Re: [PATCH v3 02/13] preempt: Introduce HARDIRQ_DISABLE_BITS

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] NMI nesting inside a hardirq causes `HARDIRQ` count to overflow into `NMI` bits, leading to permanent `preempt_count` corruption and a kernel panic.
--

commit 81acab4bc4267e8b9061bcb43c1763c01ce614f2
Author: Boqun Feng <boqun@kernel.org>

preempt: Introduce HARDIRQ_DISABLE_BITS

This commit changes the preempt_count() layout to contain an 8-bit
HARDIRQ_DISABLE count to track interrupt disabling nested levels. This
supports preempt_disable()-like interrupt disabling.

Link: https://patch.msgid.link/20260121223933.1568682-2-lyude@redhat.com

> diff --git a/include/linux/preempt.h b/include/linux/preempt.h
> index 586f966883255..e2d3079d3f5f1 100644
> --- a/include/linux/preempt.h
> +++ b/include/linux/preempt.h

[ ... ]

> @@ -31,29 +32,34 @@
>   *
>   *         PREEMPT_MASK:	0x000000ff
>   *         SOFTIRQ_MASK:	0x0000ff00
> - *         HARDIRQ_MASK:	0x000f0000
> - *             NMI_MASK:	0x00100000
> + * HARDIRQ_DISABLE_MASK:	0x00ff0000
> + *         HARDIRQ_MASK:	0x0f000000
> + *             NMI_MASK:	0x10000000
>   * PREEMPT_NEED_RESCHED:	0x80000000
>   */
>  #define PREEMPT_BITS	8
>  #define SOFTIRQ_BITS	8
> +#define HARDIRQ_DISABLE_BITS	8
>  #define HARDIRQ_BITS	4

[Severity: High]
This is a pre-existing issue, but does keeping HARDIRQ_BITS at 4 risk a
structural overflow into the NMI bits during deep NMI nesting?

Looking at __preempt_count_nmi_enter() in include/linux/hardirq.h, it adds
HARDIRQ_OFFSET to preempt_count on every NMI, and explicitly permits up to
15 nested NMIs:

include/linux/hardirq.h:__preempt_count_nmi_enter() {
	__preempt_count_add(HARDIRQ_OFFSET);
	/* Maximum NMI nesting is 15. */
	BUG_ON(__this_cpu_read(nmi_nesting) >= 15);
	...
}

If 15 NMIs nest while the CPU is already inside a hardirq (where the HARDIRQ
count is 1), the total count reaches 16.

Since HARDIRQ_BITS is 4, would a value of 16 overflow the 4-bit field into the
adjacent NMI field? It appears this could corrupt preempt_count and eventually
clear the NMI flags prematurely during exit, leading to a kernel panic.

>  #define NMI_BITS	1
>  
>  #define PREEMPT_SHIFT	0
>  #define SOFTIRQ_SHIFT	(PREEMPT_SHIFT + PREEMPT_BITS)
> -#define HARDIRQ_SHIFT	(SOFTIRQ_SHIFT + SOFTIRQ_BITS)
> +#define HARDIRQ_DISABLE_SHIFT	(SOFTIRQ_SHIFT + SOFTIRQ_BITS)
> +#define HARDIRQ_SHIFT	(HARDIRQ_DISABLE_SHIFT + HARDIRQ_DISABLE_BITS)
>  #define NMI_SHIFT	(HARDIRQ_SHIFT + HARDIRQ_BITS)

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260605054128.5925-1-boqun@kernel.org?part=2