52..ef7504db0fef 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 03feee373f05d5c500dd6198015de83005df902c
+refs/heads/master: c08c464d6f4136d9e48ffa23c0bcd93442343b2a
diff --git a/trunk/drivers/isdn/mISDN/timerdev.c b/trunk/drivers/isdn/mISDN/timerdev.c
index 1094667d8f31..5a1a5cadc766 100644
--- a/trunk/drivers/isdn/mISDN/timerdev.c
+++ b/trunk/drivers/isdn/mISDN/timerdev.c
@@ -72,14 +72,24 @@ static int
 mISDN_close(struct inode *ino, struct file *filep)
 {
 	struct mISDNtimerdev	*dev = filep->private_data;
+	struct list_head	*list = &dev->pending;
 	struct mISDNtimer	*timer, *next;
 
 	if (*debug & DEBUG_TIMER)
 		printk(KERN_DEBUG "%s(%p,%p)\n", __func__, ino, filep);
-	list_for_each_entry_safe(timer, next, &dev->pending, list) {
-		del_timer(&timer->tl);
+
+	spin_lock_irq(&dev->lock);
+	while (!list_empty(list)) {
+		timer = list_first_entry(list, struct mISDNtimer, list);
+		spin_unlock_irq(&dev->lock);
+		del_timer_sync(&timer->tl);
+		spin_lock_irq(&dev->lock);
+		/* it might have been moved to ->expired */
+		list_del(&timer->list);
 		kfree(timer);
 	}
+	spin_unlock_irq(&dev->lock);
+
 	list_for_each_entry_safe(timer, next, &dev->expired, list) {
 		kfree(timer);
 	}