[xen stable-4.20] xen/credit: fix race with schedule_cpu_rm() in csched_timer()

[patchbot@xxxxxxx]

commit da5a2144bbc1f26103bf2eb3bda8cf095acd9cb4
Author:     Juergen Gross <jgross@xxxxxxxx>
AuthorDate: Mon Aug 24 11:54:05 2026 +0200
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Mon Aug 24 11:54:05 2026 +0200

    xen/credit: fix race with schedule_cpu_rm() in csched_timer()
    
    When removing a CPU from a cpupool running the credit scheduler, a
    race might happen between schedule_cpu_rm() and csched_timer(),
    resulting in a NULL dereference.
    
    The timer associated with csched_timer() is killed only in
    csched_deinit_pdata(), which is called by schedule_cpu_rm() after
    setting the scheduler's per-cpu data to NULL AND after enabling
    interrupts again. This can result in the timer firing before being
    killed, so csched_timer() needs to test the per-cpu data being set
    before accessing it.
    
    Fixes: 78be3dbbfefa ("cpupools [1/6]: hypervisor changes")
    Reported-by: Dietmar Hahn <dietmar.hahn@xxxxxxxxxxx>
    Signed-off-by: Juergen Gross <jgross@xxxxxxxx>
    Acked-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    master commit: ea1d785a5f660ec52ec70454a0410c2f7fb2930a
    master date: 2026-07-29 14:41:22 +0100
---
 xen/common/sched/credit.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/xen/common/sched/credit.c b/xen/common/sched/credit.c
index a6bb321e7d..2adab171a2 100644
--- a/xen/common/sched/credit.c
+++ b/xen/common/sched/credit.c
@@ -1587,6 +1587,10 @@ static void cf_check csched_tick(void *_cpu)
     struct csched_pcpu *spc = CSCHED_PCPU(cpu);
     struct csched_private *prv = CSCHED_PRIV(sr->scheduler);
 
+    /* Handle race of timer disabling vs. firing when switching scheduler. */
+    if ( !spc )
+        return;
+
     spc->tick++;
 
     /*
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.20