[PATCH] perf intel-pt: Fix undefined shift in intel_pt_bip()

liujing posted 1 patch 3 weeks, 1 day ago
[PATCH] perf intel-pt: Fix undefined shift in intel_pt_bip()
Posted by liujing 3 weeks, 1 day ago
From: Liu Jing <liujing@cmss.chinamobile.com>

In intel_pt_bip(), the expression `1 << id` performs a signed integer
shift where id is a uint32_t. If id >= 32, this is undefined behavior.
The bounds check `id >= INTEL_PT_BLK_ITEM_ID_CNT` occurs after the shift,
so the UB has already happened.

Fix it by moving the bounds check before the shift and using `1U << id`
to perform an unsigned shift.

Signed-off-by: Liu Jing <liujing@cmss.chinamobile.com>
---
--- a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
+++ b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
@@ -2060,7 +2060,6 @@
 static void intel_pt_bip(struct intel_pt_decoder *decoder)
 {
 	uint32_t id = decoder->packet.count;
-	uint32_t bit = 1 << id;
 	int pos = decoder->blk_type_pos;
 
 	if (pos < 0 || id >= INTEL_PT_BLK_ITEM_ID_CNT) {
@@ -2068,6 +2067,7 @@
 			     id, decoder->blk_type);
 		return;
 	}
+	uint32_t bit = 1U << id;
 
 	if (decoder->state.items.mask[pos] & bit) {
 		intel_pt_log("WARNING: Duplicate block item %u type %d\n",