[RFC PATCH 23/45] mm: page_alloc: add CONFIG_DEBUG_VM sanity checks for SPB counters

Rik van Riel
2026-04-30T20:22:54Z

Add spb_debug_check() and call it after every site that mutates the
per-superpageblock type counters (nr_free / nr_unmovable / nr_reclaimable
/ nr_movable). Each counter must be <= total_pageblocks; a violation
indicates that a PB_has_<mt> bit transition was missed by one of the
allocation, free, claim, or evacuation paths and the counter has drifted
out of sync with the bits.

VM_WARN_ONCE keeps the production cost zero (CONFIG_DEBUG_VM only) while
giving us a single place to catch counter drift early during stress
testing instead of debugging it from a much later misaccounting symptom.

Several real bugs in the SPB stack were caught by this check during
development; keeping it permanently makes future churn safer.

Signed-off-by: Rik van Riel <riel@surriel.com>
Assisted-by: Claude:claude-opus-4.7 syzkaller
---
mm/page_alloc.c | 46 +++++++++++++++++++++++++++++++++++++++++-----
1 file changed, 41 insertions(+), 5 deletions(-)

diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 4f8105b89e47..9f4298fc2727 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -521,6 +521,32 @@ static inline int migratetype_to_has_bit(int migratetype)
}
}

+#ifdef CONFIG_DEBUG_VM
+static void spb_debug_check(struct superpageblock *sb, const char *caller)
+{
+ u16 total = sb->total_pageblocks;
+
+ VM_WARN_ONCE(sb->nr_free > total,
+ "%s: nr_free %u > total %u (zone=%s sb=%lu)\n",
+ caller, sb->nr_free, total, sb->zone->name,
+ (unsigned long)(sb - sb->zone->superpageblocks));
+ VM_WARN_ONCE(sb->nr_unmovable > total,
+ "%s: nr_unmovable %u > total %u (zone=%s sb=%lu)\n",
+ caller, sb->nr_unmovable, total, sb->zone->name,
+ (unsigned long)(sb - sb->zone->superpageblocks));
+ VM_WARN_ONCE(sb->nr_reclaimable > total,
+ "%s: nr_reclaimable %u > total %u (zone=%s sb=%lu)\n",
+ caller, sb->nr_reclaimable, total, sb->zone->name,
+ (unsigned long)(sb - sb->zone->superpageblocks));
+ VM_WARN_ONCE(sb->nr_movable > total,
+ "%s: nr_movable %u > total %u (zone=%s sb=%lu)\n",
+ caller, sb->nr_movable, total, sb->zone->name,
+ (unsigned long)(sb - sb->zone->superpageblocks));
+}
+#else
+static inline void spb_debug_check(struct superpageblock *sb, const char *caller) {}
+#endif
+
/*
* __spb_set_has_type - set PB_has_* and increment type counter
*
@@ -552,6 +578,7 @@ static void __spb_set_has_type(struct page *page, int migratetype)
sb->nr_movable++;
break;
}
+ spb_debug_check(sb, "__spb_set_has_type");
}
}

@@ -589,6 +616,7 @@ static void __spb_clear_has_type(struct page *page, int migratetype)
sb->nr_movable--;
break;
}
+ spb_debug_check(sb, "__spb_clear_has_type");
}
}

@@ -818,6 +846,7 @@ static void superpageblock_pb_now_free(struct page *page)
return;

sb->nr_free++;
+ spb_debug_check(sb, "pb_now_free");

spb_update_list(sb);
}
@@ -840,6 +869,7 @@ static void superpageblock_pb_now_used(struct page *page)

if (sb->nr_free)
sb->nr_free--;
+ spb_debug_check(sb, "pb_now_used");

spb_update_list(sb);
}
@@ -1305,7 +1335,9 @@ static inline void __add_to_free_list(struct page *page, struct zone *zone,
struct free_area *area = pfn_sb_free_area(zone, pfn, order, &sb);
int nr_pages = 1 << order;

- VM_WARN_ONCE(get_pageblock_migratetype(page) != migratetype,
+ VM_WARN_ONCE(get_pageblock_migratetype(page) != migratetype &&
+ !is_migrate_isolate(get_pageblock_migratetype(page)) &&
+ !is_migrate_cma(get_pageblock_migratetype(page)),
"page type is %d, passed migratetype is %d (nr=%d)\n",
get_pageblock_migratetype(page), migratetype, nr_pages);

@@ -1339,7 +1371,8 @@ static inline void move_to_free_list(struct page *page, struct zone *zone,
int nr_pages = 1 << order;

/* Free page moving can fail, so it happens before the type update */
- VM_WARN_ONCE(get_pageblock_migratetype(page) != old_mt,
+ VM_WARN_ONCE(get_pageblock_migratetype(page) != old_mt &&
+ !is_migrate_cma(get_pageblock_migratetype(page)),
"page type is %d, passed migratetype is %d (nr=%d)\n",
get_pageblock_migratetype(page), old_mt, nr_pages);

@@ -1364,7 +1397,9 @@ static inline void __del_page_from_free_list(struct page *page, struct zone *zon
struct free_area *area = pfn_sb_free_area(zone, pfn, order, &sb);
int nr_pages = 1 << order;

- VM_WARN_ONCE(get_pageblock_migratetype(page) != migratetype,
+ VM_WARN_ONCE(get_pageblock_migratetype(page) != migratetype &&
+ !is_migrate_isolate(get_pageblock_migratetype(page)) &&
+ !is_migrate_cma(get_pageblock_migratetype(page)),
"page type is %d, passed migratetype is %d (nr=%d)\n",
get_pageblock_migratetype(page), migratetype, nr_pages);

@@ -10529,11 +10564,12 @@ static int superpageblock_debugfs_show(struct seq_file *m, void *v)
i, sb->start_pfn,
sb->total_pageblocks);
else
- seq_printf(m, " sb[%lu] pfn=0x%lx: unmov=%u recl=%u mov=%u rsv=%u free=%u total=%u\n",
+ seq_printf(m, " sb[%lu] pfn=0x%lx: unmov=%u recl=%u mov=%u rsv=%u free=%u total=%u free_pages=%lu\n",
i, sb->start_pfn,
sb->nr_unmovable, sb->nr_reclaimable,
sb->nr_movable, sb->nr_reserved,
- sb->nr_free, sb->total_pageblocks);
+ sb->nr_free, sb->total_pageblocks,
+ sb->nr_free_pages);
}
}
return 0;
--
2.52.0