From da5a2144bbc1f26103bf2eb3bda8cf095acd9cb4 Mon Sep 17 00:00:00 2001 From: Juergen Gross Date: Mon, 24 Aug 2026 11:54:05 +0200 Subject: [PATCH] xen/credit: fix race with schedule_cpu_rm() in csched_timer() When removing a CPU from a cpupool running the credit scheduler, a race might happen between schedule_cpu_rm() and csched_timer(), resulting in a NULL dereference. The timer associated with csched_timer() is killed only in csched_deinit_pdata(), which is called by schedule_cpu_rm() after setting the scheduler's per-cpu data to NULL AND after enabling interrupts again. This can result in the timer firing before being killed, so csched_timer() needs to test the per-cpu data being set before accessing it. Fixes: 78be3dbbfefa ("cpupools [1/6]: hypervisor changes") Reported-by: Dietmar Hahn Signed-off-by: Juergen Gross Acked-by: Andrew Cooper master commit: ea1d785a5f660ec52ec70454a0410c2f7fb2930a master date: 2026-07-29 14:41:22 +0100 --- xen/common/sched/credit.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/xen/common/sched/credit.c b/xen/common/sched/credit.c index a6bb321e7d..2adab171a2 100644 --- a/xen/common/sched/credit.c +++ b/xen/common/sched/credit.c @@ -1587,6 +1587,10 @@ static void cf_check csched_tick(void *_cpu) struct csched_pcpu *spc = CSCHED_PCPU(cpu); struct csched_private *prv = CSCHED_PRIV(sr->scheduler); + /* Handle race of timer disabling vs. firing when switching scheduler. */ + if ( !spc ) + return; + spc->tick++; /*