Re: [PATCH] ntfs: fix undefined behavior in mft/index record size calculation

[liubaolin]

在 2026/8/25 17:54, Hongling Zeng 写道:
> The boot sector validation allows clusters_per_mft_record and
> clusters_per_index_record to range from 0xE1 (-31) to 0xF7 (-9) when
> interpreted as signed values. When these are used as negative shift
> counts in expressions like `1 << -clusters_per_mft_record`, values
> like 0xE1 cause `1 << 31`, which shifts into the sign bit of a 32-bit
> signed integer, resulting in undefined behavior.
>
> Fix by using unsigned shift (1U << ...) instead of signed shift.
> This prevents undefined behavior while preserving the full valid
> range of negative values (-31 to -9) that may appear in NTFS boot
> sectors.
>
> The encoding scheme uses negative values to represent record sizes
> smaller than cluster_size: -log2(record_size). Common values include
> -10 (1024 bytes) for mft_record_size and -12 (4096 bytes) for
> index_record_size.
>
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Hongling Zeng <zenghongling@xxxxxxxxxx>
> ---
>   fs/ntfs/super.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/fs/ntfs/super.c b/fs/ntfs/super.c
> index 30481e5d5dd4..a1813093222b 100644
> --- a/fs/ntfs/super.c
> +++ b/fs/ntfs/super.c
> @@ -695,7 +695,7 @@ static bool parse_ntfs_boot_sector(struct ntfs_volume *vol,
>   		 * = -log2(mft_record_size) bytes. mft_record_size normaly is
>   		 * 1024 bytes, which is encoded as 0xF6 (-10 in decimal).
>   		 */
> -		vol->mft_record_size = 1 << -clusters_per_mft_record;
> +		vol->mft_record_size = 1U << -clusters_per_mft_record;
>   	vol->mft_record_size_mask = vol->mft_record_size - 1;
>   	vol->mft_record_size_bits = ffs(vol->mft_record_size) - 1;
>   	ntfs_debug("vol->mft_record_size = %i (0x%x)", vol->mft_record_size,
> @@ -732,7 +732,7 @@ static bool parse_ntfs_boot_sector(struct ntfs_volume *vol,
>   		 * index_record_size normaly equals 4096 bytes, which is
>   		 * encoded as 0xF4 (-12 in decimal).
>   		 */
> -		vol->index_record_size = 1 << -clusters_per_index_record;
> +		vol->index_record_size = 1U << -clusters_per_index_record;
>   	vol->index_record_size_mask = vol->index_record_size - 1;
>   	vol->index_record_size_bits = ffs(vol->index_record_size) - 1;
>   	ntfs_debug("vol->index_record_size = %i (0x%x)",

Looks good to me.
Reviewed-by: Baolin Liu <liubaolin@xxxxxxxxxx>