[PATCH] mm/migrate: fix softlockup in do_pages_stat() with huge page arrays

[PATCH] mm/migrate: fix softlockup in do_pages_stat() with huge page arrays

[Qi Xi]

From: Qi Xi <xiqi2@huawei.com>

do_pages_stat() walks the user page array in 16-page chunks but never
reschedules, so a huge nr_pages can hold a CPU past the watchdog
threshold on non-preemptible kernels. Add cond_resched() to the loop so
long move_pages() node-query calls yield periodically.

With KASAN and function tracing enabled, a move_pages() node query
(nodes == NULL) over 10 million page entries (~40GB) can trigger the
softlockup on a PREEMPT_NONE kernel.

Fixes: 80bba1290ab5 ("mm: no get_user/put_user while holding mmap_sem in do_pages_stat?")
Signed-off-by: Qi Xi <xiqi2@huawei.com>
---
 mm/migrate.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/mm/migrate.c b/mm/migrate.c
index 7bdcdb57652f..6c2371020cc5 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -2545,6 +2545,7 @@ static int do_pages_stat(struct mm_struct *mm, unsigned long nr_pages,
 
 		chunk_offset += chunk_nr;
 		nr_pages -= chunk_nr;
+		cond_resched();
 	}
 	return nr_pages ? -EFAULT : 0;
 }
-- 
2.53.0

Re: [PATCH] mm/migrate: fix softlockup in do_pages_stat() with huge page arrays

[David Hildenbrand (Arm)]

On 10/31/26 04:33, Qi Xi wrote:
> From: Qi Xi <xiqi2@huawei.com>
> 
> do_pages_stat() walks the user page array in 16-page chunks but never
> reschedules, so a huge nr_pages can hold a CPU past the watchdog
> threshold on non-preemptible kernels. Add cond_resched() to the loop so
> long move_pages() node-query calls yield periodically.
> 
> With KASAN and function tracing enabled, a move_pages() node query
> (nodes == NULL) over 10 million page entries (~40GB) can trigger the
> softlockup on a PREEMPT_NONE kernel.
> 
> Fixes: 80bba1290ab5 ("mm: no get_user/put_user while holding mmap_sem in do_pages_stat?")
> Signed-off-by: Qi Xi <xiqi2@huawei.com>
> ---
>  mm/migrate.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/mm/migrate.c b/mm/migrate.c
> index 7bdcdb57652f..6c2371020cc5 100644
> --- a/mm/migrate.c
> +++ b/mm/migrate.c
> @@ -2545,6 +2545,7 @@ static int do_pages_stat(struct mm_struct *mm, unsigned long nr_pages,
>  
>  		chunk_offset += chunk_nr;
>  		nr_pages -= chunk_nr;
> +		cond_resched();
>  	}
>  	return nr_pages ? -EFAULT : 0;
>  }

I though we wanted to stop throwing in cond_resched() at this point?

-- 
Cheers,

David

Re: [PATCH] mm/migrate: fix softlockup in do_pages_stat() with huge page arrays

[Andrew Morton]

On Sat, 31 Oct 2026 11:52:30 +0100 "David Hildenbrand (Arm)" <david@kernel.org> wrote:

> On 10/31/26 04:33, Qi Xi wrote:
> > From: Qi Xi <xiqi2@huawei.com>
> > 
> > do_pages_stat() walks the user page array in 16-page chunks but never
> > reschedules, so a huge nr_pages can hold a CPU past the watchdog
> > threshold on non-preemptible kernels. Add cond_resched() to the loop so
> > long move_pages() node-query calls yield periodically.
> > 
> > With KASAN and function tracing enabled, a move_pages() node query
> > (nodes == NULL) over 10 million page entries (~40GB) can trigger the
> > softlockup on a PREEMPT_NONE kernel.
> > 
> > Fixes: 80bba1290ab5 ("mm: no get_user/put_user while holding mmap_sem in do_pages_stat?")
> > Signed-off-by: Qi Xi <xiqi2@huawei.com>
> > ---
> >  mm/migrate.c | 1 +
> >  1 file changed, 1 insertion(+)
> > 
> > diff --git a/mm/migrate.c b/mm/migrate.c
> > index 7bdcdb57652f..6c2371020cc5 100644
> > --- a/mm/migrate.c
> > +++ b/mm/migrate.c
> > @@ -2545,6 +2545,7 @@ static int do_pages_stat(struct mm_struct *mm, unsigned long nr_pages,
> >  
> >  		chunk_offset += chunk_nr;
> >  		nr_pages -= chunk_nr;
> > +		cond_resched();
> >  	}
> >  	return nr_pages ? -EFAULT : 0;
> >  }
> 
> I though we wanted to stop throwing in cond_resched() at this point?

It's almost unneeded in current mainline kernels.  PREEMPT_NONE can
still be selected by

	All supported Alpha configurations

	All supported Hexagon configurations

	Non-ColdFire configurations (classic m68k)

However 99% of the world are on 5.x and 6.x kernels and many of those
machines use PREEMPT_NONE.


IOW, cond_resched() is not really needed in mainline, needed in
-stable.


I think simply merging the thing with cc:stable is the simplest and
most reliable way of getting those older kernels fixed up.  mm/ already
has >200 cond_resched/need_resched so a few more won't matter.

Presumably the day will come when we remove all those scheduling
points, after which people will have to work directly with the -stable
maintainers to get these things fixed up.