Re: [PATCH] mm/migrate: fix softlockup in do_pages_stat() with huge page arrays

[Qi Xi <xiqi2@huawei.com>]

On 02/11/2026 17:07, David Hildenbrand (Arm) wrote:
> On 10/31/26 17:42, Andrew Morton wrote:
>> On Sat, 31 Oct 2026 11:52:30 +0100 "David Hildenbrand (Arm)" <david@kernel.org> wrote:
>>
>>> On 10/31/26 04:33, Qi Xi wrote:
>>>> From: Qi Xi <xiqi2@huawei.com>
>>>>
>>>> do_pages_stat() walks the user page array in 16-page chunks but never
>>>> reschedules, so a huge nr_pages can hold a CPU past the watchdog
>>>> threshold on non-preemptible kernels. Add cond_resched() to the loop so
>>>> long move_pages() node-query calls yield periodically.
>>>>
>>>> With KASAN and function tracing enabled, a move_pages() node query
>>>> (nodes == NULL) over 10 million page entries (~40GB) can trigger the
>>>> softlockup on a PREEMPT_NONE kernel.
>>>>
>>>> Fixes: 80bba1290ab5 ("mm: no get_user/put_user while holding mmap_sem in do_pages_stat?")
>>>> Signed-off-by: Qi Xi <xiqi2@huawei.com>
>>>> ---
>>>>   mm/migrate.c | 1 +
>>>>   1 file changed, 1 insertion(+)
>>>>
>>>> diff --git a/mm/migrate.c b/mm/migrate.c
>>>> index 7bdcdb57652f..6c2371020cc5 100644
>>>> --- a/mm/migrate.c
>>>> +++ b/mm/migrate.c
>>>> @@ -2545,6 +2545,7 @@ static int do_pages_stat(struct mm_struct *mm, unsigned long nr_pages,
>>>>   
>>>>   		chunk_offset += chunk_nr;
>>>>   		nr_pages -= chunk_nr;
>>>> +		cond_resched();
>>>>   	}
>>>>   	return nr_pages ? -EFAULT : 0;
>>>>   }
>>> I though we wanted to stop throwing in cond_resched() at this point?
>> It's almost unneeded in current mainline kernels.  PREEMPT_NONE can
>> still be selected by
>>
>> 	All supported Alpha configurations
>>
>> 	All supported Hexagon configurations
>>
>> 	Non-ColdFire configurations (classic m68k)
>>
>> However 99% of the world are on 5.x and 6.x kernels and many of those
>> machines use PREEMPT_NONE.
>>
>>
>> IOW, cond_resched() is not really needed in mainline, needed in
>> -stable.
> But where did the submitter reproduce this?
>
> Why should we even care reading the above?
>
> I'm all confused now.
Sorry for the confusion. I reproduced it on a 6.6-based arm64 kernel
with CONFIG_PREEMPT_NONE=y, KASAN and function tracing enabled.

Mainline now only allows PREEMPT_NONE on alpha, hexagon and
classic m68k; the mainstream architectures  cannot select it anymore.
So, as Andrew said, the practical value is for 5.x/6.x stable users.

I'll send a v2 with this written and CC stable.

Qi