From nobody Tue Aug 25 06:46:03 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; dmarc=pass(p=quarantine dis=none) header.from=suse.com ARC-Seal: i=1; a=rsa-sha256; t=1785326858; cv=none; d=zohomail.com; s=zohoarc; b=YTDdI862IethRZcnTKVxIHrgu6PlyLQZ1f/BBFn0W1wNm5C+qxcePUMkKOvGnwp80AF3eYPIXIoPjumkaUGm0FpXB9JI6K0ueaz6Zme+bTNQf+tzNi5riq4PUPi+hUyBnRPSWIvFSvnTkKbxzRF1ISbpd1BzM5x5czUt7T7LOMM= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785326858; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=0BQAZ0Qu4PKd0KoO61TIZjvwax8MIaVRGF11HrjtQV0=; b=UaLdNQIbSviV++GZxYVoFbrEYvJZ/O605L0BscHyBkUZmbDvQ1dEcMpy6fkMfcsoSkvhdeNoVgSqiv+LZ+4Y9aUGrGFGwiANxvkjD9H5WI3v8XCyXO3Dtyiu7+j0np4SgH0ea2ycPzNPd/WzlRDmKZSIL3ME6xQ1wnJYyC9o8+M= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1785326858468358.5581945520835; Wed, 29 Jul 2026 05:07:38 -0700 (PDT) Received: from list by lists.xenproject.org with outflank-mailman.1375643.1622751 (Exim 4.92) (envelope-from ) id 1wp33y-0000P1-Hi; Wed, 29 Jul 2026 12:07:06 +0000 Received: by outflank-mailman (output) from mailman id 1375643.1622751; Wed, 29 Jul 2026 12:07:06 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp33y-0000Ot-Bn; Wed, 29 Jul 2026 12:07:06 +0000 Received: by outflank-mailman (input) for mailman id 1375643; Wed, 29 Jul 2026 12:07:05 +0000 Received: from mx.expurgate.net ([194.145.224.20]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp33x-0000Lg-Ag for xen-devel@lists.xenproject.org; Wed, 29 Jul 2026 12:07:05 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1wp33w-0006Zi-Nj for xen-devel@lists.xenproject.org; Wed, 29 Jul 2026 14:07:04 +0200 Received: from [10.42.69.6] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6a69ece2-e002-0a2a0a5209dd-0a2a4506c790-22 for ; Wed, 29 Jul 2026 14:07:04 +0200 Received: from [195.135.223.130] (helo=smtp-out1.suse.de) by tlsNG-16d1c6.mxtls.expurgate.net with ESMTPS (eXpurgate 4.57.1) (envelope-from ) id 6a69ece8-195a-0a2a45060019-c387df82c4e2-3 for ; Wed, 29 Jul 2026 14:07:04 +0200 Received: from imap1.dmz-prg2.suse.org (imap1.dmz-prg2.suse.org [IPv6:2a07:de40:b281:104:10:150:64:97]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by smtp-out1.suse.de (Postfix) with ESMTPS id 164C27CA08; Wed, 29 Jul 2026 12:06:56 +0000 (UTC) Received: from imap1.dmz-prg2.suse.org (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by imap1.dmz-prg2.suse.org (Postfix) with ESMTPS id DB925779B1; Wed, 29 Jul 2026 12:06:55 +0000 (UTC) Received: from dovecot-director2.suse.de ([2a07:de40:b281:106:10:150:64:167]) by imap1.dmz-prg2.suse.org with ESMTPSA id w8o5NN/saWrZKAAAD6G6ig (envelope-from ); Wed, 29 Jul 2026 12:06:55 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=susede1 header.d=suse.com header.i="@suse.com" header.h="From:Date:Message-ID:To:Cc:MIME-Version:Content-Transfer-Encoding:In-Reply-To:References"; dkim=pass header.s=susede1 header.d=suse.com header.i="@suse.com" header.h="From:Date:Message-ID:To:Cc:MIME-Version:Content-Transfer-Encoding:In-Reply-To:References" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.com; s=susede1; t=1785326820; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=0BQAZ0Qu4PKd0KoO61TIZjvwax8MIaVRGF11HrjtQV0=; b=gsoQUgqaEvbTNE6+MDquTTB760Esmpl7EYtfzlJRtZHjNOZ24W3IvXxw8reoaOmr7TNCWL U4Bi/sHjedRcELCMz51lPxApV/LFnnkvCPAIm8CU4kxMTs/egyybhKQUjOIKMWNZKWZjSh 