linux-kernel - [PATCH] tmon: Fix undefined behavior in left shift

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20250901144756.1179834-1-visitorckw@gmail.com>
Date: Mon,  1 Sep 2025 22:47:56 +0800
From: Kuan-Wei Chiu <visitorckw@...il.com>
To: rafael@...nel.org,
	daniel.lezcano@...aro.org
Cc: rui.zhang@...el.com,
	lukasz.luba@....com,
	jacob.jun.pan@...ux.intel.com,
	jserv@...s.ncku.edu.tw,
	linux-pm@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	Kuan-Wei Chiu <visitorckw@...il.com>
Subject: [PATCH] tmon: Fix undefined behavior in left shift

Using 1 << j when j reaches 31 triggers undefined behavior because
the constant 1 is of type int, and shifting it left by 31 exceeds
the range of signed int. UBSAN reports:

tmon.c:174:54: runtime error: left shift of 1 by 31 places cannot be represented in type 'int'

According to the C11 standard:

"If E1 has a signed type and E1 x 2^E2 is not representable in the
result type, the behavior is undefined."

Fix this by using 1U << j, ensuring the shift is performed on an
unsigned type where all 32 bits are representable.

Fixes: 94f69966faf8 ("tools/thermal: Introduce tmon, a tool for thermal subsystem")
Signed-off-by: Kuan-Wei Chiu <visitorckw@...il.com>
---
 tools/thermal/tmon/tmon.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/thermal/tmon/tmon.c b/tools/thermal/tmon/tmon.c
index 7eb3216a27f4..ef67cd1a4861 100644
--- a/tools/thermal/tmon/tmon.c
+++ b/tools/thermal/tmon/tmon.c
@@ -171,7 +171,7 @@ static void prepare_logging(void)
 
 		memset(binding_str, 0, sizeof(binding_str));
 		for (j = 0; j < 32; j++)
-			binding_str[j] = (ptdata.tzi[i].cdev_binding & (1 << j)) ?
+			binding_str[j] = (ptdata.tzi[i].cdev_binding & (1U << j)) ?
 				'1' : '0';
 
 		fprintf(tmon_log, "#thermal zone %s%02d cdevs binding: %32s\n",
-- 
2.34.1