[PATCH v2] mm/migrate: fix softlockup in do_pages_move() with huge page arrays

[PATCH v2] mm/migrate: fix softlockup in do_pages_move() with huge page arrays

[shao.mingyin]

From: Shao Mingyin <shao.mingyin@zte.com.cn>

mm/migrate: fix softlockup in do_pages_move() with huge page arrays

do_pages_move() walks the array one page at a time.  An entry naming the
node its page is already on is never queued, so the loop runs without a
voluntary preemption point on a non-preemptible kernel; the existing
cond_resched() calls in the migration code are only reached after a
folio has been queued.  nr_pages comes straight from the syscall.

A 6.6.60 x86_64 kernel with CONFIG_PREEMPT_NONE=y and CONFIG_NUMA=y
reproduces this under QEMU TCG: 50 million entries pointing at a page
already on the target node keep the CPU in do_pages_move() for 42.9 s and
trip the softlockup watchdog; with this patch the same call completes in
44.3 s without a softlockup.

Add cond_resched() so that long calls yield periodically.
do_pages_stat() had the same problem; it was fixed by 8e934ab44389.  In
current mainline only alpha, hexagon and classic m68k can select
PREEMPT_NONE and they cannot enable CONFIG_NUMA, so this mainly targets
pre-v7.0 stable kernels.

Fixes: a49bd4d71637 ("mm, numa: rework do_pages_move")
Cc: stable@vger.kernel.org
Signed-off-by: Shao Mingyin <shao.mingyin@zte.com.cn>
---
Changes in v2:
  - describe the reproduction and the code path, as requested by David
    Hildenbrand; no code change
  - correct the do_pages_stat() reference (fixed by 8e934ab44389)
Link: https://lore.kernel.org/all/20261107213856462Jx8pIdgdtLvPLfOFTwV4X@zte.com.cn/

 mm/migrate.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/mm/migrate.c b/mm/migrate.c
index 875079464930..3122ecb85270 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -2372,6 +2372,8 @@ static int do_pages_move(struct mm_struct *mm, nodemask_t task_nodes,
 		const void __user *p;
 		int node;
 
+		cond_resched();
+
 		err = -EFAULT;
 		if (in_compat_syscall()) {
 			compat_uptr_t cp;

Re: [PATCH v2] mm/migrate: fix softlockup in do_pages_move() with huge page arrays

[David Hildenbrand (Arm)]

On 11/8/26 07:28, shao.mingyin@zte.com.cn wrote:
> From: Shao Mingyin <shao.mingyin@zte.com.cn>
> 
> mm/migrate: fix softlockup in do_pages_move() with huge page arrays
> 
> do_pages_move() walks the array one page at a time.  An entry naming the
> node its page is already on is never queued, so the loop runs without a
> voluntary preemption point on a non-preemptible kernel; the existing
> cond_resched() calls in the migration code are only reached after a
> folio has been queued.  nr_pages comes straight from the syscall.
> 
> A 6.6.60 x86_64 kernel with CONFIG_PREEMPT_NONE=y and CONFIG_NUMA=y
> reproduces this under QEMU TCG: 50 million entries pointing at a page
> already on the target node keep the CPU in do_pages_move() for 42.9 s and
> trip the softlockup watchdog; with this patch the same call completes in
> 44.3 s without a softlockup.
> 
> Add cond_resched() so that long calls yield periodically.
> do_pages_stat() had the same problem; it was fixed by 8e934ab44389.  In
> current mainline only alpha, hexagon and classic m68k can select
> PREEMPT_NONE and they cannot enable CONFIG_NUMA, so this mainly targets
> pre-v7.0 stable kernels.

I hat that we have to care about this, and I'll probably increasingly hard push
back against such effective stable-only fixes in the future.

In particular if it wasn't even encountered in practice but required a QEMU TCG
instance to even trigger it ...

-- 
Cheers,

David