[PATCH v2] libpf: Fix for the potential undefined behavior due to shifting

[PATCH v2] libpf: Fix for the potential undefined behavior due to shifting

[Tw]

When compiling libbpf with sanitation, ubsan will report the following:
```
left shift of 1 by 31 places cannot be represented in type 'int'
```
This may lead to undefined behavior according to the compiler implementation,
let's fix it by casting to unsigned counterpart before shifting.

Signed-off-by: Tan Wei <tw19881113@gmail.com>
---
v2:
 - Fix two more cases found by AI.
 - Refine the commit message a bit.

 tools/lib/bpf/libbpf.c          | 2 +-
 tools/lib/bpf/libbpf_internal.h | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
index b749c0174..f09cbfd8e 100644
--- a/tools/lib/bpf/libbpf.c
+++ b/tools/lib/bpf/libbpf.c
@@ -11738,7 +11738,7 @@ static int perf_event_open_probe(bool uprobe, bool retprobe, const char *name,
 				errstr(bit));
 			return bit;
 		}
-		attr.config |= 1 << bit;
+		attr.config |= 1ULL << bit;
 	}
 	attr.size = attr_sz;
 	attr.type = type;
diff --git a/tools/lib/bpf/libbpf_internal.h b/tools/lib/bpf/libbpf_internal.h
index 4c46d34fc..2df1df3f3 100644
--- a/tools/lib/bpf/libbpf_internal.h
+++ b/tools/lib/bpf/libbpf_internal.h
@@ -77,7 +77,7 @@
 #define JUMPTABLES_SEC ".jumptables"
 
 #define BTF_INFO_ENC(kind, kind_flag, vlen) \
-	((!!(kind_flag) << 31) | ((kind) << 24) | ((vlen) & BTF_MAX_VLEN))
+	((!!((__u32)kind_flag) << 31) | ((kind) << 24) | ((vlen) & BTF_MAX_VLEN))
 #define BTF_TYPE_ENC(name, info, size_or_type) (name), (info), (size_or_type)
 #define BTF_INT_ENC(encoding, bits_offset, nr_bits) \
 	((encoding) << 24 | (bits_offset) << 16 | (nr_bits))
@@ -259,7 +259,7 @@ static inline enum btf_func_linkage btf_func_linkage(const struct btf_type *t)
 
 static inline __u32 btf_type_info(int kind, int vlen, int kflag)
 {
-	return (kflag << 31) | (kind << 24) | vlen;
+	return ((__u32)kflag << 31) | (kind << 24) | vlen;
 }
 
 enum map_def_parts {
-- 
2.54.0

Re: [PATCH v2] libpf: Fix for the potential undefined behavior due to shifting

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] The patch attempts to fix undefined behavior in `BTF_INFO_ENC` but places the cast incorrectly, leaving the undefined behavior unresolved. According to the C standard (C11 6.5.3.3), the logical negation operator `!` always yields a signed `int` (0 or 1), regardless of the operand's type. Thus, `!!((__u32)kind_flag)` evaluates to a signed `int`. Left-shifting this signed `int` by 31 places (`!!(...) << 31`) continues to trigger undefined behavior by shifting a bit into the sign bit of a 32-bit signed integer. To correctly prevent the undefined behavior, the cast must be applied after the logical negation, e.g., `((__u32)!!(kind_flag) << 31)`.
--

commit ce021dde7807eb8995ad265d12e0e7372294cfb7
Author: Tw <tw19881113@gmail.com>

libpf: Fix for the potential undefined behavior due to shifting

This patch aims to fix an undefined behavior issue reported by UBSAN in
libbpf ("left shift of 1 by 31 places cannot be represented in type 'int'")
by casting the operand to an unsigned type before shifting.

[ ... ]

> diff --git a/tools/lib/bpf/libbpf_internal.h b/tools/lib/bpf/libbpf_internal.h
> index 4c46d34fc055d..2df1df3f3f22c 100644
> --- a/tools/lib/bpf/libbpf_internal.h
> +++ b/tools/lib/bpf/libbpf_internal.h
> @@ -77,7 +77,7 @@
>  #define JUMPTABLES_SEC ".jumptables"
>  
>  #define BTF_INFO_ENC(kind, kind_flag, vlen) \
> -	((!!(kind_flag) << 31) | ((kind) << 24) | ((vlen) & BTF_MAX_VLEN))
> +	((!!((__u32)kind_flag) << 31) | ((kind) << 24) | ((vlen) & BTF_MAX_VLEN))

[Severity: Medium]
Does this cast actually resolve the undefined behavior, or is the regression 
still present?

According to C11 6.5.3.3, the logical negation operator (!) always yields a 
signed int (0 or 1), regardless of the operand's type. This means 
!!((__u32)kind_flag) evaluates to a signed int.

Left-shifting this signed int by 31 places continues to shift a bit into 
the sign bit of a 32-bit signed integer.

Could the cast be applied after the logical negation instead, such as 
((__u32)!!(kind_flag) << 31)?

>  #define BTF_TYPE_ENC(name, info, size_or_type) (name), (info), (size_or_type)
>  #define BTF_INT_ENC(encoding, bits_offset, nr_bits) \
>  	((encoding) << 24 | (bits_offset) << 16 | (nr_bits))

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260827001007.1420507-1-tw19881113@gmail.com?part=1