[PATCH v2] mm/migrate: fix softlockup in do_pages_stat() with huge page arrays

[PATCH v2] mm/migrate: fix softlockup in do_pages_stat() with huge page arrays

[Qi Xi]

From: Qi Xi <xiqi2@huawei.com>

do_pages_stat() walks the user page array in 16-page chunks but never
reschedules, so a huge nr_pages can hold a CPU past the watchdog
threshold on non-preemptible kernels.  Add cond_resched() to the loop so
long move_pages() node-query calls yield periodically.

With KASAN and function tracing enabled, a move_pages() node query
(nodes == NULL) over 10 million page entries (~40GB of mapped memory)
reproduces the softlockup on a 6.6-based arm64 kernel with
CONFIG_PREEMPT_NONE=y.

In current mainline, only alpha, hexagon and classic m68k can still
select PREEMPT_NONE; stable kernels older than v7.0 still allow it, so
the fix mainly targets pre-v7.0 stable users.

Fixes: 80bba1290ab5 ("mm: no get_user/put_user while holding mmap_sem in do_pages_stat?")
Cc: <stable@vger.kernel.org>
Signed-off-by: Qi Xi <xiqi2@huawei.com>
---
v1 -> v2: describe the repro environment; add Cc stable; no code change.

 mm/migrate.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/mm/migrate.c b/mm/migrate.c
index 7bdcdb57652f..6c2371020cc5 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -2545,6 +2545,7 @@ static int do_pages_stat(struct mm_struct *mm, unsigned long nr_pages,
 
 		chunk_offset += chunk_nr;
 		nr_pages -= chunk_nr;
+		cond_resched();
 	}
 	return nr_pages ? -EFAULT : 0;
 }
-- 
2.53.0

Re: [PATCH v2] mm/migrate: fix softlockup in do_pages_stat() with huge page arrays

[David Hildenbrand (Arm)]

On 11/3/26 09:05, Qi Xi wrote:
> From: Qi Xi <xiqi2@huawei.com>
> 
> do_pages_stat() walks the user page array in 16-page chunks but never
> reschedules, so a huge nr_pages can hold a CPU past the watchdog
> threshold on non-preemptible kernels.  Add cond_resched() to the loop so
> long move_pages() node-query calls yield periodically.
> 
> With KASAN and function tracing enabled, a move_pages() node query
> (nodes == NULL) over 10 million page entries (~40GB of mapped memory)
> reproduces the softlockup on a 6.6-based arm64 kernel with
> CONFIG_PREEMPT_NONE=y.
> 
> In current mainline, only alpha, hexagon and classic m68k can still
> select PREEMPT_NONE; stable kernels older than v7.0 still allow it, so
> the fix mainly targets pre-v7.0 stable users.
> 
> Fixes: 80bba1290ab5 ("mm: no get_user/put_user while holding mmap_sem in do_pages_stat?")
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Qi Xi <xiqi2@huawei.com>
> ---
> v1 -> v2: describe the repro environment; add Cc stable; no code change.
> 
>  mm/migrate.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/mm/migrate.c b/mm/migrate.c
> index 7bdcdb57652f..6c2371020cc5 100644
> --- a/mm/migrate.c
> +++ b/mm/migrate.c
> @@ -2545,6 +2545,7 @@ static int do_pages_stat(struct mm_struct *mm, unsigned long nr_pages,
>  
>  		chunk_offset += chunk_nr;
>  		nr_pages -= chunk_nr;
> +		cond_resched();
>  	}
>  	return nr_pages ? -EFAULT : 0;
>  }

I'll wait a couple more days and will then queue it for the next merge window,
not as a hotfix.

-- 
Cheers,

David