3FrCQ2He0s74JTkdfAhYyjVN0a37VCA= Authentication-Results: smtp-out1.suse.de; dkim=pass header.d=suse.com header.s=susede1 header.b=GNaneZ6y DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.com; s=susede1; t=1785326816; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=0BQAZ0Qu4PKd0KoO61TIZjvwax8MIaVRGF11HrjtQV0=; b=GNaneZ6yJNJGAQb6hcL582mHt1eUbgvcWuT7DD4q+0vwGuja114zo54v1Qg/92Cj9uXrYY ooDT1XyLVxrFtDu9a1w7siNQR5Wb/MoCq9PMxaPfMF+9OsNrF7H/Z25BqZWPvIuv3Q2CfG XmOK1rjfuVoacAhIfnB4ofIPyaI7Me8= From: Juergen Gross To: xen-devel@lists.xenproject.org Cc: Juergen Gross , Dario Faggioli , George Dunlap , Dietmar Hahn Subject: [PATCH 1/2] xen/credit: fix race with schedule_cpu_rm() in csched_timer() Date: Wed, 29 Jul 2026 14:06:42 +0200 Message-ID: <20260729120643.327387-2-jgross@suse.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260729120643.327387-1-jgross@suse.com> References: <20260729120643.327387-1-jgross@suse.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Spam-Score: -3.01 X-Spam-Level: X-Rspamd-Action: no action X-Rspamd-Queue-Id: 164C27CA08 X-Spamd-Result: default: False [-3.01 / 50.00]; BAYES_HAM(-3.00)[99.99%]; MID_CONTAINS_FROM(1.00)[]; NEURAL_HAM_LONG(-1.00)[-1.000]; R_MISSING_CHARSET(0.50)[]; R_DKIM_ALLOW(-0.20)[suse.com:s=susede1]; NEURAL_HAM_SHORT(-0.20)[-1.000]; MIME_GOOD(-0.10)[text/plain]; MX_GOOD(-0.01)[]; DBL_BLOCKED_OPENRESOLVER(0.00)[fujitsu.com:email,suse.com:mid,suse.com:email,suse.com:dkim,imap1.dmz-prg2.suse.org:helo,imap1.dmz-prg2.suse.org:rdns]; ARC_NA(0.00)[]; RCVD_VIA_SMTP_AUTH(0.00)[]; RBL_SPAMHAUS_BLOCKED_OPENRESOLVER(0.00)[2a07:de40:b281:104:10:150:64:97:from]; FROM_HAS_DN(0.00)[]; TO_DN_SOME(0.00)[]; MIME_TRACE(0.00)[0:+]; TO_MATCH_ENVRCPT_ALL(0.00)[]; DNSWL_BLOCKED(0.00)[2a07:de40:b281:104:10:150:64:97:from]; FROM_EQ_ENVFROM(0.00)[]; DKIM_SIGNED(0.00)[suse.com:s=susede1]; RECEIVED_SPAMHAUS_BLOCKED_OPENRESOLVER(0.00)[2a07:de40:b281:106:10:150:64:167:received]; RCVD_COUNT_TWO(0.00)[2]; RCVD_TLS_ALL(0.00)[]; RCPT_COUNT_FIVE(0.00)[5]; DKIM_TRACE(0.00)[suse.com:+] X-Rspamd-Server: rspamd1.dmz-prg2.suse.org X-Spam-Flag: NO X-purgate-ID: tlsNG-16d1c6/1785326824-F74C977B-497F951E/0/0 X-purgate-type: clean X-purgate-size: 1289 X-ZohoMail-DKIM: pass (identity @suse.com) (identity @suse.com) X-ZM-MESSAGEID: 1785326858740158500 Content-Type: text/plain; charset="utf-8" When removing a CPU from a cpupool running the credit scheduler, a race might happen between schedule_cpu_rm() and csched_timer(), resulting in a NULL dereference. The timer associated with csched_timer() is killed only in csched_deinit_pdata(), which is called by schedule_cpu_rm() after setting the scheduler's per-cpu data to NULL AND after enabling interrupts again. This can result in the timer to fire before it is being killed, so csched_timer() needs to test the per-cpu data to be set before accessing it. Fixes: 78be3dbbfefa ("cpupools [1/6]: hypervisor changes") Reported-by: Dietmar Hahn Signed-off-by: Juergen Gross Acked-by: Andrew Cooper --- xen/common/sched/credit.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/xen/common/sched/credit.c b/xen/common/sched/credit.c index 328c802d0c..4dde2ede12 100644 --- a/xen/common/sched/credit.c +++ b/xen/common/sched/credit.c @@ -1589,6 +1589,10 @@ static void cf_check csched_tick(void *_cpu) struct csched_pcpu *spc =3D CSCHED_PCPU(cpu); struct csched_private *prv =3D CSCHED_PRIV(sr->scheduler); =20 + /* Handle race of timer disabling vs. firing when switching scheduler.