[llvm] [HWASan] Fix UB in tag-bits mask shift (PR #202269)

Maosu Zhao via llvm-commits llvm-commits at lists.llvm.org
Mon Jun 8 22:46:05 PDT 2026


https://github.com/zhaomaosu updated https://github.com/llvm/llvm-project/pull/202269

>From 50683ffe3a65253c41d1f7ea09c54dda5393cf95 Mon Sep 17 00:00:00 2001
From: Maosu Zhao <maosu.zhao at intel.com>
Date: Wed, 3 Jun 2026 15:00:45 +0800
Subject: [PATCH] [HWASan] Fix UB in tag-bits mask shift

`TagMaskByte &= (1 << ClTagBits) - 1` shifts an `int` literal, which is
undefined behavior for `ClTagBits >= 32`.
---
 llvm/lib/Transforms/Instrumentation/HWAddressSanitizer.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/llvm/lib/Transforms/Instrumentation/HWAddressSanitizer.cpp b/llvm/lib/Transforms/Instrumentation/HWAddressSanitizer.cpp
index 50eecdb168161..230977540bf82 100644
--- a/llvm/lib/Transforms/Instrumentation/HWAddressSanitizer.cpp
+++ b/llvm/lib/Transforms/Instrumentation/HWAddressSanitizer.cpp
@@ -687,7 +687,7 @@ void HWAddressSanitizer::initializeModule() {
     if (TagMaskByte < 4)
       reportFatalUsageError(
           "need more than 4 bits of tag to have non-short-granule tags");
-    TagMaskByte &= (1 << ClTagBits) - 1;
+    TagMaskByte &= (1ULL << ClTagBits) - 1;
   }
 
   Mapping.init(TargetTriple, InstrumentWithCalls, CompileKernel);



More information about the llvm-commits mailing list