diff --git a/fs/exec.c b/fs/exec.c
index 97f991f79e6990b431eea3b9d66af9678f63b1ea..add4a298a49a2d828397ef1e0527694b1665fb80 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1277,7 +1277,7 @@ int begin_new_exec(struct linux_binprm * bprm)
 	spin_lock_irq(&me->sighand->siglock);
 	posix_cpu_timers_exit(me);
 	spin_unlock_irq(&me->sighand->siglock);
-	exit_itimers(me->signal);
+	exit_itimers(me);
 	flush_itimer_signals();
 #endif
 
diff --git a/include/linux/sched/task.h b/include/linux/sched/task.h
index cea4bdfd0f05f32ea26a40c22b140e40375262aa..df9505faed27991eb3ffd1e27ce954d041e6fc1b 100644
--- a/include/linux/sched/task.h
+++ b/include/linux/sched/task.h
@@ -82,7 +82,7 @@ static inline void exit_thread(struct task_struct *tsk)
 extern void do_group_exit(int);
 
 extern void exit_files(struct task_struct *);
-extern void exit_itimers(struct signal_struct *);
+extern void exit_itimers(struct task_struct *);
 
 extern pid_t kernel_clone(struct kernel_clone_args *kargs);
 struct task_struct *fork_idle(int);
diff --git a/kernel/exit.c b/kernel/exit.c
index d13d67fc5f4e2085f93c46b77440ca1eeb908833..ab900b661867f6ebac0862e80d6f80fa16d168a2 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -782,7 +782,7 @@ void __noreturn do_exit(long code)
 
 #ifdef CONFIG_POSIX_TIMERS
 		hrtimer_cancel(&tsk->signal->real_timer);
-		exit_itimers(tsk->signal);
+		exit_itimers(tsk);
 #endif
 		if (tsk->mm)
 			setmax_mm_hiwater_rss(&tsk->signal->maxrss, tsk->mm);
diff --git a/kernel/time/posix-timers.c b/kernel/time/posix-timers.c
index 7363f81dc31add5f2ffa83f2c8f0008a91935880..c2a02f2bb6230803c189c95da4ec56470deb86ae 100644
--- a/kernel/time/posix-timers.c
+++ b/kernel/time/posix-timers.c
@@ -1051,15 +1051,24 @@ static void itimer_delete(struct k_itimer *timer)
 }
 
 /*
- * This is called by do_exit or de_thread, only when there are no more
- * references to the shared signal_struct.
+ * This is called by do_exit or de_thread, only when nobody else can
+ * modify the signal->posix_timers list. Yet we need sighand->siglock
+ * to prevent the race with /proc/pid/timers.
  */
-void exit_itimers(struct signal_struct *sig)
+void exit_itimers(struct task_struct *tsk)
 {
+	struct list_head timers;
 	struct k_itimer *tmr;
 
-	while (!list_empty(&sig->posix_timers)) {
-		tmr = list_entry(sig->posix_timers.next, struct k_itimer, list);
+	if (list_empty(&tsk->signal->posix_timers))
+		return;
+
+	spin_lock_irq(&tsk->sighand->siglock);
+	list_replace_init(&tsk->signal->posix_timers, &timers);
+	spin_unlock_irq(&tsk->sighand->siglock);
+
+	while (!list_empty(&timers)) {
+		tmr = list_first_entry(&timers, struct k_itimer, list);
 		itimer_delete(tmr);
 	}
 }