= */ + if ( !spc ) + return; + spc->tick++; =20 /* --=20 2.55.0 From nobody Tue Aug 25 06:46:03 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; dmarc=pass(p=quarantine dis=none) header.from=suse.com ARC-Seal: i=1; a=rsa-sha256; t=1785326855; cv=none; d=zohomail.com; s=zohoarc; b=bMxTOPLt+S6tzUDIMIzHl4vmMNx4fC0dHDzp9h5bwDsXiIFb/lvMpsC3hUIpQmG7KfplCb2tHoVetmcYcUaydSJ1MVkxEi7LeWH3qO+IZpO0rudbwP7vLN8AKSugNeezi4BnueyBBxDDhJOg3W21cEhDulKfeJ1eFuc7xodvL6k= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785326855; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=yJ9KZC1N9lgIdK6gjTKt/b/8X+SICl0CjKrsBqav+I4=; b=NtuUc0U8yRzoyBjqrUJ4xhG7SmjGsdc77AZlj1JFFAQZPFhqWPAwWVghf9ppatbBpavhidKIgpAZNB7n531ApyZwaJOKTo3/MUlEK2FWXX9lLZA2HHAXkKDCs5x6w06qwIUIdN3bMX3np+FZ2gQCSVDI60ZLNo46q7JCBnutIRU= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1785326855621341.9236562726155; Wed, 29 Jul 2026 05:07:35 -0700 (PDT) Received: from list by lists.xenproject.org with outflank-mailman.1375645.1622764 (Exim 4.92) (envelope-from ) id 1wp344-0000o7-Me; Wed, 29 Jul 2026 12:07:12 +0000 Received: by outflank-mailman (output) from mailman id 1375645.1622764; Wed, 29 Jul 2026 12:07:12 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp344-0000nw-IW; Wed, 29 Jul 2026 12:07:12 +0000 Received: by outflank-mailman (input) for mailman id 1375645; Wed, 29 Jul 2026 12:07:10 +0000 Received: from mx.expurgate.net ([195.190.135.10]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp342-0000mb-T5 for xen-devel@lists.xenproject.org; Wed, 29 Jul 2026 12:07:10 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1wp342-00HPjJ-9q for xen-devel@lists.xenproject.org; Wed, 29 Jul 2026 14:07:10 +0200 Received: from [10.42.69.11] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6a69ece9-5cb7-0a2a0a5109dd-0a2a450be72a-24 for ; Wed, 29 Jul 2026 14:07:10 +0200 Received: from [195.135.223.130] (helo=smtp-out1.suse.de) by tlsNG-42698a.mxtls.expurgate.net with ESMTPS (eXpurgate 4.57.1) (envelope-from ) id 6a69eced-b7e8-0a2a450b0019-c387df82a262-3 for ; Wed, 29 Jul 2026 14:07:10 +0200 Received: from imap1.dmz-prg2.suse.org (unknown [10.150.64.97]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by smtp-out1.suse.de (Postfix) with ESMTPS id 914737CACE; Wed, 29 Jul 2026 12:07:01 +0000 (UTC) Received: from imap1.dmz-prg2.suse.org (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by imap1.dmz-prg2.suse.org (Postfix) with ESMTPS id 645B1779A1; Wed, 29 Jul 2026 12:07:01 +0000 (UTC) Received: from dovecot-director2.suse.de ([2a07:de40:b281:106:10:150:64:167]) by imap1.dmz-prg2.suse.org with ESMTPSA id BlkXF+XsaWrgKAAAD6G6ig (envelope-from ); Wed, 29 Jul 2026 12:07:01 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=susede1 header.d=suse.com header.i="@suse.com" header.h="From:Date:Message-ID:To:Cc:MIME-Version:Content-Transfer-Encoding:In-Reply-To:References"; dkim=pass header.s=susede1 header.d=suse.com header.i="@suse.com" header.h="From:Date:Message-ID:To:Cc:MIME-Version:Content-Transfer-Encoding:In-Reply-To:References" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.com; s=susede1; t=1785326825; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=yJ9KZC1N9lgIdK6gjTKt/b/8X+SICl0CjKrsBqav+I4=; b=I5UCs0MSXGEe5X5BT1cjVVdsDsvL83fC23AzpL/LeDy3Jiqc3urSlR8xg9UG3dewPcXEe4 