[xen stable-4.22] xen/credit: fix race with schedule_cpu_rm() in csched_timer()

[patchbot@xxxxxxx]

commit dca917bff4a0253a57616b485a26d419615c4003
Author:     Juergen Gross <jgross@xxxxxxxx>
AuthorDate: Wed Jul 29 14:06:42 2026 +0200
Commit:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
CommitDate: Wed Jul 29 14:51:51 2026 +0100

    xen/credit: fix race with schedule_cpu_rm() in csched_timer()
    
    When removing a CPU from a cpupool running the credit scheduler, a
    race might happen between schedule_cpu_rm() and csched_timer(),
    resulting in a NULL dereference.
    
    The timer associated with csched_timer() is killed only in
    csched_deinit_pdata(), which is called by schedule_cpu_rm() after
    setting the scheduler's per-cpu data to NULL AND after enabling
    interrupts again. This can result in the timer firing before being
    killed, so csched_timer() needs to test the per-cpu data being set
    before accessing it.
    
    Fixes: 78be3dbbfefa ("cpupools [1/6]: hypervisor changes")
    Reported-by: Dietmar Hahn <dietmar.hahn@xxxxxxxxxxx>
    Signed-off-by: Juergen Gross <jgross@xxxxxxxx>
    Acked-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Release-Acked-by: Oleksii Kurochko <oleksii.kurochko@xxxxxxxxx>
    (cherry picked from commit ea1d785a5f660ec52ec70454a0410c2f7fb2930a)
---
 xen/common/sched/credit.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/xen/common/sched/credit.c b/xen/common/sched/credit.c
index 07656a57e9..63ef0d1318 100644
--- a/xen/common/sched/credit.c
+++ b/xen/common/sched/credit.c
@@ -1588,6 +1588,10 @@ static void cf_check csched_tick(void *_cpu)
     struct csched_pcpu *spc = CSCHED_PCPU(cpu);
     struct csched_private *prv = CSCHED_PRIV(sr->scheduler);
 
+    /* Handle race of timer disabling vs. firing when switching scheduler. */
+    if ( !spc )
+        return;
+
     spc->tick++;
 
     /*
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.22