(nuttx) branch master updated: mm/ubsan: fix signed inline value decoding

[jerpelea]

This is an automated email from the ASF dual-hosted git repository.

jerpelea pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/nuttx.git


The following commit(s) were added to refs/heads/master by this push:
     new 6f175b09973 mm/ubsan: fix signed inline value decoding
6f175b09973 is described below

commit 6f175b0997302a873dcffb847fbd8e160ce38ff2
Author: hanzhijian <hanzhij...@zepp.com>
AuthorDate: Wed Jul 29 20:05:53 2026 +0800

    mm/ubsan: fix signed inline value decoding
    
    Restore the explicit signed conversion and parenthesize the sign-bit test
    so it is evaluated before the bitwise AND.  Without this, operator
    precedence makes the decoder test bit zero instead of the sign bit and
    negative inline operands are reported as large positive values.
    
    Build the width mask without shifting by the full width of uint64_t.
    This avoids recursively invoking UBSan while decoding a 64-bit inline
    operand.
    
    Signed-off-by: hanzhijian <hanzhij...@zepp.com>
---
 mm/ubsan/ubsan.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/mm/ubsan/ubsan.c b/mm/ubsan/ubsan.c
index f0b2944a04e..5d31b137a3e 100644
--- a/mm/ubsan/ubsan.c
+++ b/mm/ubsan/ubsan.c
@@ -158,10 +158,11 @@ static int64_t get_signed_val(FAR struct type_descriptor 
*type,
   if (is_inline_int(type))
     {
       unsigned bits = type_bit_width(type);
-      uint64_t mask = (1llu << bits) - 1;
+      uint64_t mask = UINT64_MAX >> (sizeof(uint64_t) * 8 - bits);
       uint64_t ret = (uintptr_t)val & mask;
 
-      return ret & (1llu << (bits - 1)) != 0 ? ret | ~mask : ret;
+      return (int64_t)(((ret & (1llu << (bits - 1))) != 0) ?
+             ret | ~mask : ret);
     }
 
   return *(FAR int64_t *)val;