dlpSm6bOiMPGu64PIJ0VgpLXI43mH2ClVumw6Bt/1mGCNgy9p8m0lfaPsWMd8BXhPNR5Mp CxC6f8TJw7aP0hgZCQ0ZHt2XKj8v4iU= Authentication-Results: smtp-out1.suse.de; none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.com; s=susede1; t=1785326821; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=yJ9KZC1N9lgIdK6gjTKt/b/8X+SICl0CjKrsBqav+I4=; b=EYPDMgeXbiRRZMo25vBd4TcYha5c5DAPjegC41TfARM8s3egi+txgEgN1YAxvE/qwr2jo8 5CeDxQwqKyuiDSLEw/L4FuQwTF6ZGcqoPi7qZSvPEhrIyeqxG8iSr+iQwcGjQgDaih2s0b QK8XQ2wkJcGcL5efkfcN8A8cQABZZqc= From: Juergen Gross To: xen-devel@lists.xenproject.org Cc: Juergen Gross , Dario Faggioli , George Dunlap , Dietmar Hahn Subject: [PATCH 2/2] xen/sched: fix schedule_dump() handling of free cpus Date: Wed, 29 Jul 2026 14:06:43 +0200 Message-ID: <20260729120643.327387-3-jgross@suse.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260729120643.327387-1-jgross@suse.com> References: <20260729120643.327387-1-jgross@suse.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Spam-Score: -2.80 X-Spam-Level: X-Spam-Flag: NO X-Spamd-Result: default: False [-2.80 / 50.00]; BAYES_HAM(-3.00)[99.99%]; MID_CONTAINS_FROM(1.00)[]; NEURAL_HAM_LONG(-1.00)[-1.000]; R_MISSING_CHARSET(0.50)[]; NEURAL_HAM_SHORT(-0.20)[-1.000]; MIME_GOOD(-0.10)[text/plain]; MIME_TRACE(0.00)[0:+]; TO_DN_SOME(0.00)[]; RCVD_VIA_SMTP_AUTH(0.00)[]; ARC_NA(0.00)[]; DKIM_SIGNED(0.00)[suse.com:s=susede1]; TO_MATCH_ENVRCPT_ALL(0.00)[]; FROM_HAS_DN(0.00)[]; RCPT_COUNT_FIVE(0.00)[5]; FROM_EQ_ENVFROM(0.00)[]; DBL_BLOCKED_OPENRESOLVER(0.00)[fujitsu.com:email,imap1.dmz-prg2.suse.org:helo,suse.com:email,suse.com:mid]; RCVD_COUNT_TWO(0.00)[2]; RCVD_TLS_ALL(0.00)[] X-purgate-ID: tlsNG-42698a/1785326830-AAAD89EA-092B6C06/0/0 X-purgate-type: clean X-purgate-size: 1469 X-ZohoMail-DKIM: pass (identity @suse.com) (identity @suse.com) X-ZM-MESSAGEID: 1785326856980158500 Content-Type: text/plain; charset="utf-8" With the introduction of core scheduling cpus not used by any cpupool have been switched to use the very simple idle scheduler instead of the default scheduler. Trying to obtain diagnostic scheduling data via the "r" debug key is scanning through all cpupools using the per-cpupool scheduler to print the related data. Unfortunately the switch to use the idle scheduler for free cpus wasn't reflected in schedule_dump(), causing the default scheduler's dump_cpu_state callback to be used for free cpus. This causes NULL dereferences in case the default scheduler is one of credit or null. Fix that by using the idle scheduler instead of the default scheduler for free cpus. Note that it is fine for a scheduler to have no dump_cpu_state callback. Fixes: f855dd962523 ("sched: add minimalistic idle scheduler for free cpus") Reported-by: Dietmar Hahn Tested-by: Dietmar Hahn Signed-off-by: Juergen Gross --- xen/common/sched/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xen/common/sched/core.c b/xen/common/sched/core.c index 55b71301cf..9ccf5811bf 100644 --- a/xen/common/sched/core.c +++ b/xen/common/sched/core.c @@ -3452,7 +3452,7 @@ void schedule_dump(struct cpupool *c) } else { - sched =3D &operations; + sched =3D &sched_idle_ops; cpus =3D &cpupool_free_cpus; } =20 --=20 2.55.0