From: Liu Jing <liujing@cmss.chinamobile.com>

In btf_type_info(), the expression `kflag << 31` performs a signed
integer shift. When kflag is 1, this sets the sign bit of a 32-bit
signed integer, which is undefined behavior in C.

Fix it by casting kflag to unsigned int before the shift.

Signed-off-by: Liu Jing <liujing@cmss.chinamobile.com>
---
--- a/tools/lib/bpf/libbpf_internal.h
+++ b/tools/lib/bpf/libbpf_internal.h
@@ -259,7 +259,7 @@
 
 static inline __u32 btf_type_info(int kind, int vlen, int kflag)
 {
-	return (kflag << 31) | (kind << 24) | vlen;
+	return (((unsigned int)kflag << 31)) | (kind << 24) | vlen;
 }
 
 enum map_def_parts {

On Thu, Sep 3, 2026 at 1:26 AM liujing <liujing@cmss.chinamobile.com> wrote:
>
> From: Liu Jing <liujing@cmss.chinamobile.com>
>
> In btf_type_info(), the expression `kflag << 31` performs a signed
> integer shift. When kflag is 1, this sets the sign bit of a 32-bit
> signed integer, which is undefined behavior in C.
>
> Fix it by casting kflag to unsigned int before the shift.
>
> Signed-off-by: Liu Jing <liujing@cmss.chinamobile.com>
> ---
> --- a/tools/lib/bpf/libbpf_internal.h
> +++ b/tools/lib/bpf/libbpf_internal.h
> @@ -259,7 +259,7 @@
>
>  static inline __u32 btf_type_info(int kind, int vlen, int kflag)
>  {
> -       return (kflag << 31) | (kind << 24) | vlen;
> +       return (((unsigned int)kflag << 31)) | (kind << 24) | vlen;

this was recently fixed as part of slightly bigger set of fixes of the
similar kind

pw-bot: cr

>  }
>
>  enum map_def_parts {
>
>
>
>

> In btf_type_info(), the expression `kflag << 31` performs a signed
> integer shift. When kflag is 1, this sets the sign bit of a 32-bit
> signed integer, which is undefined behavior in C.
>
> Fix it by casting kflag to unsigned int before the shift.
>
> Signed-off-by: Liu Jing <liujing@cmss.chinamobile.com>

This looks like a bug fix for undefined behavior that was introduced in
an earlier commit. Should this include a Fixes: tag?

The signed shift undefined behavior in btf_type_info() appears to have
been introduced by commit aea28a602fa1 ("libbpf: Mark BPF subprogs with
hidden visibility as static for BPF verifier"). Would it be appropriate
to add:

  Fixes: aea28a602fa1 ("libbpf: Mark BPF subprogs with hidden visibility as static for BPF verifier")


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/33734678501