[PATCH v2] mm/migrate: fix softlockup in do_pages_move() with huge page arrays

[PATCH v2] mm/migrate: fix softlockup in do_pages_move() with huge page arrays

[shao.mingyin]

From: Shao Mingyin <shao.mingyin@zte.com.cn>

mm/migrate: fix softlockup in do_pages_move() with huge page arrays

do_pages_move() walks the array one page at a time.  An entry naming the
node its page is already on is never queued, so the loop runs without a
voluntary preemption point on a non-preemptible kernel; the existing
cond_resched() calls in the migration code are only reached after a
folio has been queued.  nr_pages comes straight from the syscall.

A 6.6.60 x86_64 kernel with CONFIG_PREEMPT_NONE=y and CONFIG_NUMA=y
reproduces this under QEMU TCG: 50 million entries pointing at a page
already on the target node keep the CPU in do_pages_move() for 42.9 s and
trip the softlockup watchdog; with this patch the same call completes in
44.3 s without a softlockup.

Add cond_resched() so that long calls yield periodically.
do_pages_stat() had the same problem; it was fixed by 8e934ab44389.  In
current mainline only alpha, hexagon and classic m68k can select
PREEMPT_NONE and they cannot enable CONFIG_NUMA, so this mainly targets
pre-v7.0 stable kernels.

Fixes: a49bd4d71637 ("mm, numa: rework do_pages_move")
Cc: stable@vger.kernel.org
Signed-off-by: Shao Mingyin <shao.mingyin@zte.com.cn>
---
Changes in v2:
  - describe the reproduction and the code path, as requested by David
    Hildenbrand; no code change
  - correct the do_pages_stat() reference (fixed by 8e934ab44389)
Link: https://lore.kernel.org/all/20261107213856462Jx8pIdgdtLvPLfOFTwV4X@zte.com.cn/

 mm/migrate.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/mm/migrate.c b/mm/migrate.c
index 875079464930..3122ecb85270 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -2372,6 +2372,8 @@ static int do_pages_move(struct mm_struct *mm, nodemask_t task_nodes,
 		const void __user *p;
 		int node;
 
+		cond_resched();
+
 		err = -EFAULT;
 		if (in_compat_syscall()) {
 			compat_uptr_t cp;

Re: [PATCH v2] mm/migrate: fix softlockup in do_pages_move() with huge page arrays

[David Hildenbrand (Arm)]

On 11/8/26 07:28, shao.mingyin@zte.com.cn wrote:
> From: Shao Mingyin <shao.mingyin@zte.com.cn>
> 
> mm/migrate: fix softlockup in do_pages_move() with huge page arrays
> 
> do_pages_move() walks the array one page at a time.  An entry naming the
> node its page is already on is never queued, so the loop runs without a
> voluntary preemption point on a non-preemptible kernel; the existing
> cond_resched() calls in the migration code are only reached after a
> folio has been queued.  nr_pages comes straight from the syscall.
> 
> A 6.6.60 x86_64 kernel with CONFIG_PREEMPT_NONE=y and CONFIG_NUMA=y
> reproduces this under QEMU TCG: 50 million entries pointing at a page
> already on the target node keep the CPU in do_pages_move() for 42.9 s and
> trip the softlockup watchdog; with this patch the same call completes in
> 44.3 s without a softlockup.
> 
> Add cond_resched() so that long calls yield periodically.
> do_pages_stat() had the same problem; it was fixed by 8e934ab44389.  In
> current mainline only alpha, hexagon and classic m68k can select
> PREEMPT_NONE and they cannot enable CONFIG_NUMA, so this mainly targets
> pre-v7.0 stable kernels.

I hat that we have to care about this, and I'll probably increasingly hard push
back against such effective stable-only fixes in the future.

In particular if it wasn't even encountered in practice but required a QEMU TCG
instance to even trigger it ...

-- 
Cheers,

David

Re: [PATCH v2] mm/migrate: fix softlockup in do_pages_move() with huge page arrays

[shao.mingyin]

Hi David,

fair enough -- and your reading is correct: preempt=none is unselectable
under PREEMPT_DYNAMIC, and the arches that can still pick PREEMPT_NONE
have no NUMA, so mainline cannot reach this path.

I was aiming at the 6.6 LTS configs that shipped PREEMPT_NONE + NUMA: two
lines of cond_resched(), no behaviour change, same as do_pages_stat() got
in 8e934ab44389.  If you and Andrew would rather not carry a stable-only
fix, just say so and I will withdraw it.

Thanks,
Shao

Re: [PATCH v2] mm/migrate: fix softlockup in do_pages_move() with huge page arrays

[David Hildenbrand (Arm)]

On 11/9/26 13:33, shao.mingyin@zte.com.cn wrote:
> Hi David,
> 
> fair enough -- and your reading is correct: preempt=none is unselectable
> under PREEMPT_DYNAMIC, and the arches that can still pick PREEMPT_NONE
> have no NUMA, so mainline cannot reach this path.
> 
> I was aiming at the 6.6 LTS configs that shipped PREEMPT_NONE + NUMA: two
> lines of cond_resched(), no behaviour change, same as do_pages_stat() got
> in 8e934ab44389.  If you and Andrew would rather not carry a stable-only
> fix, just say so and I will withdraw it.

I think this one will be the last ones where we do that and don't really have a
real workload run into it.

It's not a good use of our time and it doesn't make upstream any better :)

-- 
Cheers,

David

Re: [PATCH v2] mm/migrate: fix softlockup in do_pages_move() with huge page arrays

[David Hildenbrand]

On Sun, 08 Nov 2026 14:28:31 +0800, shao.mingyin@zte.com.cn wrote:
> mm/migrate: fix softlockup in do_pages_move() with huge page arrays
> 
> do_pages_move() walks the array one page at a time.  An entry naming the
> node its page is already on is never queued, so the loop runs without a
> voluntary preemption point on a non-preemptible kernel; the existing
> cond_resched() calls in the migration code are only reached after a
> folio has been queued.  nr_pages comes straight from the syscall.
> 
> [...]

Applied, thanks!

tree: mm/core.git
branch: migrate-7.5.misc

Applied patches will appear soon in mm-next, followed by linux-next.

Please report any outstanding bugs that were missed during review, so we
can either drop the patch series or decide how to fix it up.

It is encouraged to provide Acked-bys, Reviewed-bys, and Tested-bys even
though the patches have already been applied. If possible, patch trailers
will be updated.

Note that commit hashes shown below are subject to change due to rebase,
trailer updates or similar. Further, this is not a guarantee that the
patches will go upstream. If in doubt, please check the listed branch.

[1/1] mm/migrate: fix softlockup in do_pages_move() with huge page arrays
      https://git.kernel.org/mm/core/c/e200153a

-- 
Cheers,

David