Re: [PATCH] tools libbpf: Fix signed shift UB in btf_type_info()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The commit provides an incomplete fix: it resolves the signed shift undefined behavior in the `btf_type_info()` function but misses the exact same undefined behavior in the `BTF_INFO_ENC()` macro defined in the same file (and duplicated in selftests).
--

commit d2829a28ec022a655878147a1269bec0aaf774db
Author: Liu Jing <liujing@cmss.chinamobile.com>

tools libbpf: Fix signed shift UB in btf_type_info()

This commit fixes a signed shift undefined behavior in btf_type_info() by
casting the kflag parameter to an unsigned int before left-shifting by 31
bits.

> diff --git a/tools/lib/bpf/libbpf_internal.h b/tools/lib/bpf/libbpf_internal.h
> index 4c46d34fc055d..2fda8c916cc35 100644
> --- a/tools/lib/bpf/libbpf_internal.h
> +++ b/tools/lib/bpf/libbpf_internal.h
> @@ -259,7 +259,7 @@ static inline enum btf_func_linkage btf_func_linkage(const struct btf_type *t)
>  
>  static inline __u32 btf_type_info(int kind, int vlen, int kflag)
>  {
> -	return (kflag << 31) | (kind << 24) | vlen;
> +	return (((unsigned int)kflag << 31)) | (kind << 24) | vlen;
>  }

[Severity: High]
This isn't a bug introduced by this patch, but while fixing the signed
shift undefined behavior in btf_type_info(), it looks like the exact
same issue was missed in the BTF_INFO_ENC() macro defined in this same
file.

The BTF_INFO_ENC() macro evaluates !!(kind_flag) << 31:

#define BTF_INFO_ENC(kind, kind_flag, vlen) \
    ((!!(kind_flag) << 31) | ((kind) << 24) | ((vlen) & BTF_MAX_VLEN))

Because !!(kind_flag) yields a signed 32-bit int, shifting it left by 31
bits results in 1 << 31 when kind_flag is non-zero (e.g., when encoding
BTF_KIND_DECL_TAG). Doesn't this also trigger the same undefined behavior
that compilers could exploit to generate corrupted BTF data?

Additionally, it looks like this same macro is duplicated in the selftests
under tools/testing/selftests/bpf/test_btf.h and
tools/testing/selftests/bpf/progs/syscall.c. Should those be updated as
well to ensure a complete fix across both libbpf and the selftests?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260903082616.5096-1-liujing@cmss.chinamobile.com?part=1