diff --git a/net/ax25/ax25_timer.c b/net/ax25/ax25_timer.c
index 1bb2ae9d47f7c422c8baa1e1b5148dc25505ba36..7ef07596932fdfa632ed4e9e8f12c3131a40edf5 100644
--- a/net/ax25/ax25_timer.c
+++ b/net/ax25/ax25_timer.c
@@ -10,6 +10,7 @@
  * Copyright (C) Darryl Miles G7LED (dlm@g7led.demon.co.uk)
  * Copyright (C) Joerg Reuter DL1BKE (jreuter@yaina.de)
  * Copyright (C) Frederic Rible F1OAT (frible@teaser.fr)
+ * Copyright (C) 2002 Ralf Baechle DO1GRB (ralf@gnu.org)
  */
 #include <linux/config.h>
 #include <linux/errno.h>
@@ -138,12 +139,15 @@ unsigned long ax25_display_timer(struct timer_list *timer)
 
 static void ax25_heartbeat_expiry(unsigned long param)
 {
-	ax25_cb *ax25 = (ax25_cb *)param;
 	int proto = AX25_PROTO_STD_SIMPLEX;
+	ax25_cb *ax25 = (ax25_cb *)param;
+	struct sock *sk = ax25->sk;
 
 	if (ax25->ax25_dev)
 		proto = ax25->ax25_dev->values[AX25_VALUES_PROTOCOL];
 
+	bh_lock_sock(sk);
+
 	switch (proto) {
 	case AX25_PROTO_STD_SIMPLEX:
 	case AX25_PROTO_STD_DUPLEX:
@@ -159,12 +163,15 @@ static void ax25_heartbeat_expiry(unsigned long param)
 		break;
 #endif
 	}
+	bh_unlock_sock(sk);
 }
 
 static void ax25_t1timer_expiry(unsigned long param)
 {
 	ax25_cb *ax25 = (ax25_cb *)param;
+	struct sock *sk = ax25->sk;
 
+	bh_lock_sock(sk);
 	switch (ax25->ax25_dev->values[AX25_VALUES_PROTOCOL]) {
 	case AX25_PROTO_STD_SIMPLEX:
 	case AX25_PROTO_STD_DUPLEX:
@@ -178,12 +185,15 @@ static void ax25_t1timer_expiry(unsigned long param)
 		break;
 #endif
 	}
+	bh_unlock_sock(sk);
 }
 
 static void ax25_t2timer_expiry(unsigned long param)
 {
 	ax25_cb *ax25 = (ax25_cb *)param;
+	struct sock *sk = ax25->sk;
 
+	bh_lock_sock(sk);
 	switch (ax25->ax25_dev->values[AX25_VALUES_PROTOCOL]) {
 	case AX25_PROTO_STD_SIMPLEX:
 	case AX25_PROTO_STD_DUPLEX:
@@ -197,12 +207,15 @@ static void ax25_t2timer_expiry(unsigned long param)
 		break;
 #endif
 	}
+	bh_unlock_sock(sk);
 }
 
 static void ax25_t3timer_expiry(unsigned long param)
 {
 	ax25_cb *ax25 = (ax25_cb *)param;
+	struct sock *sk = ax25->sk;
 
+	bh_lock_sock(sk);
 	switch (ax25->ax25_dev->values[AX25_VALUES_PROTOCOL]) {
 	case AX25_PROTO_STD_SIMPLEX:
 	case AX25_PROTO_STD_DUPLEX:
@@ -218,12 +231,15 @@ static void ax25_t3timer_expiry(unsigned long param)
 		break;
 #endif
 	}
+	bh_unlock_sock(sk);
 }
 
 static void ax25_idletimer_expiry(unsigned long param)
 {
 	ax25_cb *ax25 = (ax25_cb *)param;
+	struct sock *sk = ax25->sk;
 
+	bh_lock_sock(sk);
 	switch (ax25->ax25_dev->values[AX25_VALUES_PROTOCOL]) {
 	case AX25_PROTO_STD_SIMPLEX:
 	case AX25_PROTO_STD_DUPLEX:
@@ -239,4 +255,5 @@ static void ax25_idletimer_expiry(unsigned long param)
 		break;
 #endif
 	}
+	bh_unlock_sock(sk);
 }
diff --git a/net/netrom/nr_timer.c b/net/netrom/nr_timer.c
index 6dd57436dc0d7c9a5174fbddfefac813d6f5f188..388105d711b0a99bb5bcb301c08480dd50d00583 100644
--- a/net/netrom/nr_timer.c
+++ b/net/netrom/nr_timer.c
@@ -4,7 +4,8 @@
  * the Free Software Foundation; either version 2 of the License, or
  * (at your option) any later version.
  *
- * Copyright Jonathan Naylor G4KLX (g4klx@g4klx.demon.co.uk)
+ * Copyright (C) Jonathan Naylor G4KLX (g4klx@g4klx.demon.co.uk)
+ * Copyright (C) 2002 Ralf Baechle DO1GRB (ralf@gnu.org)
  */
 #include <linux/errno.h>
 #include <linux/types.h>
@@ -135,6 +136,7 @@ static void nr_heartbeat_expiry(unsigned long param)
 	struct sock *sk = (struct sock *)param;
 	nr_cb *nr = nr_sk(sk);
 
