[PATCH v2] mm/migrate: fix softlockup in do_pages_move() with huge page arrays

[shao.mingyin]

From: Shao Mingyin <shao.mingyin@xxxxxxxxxx>

mm/migrate: fix softlockup in do_pages_move() with huge page arrays

do_pages_move() walks the array one page at a time.  An entry naming the
node its page is already on is never queued, so the loop runs without a
voluntary preemption point on a non-preemptible kernel; the existing
cond_resched() calls in the migration code are only reached after a
folio has been queued.  nr_pages comes straight from the syscall.

A 6.6.60 x86_64 kernel with CONFIG_PREEMPT_NONE=y and CONFIG_NUMA=y
reproduces this under QEMU TCG: 50 million entries pointing at a page
already on the target node keep the CPU in do_pages_move() for 42.9 s and
trip the softlockup watchdog; with this patch the same call completes in
44.3 s without a softlockup.

Add cond_resched() so that long calls yield periodically.
do_pages_stat() had the same problem; it was fixed by 8e934ab44389.  In
current mainline only alpha, hexagon and classic m68k can select
PREEMPT_NONE and they cannot enable CONFIG_NUMA, so this mainly targets
pre-v7.0 stable kernels.

Fixes: a49bd4d71637 ("mm, numa: rework do_pages_move")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Shao Mingyin <shao.mingyin@xxxxxxxxxx>
---
Changes in v2:
  - describe the reproduction and the code path, as requested by David
    Hildenbrand; no code change
  - correct the do_pages_stat() reference (fixed by 8e934ab44389)
Link: https://lore.kernel.org/all/20261107213856462Jx8pIdgdtLvPLfOFTwV4X@xxxxxxxxxx/

 mm/migrate.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/mm/migrate.c b/mm/migrate.c
index 875079464930..3122ecb85270 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -2372,6 +2372,8 @@ static int do_pages_move(struct mm_struct *mm, nodemask_t task_nodes,
 		const void __user *p;
 		int node;
 
+		cond_resched();
+
 		err = -EFAULT;
 		if (in_compat_syscall()) {
 			compat_uptr_t cp;