is_boot_sector_ntfs() checks the boot sector's sectors_per_cluster field
with a range test that rejects 0x81..0xf3 but accepts 0 and other
non-power-of-two counts. A zero value reaches parse_ntfs_boot_sector():

	sectors_per_cluster_bits = ffs(sectors_per_cluster) - 1;
	...
	vol->cluster_size = vol->sector_size << sectors_per_cluster_bits;

ffs(0) is 0, so sectors_per_cluster_bits becomes (unsigned)-1 and the
shift is undefined:

  UBSAN: shift-out-of-bounds in fs/ntfs/super.c:673:39
  shift exponent 4294967295 is too large for 32-bit type 'int'

This change rejects any non-power-of-two value, since it feeds the 
aforementioned shift via ffs() - 1, which only yields the correct shift for a
power of two.

Fixes: 6251f0b0de7d ("ntfs: update super block operations")
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Dennis Tighe <dennis.tighe@gmail.com>
---
Changes in v2:
 - Check that sectors_per_cluster is a power of two rather than only
   rejecting zero, per Hyunchul Lee's review. 

is_boot_sector_ntfs() is where the driver decides an image is NTFS, so
rejecting a bad geometry there stops it before parse_ntfs_boot_sector()
computes ffs() - 1. Reached by mounting the image.

Built ntfs-next with KASAN+UBSAN and tested: sectors_per_cluster = 0 and a
non-power-of-two value (e.g. 3) are both rejected with no UBSAN, and a valid
volume still mounts (create/write/mkdir/rename/unlink smoke passes).

A reproducer is available on request.

 fs/ntfs/super.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/ntfs/super.c b/fs/ntfs/super.c
index 2fd7db672..76f62dac2 100644
--- a/fs/ntfs/super.c
+++ b/fs/ntfs/super.c
@@ -557,8 +557,8 @@ static bool is_boot_sector_ntfs(const struct super_block *sb,
 	 * Check sectors per cluster value is valid and the cluster size
 	 * is not above the maximum (2MB).
 	 */
-	if (b->bpb.sectors_per_cluster > 0x80 &&
-	    b->bpb.sectors_per_cluster < 0xf4)
+	if (b->bpb.sectors_per_cluster < 0xf4 &&
+	    !is_power_of_2(b->bpb.sectors_per_cluster))
 		goto not_ntfs;
 
 	/* Check reserved/unused fields are really zero. */

On Wed, Aug 26, 2026 at 2:09 PM Dennis Tighe <dennis.tighe@gmail.com> wrote:
>
> is_boot_sector_ntfs() checks the boot sector's sectors_per_cluster field
> with a range test that rejects 0x81..0xf3 but accepts 0 and other
> non-power-of-two counts. A zero value reaches parse_ntfs_boot_sector():
>
>         sectors_per_cluster_bits = ffs(sectors_per_cluster) - 1;
>         ...
>         vol->cluster_size = vol->sector_size << sectors_per_cluster_bits;
>
> ffs(0) is 0, so sectors_per_cluster_bits becomes (unsigned)-1 and the
> shift is undefined:
>
>   UBSAN: shift-out-of-bounds in fs/ntfs/super.c:673:39
>   shift exponent 4294967295 is too large for 32-bit type 'int'
>
> This change rejects any non-power-of-two value, since it feeds the
> aforementioned shift via ffs() - 1, which only yields the correct shift for a
> power of two.
>
> Fixes: 6251f0b0de7d ("ntfs: update super block operations")
> Assisted-by: Claude:claude-opus-4-8
> Signed-off-by: Dennis Tighe <dennis.tighe@gmail.com>
Applied it to #ntfs-next.
Thanks!