[PATCH] ntfs: reject zero sectors_per_cluster in the boot sector

[PATCH] ntfs: reject zero sectors_per_cluster in the boot sector

[Dennis Tighe]

is_boot_sector_ntfs() checks the boot sector's sectors_per_cluster field
with a range test that rejects 0x81..0xf3 but accepts 0. A zero value
then reaches parse_ntfs_boot_sector():

	sectors_per_cluster_bits = ffs(sectors_per_cluster) - 1;
	...
	vol->cluster_size = vol->sector_size << sectors_per_cluster_bits;

ffs(0) is 0, so sectors_per_cluster_bits becomes (unsigned)-1 and the
shift is undefined:

  UBSAN: shift-out-of-bounds in fs/ntfs/super.c:673:39
  shift exponent 4294967295 is too large for 32-bit type 'int'

Reject sectors_per_cluster == 0 alongside the existing range check.

Fixes: 6251f0b0de7d ("ntfs: update super block operations")
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Dennis Tighe <dennis.tighe@gmail.com>
---
is_boot_sector_ntfs() is where the driver decides an image is NTFS, so
rejecting sectors_per_cluster == 0 there stops the bad geometry before
parse_ntfs_boot_sector() computes ffs(0) - 1. Reached by mounting a test
image on my dev machine.

A reproducer is available on request.

 fs/ntfs/super.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/fs/ntfs/super.c b/fs/ntfs/super.c
index d400fea32..48bea5ce1 100644
--- a/fs/ntfs/super.c
+++ b/fs/ntfs/super.c
@@ -557,8 +557,9 @@ static bool is_boot_sector_ntfs(const struct super_block *sb,
 	 * Check sectors per cluster value is valid and the cluster size
 	 * is not above the maximum (2MB).
 	 */
-	if (b->bpb.sectors_per_cluster > 0x80 &&
-	    b->bpb.sectors_per_cluster < 0xf4)
+	if (!b->bpb.sectors_per_cluster ||
+	    (b->bpb.sectors_per_cluster > 0x80 &&
+	     b->bpb.sectors_per_cluster < 0xf4))
 		goto not_ntfs;
 
 	/* Check reserved/unused fields are really zero. */