When the NTFS BOOT sectors_per_clusters field is > 0x80,
it represents a shift value. Make sure that the shift value is
not too large (> 31) before using it. Return 0xffffffff if it is.
This prevents negative shift values and shift values that are
larger than the field size.
Prevents this UBSAN error:
UBSAN: shift-out-of-bounds in ../fs/ntfs3/super.c:673:16
shift exponent -192 is negative
Fixes: 82cae269cfa9 ("fs/ntfs3: Add initialization of super block")
Signed-off-by: Randy Dunlap <rdunlap@xxxxxxxxxxxxx>
Reported-by: syzbot+1631f09646bc214d2e76@xxxxxxxxxxxxxxxxxxxxxxxxx
Cc: Konstantin Komarov <almaz.alexandrovich@xxxxxxxxxxxxxxxxxxxx>
Cc: ntfs3@xxxxxxxxxxxxxxx
Cc: Alexander Viro <viro@xxxxxxxxxxxxxxxxxx>
Cc: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
Cc: Kari Argillander <kari.argillander@xxxxxxxxxxxxxxxxxxxx>
Cc: Namjae Jeon <linkinjeon@xxxxxxxxxx>
Cc: Matthew Wilcox <willy@xxxxxxxxxxxxx>
---
v2: use Willy's suggestions
fs/ntfs3/super.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
--- linux-next-20220428.orig/fs/ntfs3/super.c
+++ linux-next-20220428/fs/ntfs3/super.c
@@ -668,9 +668,11 @@ static u32 format_size_gb(const u64 byte
static u32 true_sectors_per_clst(const struct NTFS_BOOT *boot)
{
- return boot->sectors_per_clusters <= 0x80
- ? boot->sectors_per_clusters
- : (1u << (0 - boot->sectors_per_clusters));
+ if (boot->sectors_per_clusters <= 0x80)
+ return boot->sectors_per_clusters;
+ if (boot->sectors_per_clusters > 0xe0) /* limit to 31-bit shift */
+ return 1U << (0 - boot->sectors_per_clusters);
+ return 0xffffffff;
}
/*
