[Linux Kernel Bug] WARNING: zero-size vmalloc in ubi_read_volume_table

[Yang, Chenyuan]

Dear Linux Kernel Developers for UBI,

I am writing to inquire if there have been any updates regarding the crash issue previously discussed. I would like to suggest a potential solution: adding a check for the malloc size could possibly prevent crashes caused by zero-size vmalloc.

Your insights on this matter would be greatly appreciated. Thank you for your time and dedication

Best,
Chenyuan

---
From: "Yang, Chenyuan" <cy54 at illinois.edu>
Date: Monday, January 8, 2024 at 9:26 AM
To: "linux-kernel at vger.kernel.org" <linux-kernel at vger.kernel.org>, "linux-mtd at lists.infradead.org" <linux-mtd at lists.infradead.org>
Cc: "richard at nod.at" <richard at nod.at>, "miquel.raynal at bootlin.com" <miquel.raynal at bootlin.com>, "vigneshr at ti.com" <vigneshr at ti.com>, "syzkaller at googlegroups.com" <syzkaller at googlegroups.com>, "Zhao, Zijie" <zijie4 at illinois.edu>, Lingming Zhang <lingming at illinois.edu>
Subject: [Linux Kernel Bug] WARNING: zero-size vmalloc in ubi_read_volume_table

Hello,

We detected one crash, “WARNING: zero-size vmalloc in ubi_read_volume_table” for the volume management system UBI (under linux/drivers/mtd/ubi) by using our generated syscall specification for it.

This crash is triggered by create_empty_lvol (https://elixir.bootlin.com/linux/v6.7/source/drivers/mtd/ubi/vtbl.c#L484), which allocates a zero-size memory by using `vzalloc`. Additionally, this issue is associated with the /dev/ubi_ctrl driver, particularly when using IOCTL with the command value UBI_IOCATT. The size allocated can be manipulated through the ubi_attach_req argument by altering the vid_hdr_offset and max_beb_per1024 fields.

To fix this issue, it would be better to implement a check step in the create_empty_lvol function.

The crash is reproducible by a C program, which is attached in the file.
If you have any questions or require more information, please feel free to contact us.

Best,
Chenyuan