[PATCH] perf intel-pt: Fix undefined shift in intel_pt_bip()
From: liujing
Date: Thu Sep 03 2026 - 04:55:01 EST
From: Liu Jing <liujing@xxxxxxxxxxxxxxxxxxxx>
In intel_pt_bip(), the expression `1 << id` performs a signed integer
shift where id is a uint32_t. If id >= 32, this is undefined behavior.
The bounds check `id >= INTEL_PT_BLK_ITEM_ID_CNT` occurs after the shift,
so the UB has already happened.
Fix it by moving the bounds check before the shift and using `1U << id`
to perform an unsigned shift.
Signed-off-by: Liu Jing <liujing@xxxxxxxxxxxxxxxxxxxx>
---
--- a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
+++ b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
@@ -2060,7 +2060,6 @@
static void intel_pt_bip(struct intel_pt_decoder *decoder)
{
uint32_t id = decoder->packet.count;
- uint32_t bit = 1 << id;
int pos = decoder->blk_type_pos;
if (pos < 0 || id >= INTEL_PT_BLK_ITEM_ID_CNT) {
@@ -2068,6 +2067,7 @@
id, decoder->blk_type);
return;
}
+ uint32_t bit = 1U << id;
if (decoder->state.items.mask[pos] & bit) {
intel_pt_log("WARNING: Duplicate block item %u type %d\n",