+	bh_lock_sock(sk);
 	switch (nr->state) {
 	case NR_STATE_0:
 		/* Magic here: If we listen() and a new link dies before it
@@ -161,6 +163,7 @@ static void nr_heartbeat_expiry(unsigned long param)
 	}
 
 	nr_start_heartbeat(sk);
+	bh_unlock_sock(sk);
 }
 
 static void nr_t2timer_expiry(unsigned long param)
@@ -168,17 +171,21 @@ static void nr_t2timer_expiry(unsigned long param)
 	struct sock *sk = (struct sock *)param;
 	nr_cb *nr = nr_sk(sk);
 
+	bh_lock_sock(sk);
 	if (nr->condition & NR_COND_ACK_PENDING) {
 		nr->condition &= ~NR_COND_ACK_PENDING;
 		nr_enquiry_response(sk);
 	}
+	bh_unlock_sock(sk);
 }
 
 static void nr_t4timer_expiry(unsigned long param)
 {
 	struct sock *sk = (struct sock *)param;
 
+	bh_lock_sock(sk);
 	nr_sk(sk)->condition &= ~NR_COND_PEER_RX_BUSY;
+	bh_unlock_sock(sk);
 }
 
 static void nr_idletimer_expiry(unsigned long param)
@@ -186,6 +193,8 @@ static void nr_idletimer_expiry(unsigned long param)
 	struct sock *sk = (struct sock *)param;
 	nr_cb *nr = nr_sk(sk);
 
+	bh_lock_sock(sk);
+
 	nr_clear_queues(sk);
 
 	nr->n2count = 0;
@@ -204,6 +213,7 @@ static void nr_idletimer_expiry(unsigned long param)
 		sk->state_change(sk);
 
 	sk->dead = 1;
+	bh_unlock_sock(sk);
 }
 
 static void nr_t1timer_expiry(unsigned long param)
@@ -211,6 +221,7 @@ static void nr_t1timer_expiry(unsigned long param)
 	struct sock *sk = (struct sock *)param;
 	nr_cb *nr = nr_sk(sk);
 
+	bh_lock_sock(sk);
 	switch (nr->state) {
 	case NR_STATE_1:
 		if (nr->n2count == nr->n2) {
@@ -244,4 +255,5 @@ static void nr_t1timer_expiry(unsigned long param)
 	}
 
 	nr_start_t1timer(sk);
+	bh_unlock_sock(sk);
 }
diff --git a/net/rose/rose_timer.c b/net/rose/rose_timer.c
index 035e52a1c099cc166d63d46f53c248b1eb009a9f..5af130c7454151474a8db32d57099a74054bfa77 100644
--- a/net/rose/rose_timer.c
+++ b/net/rose/rose_timer.c
@@ -5,6 +5,7 @@
  * (at your option) any later version.
  *
  * Copyright (C) Jonathan Naylor G4KLX (g4klx@g4klx.demon.co.uk)
+ * Copyright (C) 2002 Ralf Baechle DO1GRB (ralf@gnu.org)
  */
 #include <linux/errno.h>
 #include <linux/types.h>
@@ -130,6 +131,7 @@ static void rose_heartbeat_expiry(unsigned long param)
 	struct sock *sk = (struct sock *)param;
 	rose_cb *rose = rose_sk(sk);
 
+	bh_lock_sock(sk);
 	switch (rose->state) {
 	case ROSE_STATE_0:
 		/* Magic here: If we listen() and a new link dies before it
@@ -157,6 +159,7 @@ static void rose_heartbeat_expiry(unsigned long param)
 	}
 
 	rose_start_heartbeat(sk);
+	bh_unlock_sock(sk);
 }
 
 static void rose_timer_expiry(unsigned long param)
@@ -164,6 +167,7 @@ static void rose_timer_expiry(unsigned long param)
 	struct sock *sk = (struct sock *)param;
 	rose_cb *rose = rose_sk(sk);
 
+	bh_lock_sock(sk);
 	switch (rose->state) {
 	case ROSE_STATE_1:	/* T1 */
 	case ROSE_STATE_4:	/* T2 */
@@ -184,12 +188,14 @@ static void rose_timer_expiry(unsigned long param)
 		}
 		break;
 	}
+	bh_unlock_sock(sk);
 }
 
 static void rose_idletimer_expiry(unsigned long param)
 {
 	struct sock *sk = (struct sock *)param;
 
+	bh_lock_sock(sk);
 	rose_clear_queues(sk);
 
 	rose_write_internal(sk, ROSE_CLEAR_REQUEST);
@@ -205,4 +211,5 @@ static void rose_idletimer_expiry(unsigned long param)
 		sk->state_change(sk);
 
 	sk->dead = 1;
+	bh_unlock_sock(sk);
 }