Skip to content

fs/procfs: fix potential out-of-bounds read in mount_sprintf() - #20049

Open
hritikkumar07 wants to merge 1 commit into
apache:masterfrom
hritikkumar07:fix/mount-sprintf-buffer-overflow
Open

fs/procfs: fix potential out-of-bounds read in mount_sprintf()#20049
hritikkumar07 wants to merge 1 commit into
apache:masterfrom
hritikkumar07:fix/mount-sprintf-buffer-overflow

Conversation

@hritikkumar07

Copy link
Copy Markdown

Summary

When formatting entries for /proc/fs/mount, vsnprintf() returns the full string length even if output is truncated to fit the 64-byte info->line staging buffer. mount_sprintf() was passing this untruncated length to procfs_memcpy(), causing an out-of-bounds read past info->line when a mountpoint path was long enough (e.g. >= 50 characters).

This PR clamps linesize to info->linelen - 1 before calling procfs_memcpy(), limiting the copy to the actual bytes stored in the buffer.

Fixes #20011

Impact

  • Is new feature needed? No
  • Impact on user? Prevents procfs buffer overflow reads when long mount paths are present.
  • Impact on build? None
  • Impact on hardware? None

Testing

  • Verified mount_sprintf() bounds logic when formatting long mount point paths (> 50 chars).
  • Confirmed output string truncation functions properly without reading past the end of info->line.

@github-actions github-actions Bot added Area: File System File System issues Size: XS The size of the change in this PR is very small labels Sep 2, 2026
@github-actions

github-actions Bot commented Sep 2, 2026

Copy link
Copy Markdown

MemBrowse Memory Report

esp32-devkitc

  • ROM: .flash.text +8 B (+0.0%, 124,908 B / 4,194,272 B, total: 3% used)
  • irom0_0_seg: .flash.text +8 B (+0.0%, 89,112 B / 3,342,304 B, total: 3% used)

hifive1-revb

  • flash: .text +12 B (+0.0%, 83,728 B / 4,194,304 B, total: 2% used)

qemu-armv8a

  • Code: .text.mount_sprintf +12 B (+0.0%, 337,520 B)

qemu-intel64

  • Code: .text +13 B (+0.0%, 8,659,727 B)

s698pm-dkit

@Abhishekmishra2808

Copy link
Copy Markdown
Contributor

Thank you- @hritikkumar07, before opening a PR, please take a look at https://github.com/apache/nuttx/blob/master/CONTRIBUTING.md. The check is failing due to a missing signed commit message. Please fix it

Logs:

../nuttx/tools/checkpatch.sh -c -u -m -g  907a521b15db6b1dceb4159ce1921c4f77124895..HEAD
❌ Missing Signed-off-by
Used config files:
    1: .codespellrc
Some checks failed. For contributing guidelines, see:
  https://github.com/apache/nuttx/blob/master/CONTRIBUTING.md
Error: Process completed with exit code 1.

@xiaoxiang781216

Copy link
Copy Markdown
Contributor

@hritikkumar07 please fix:

cc2df0bae3 fs/procfs: fix buffer overflow in mount_sprintf
../nuttx/tools/checkpatch.sh -c -u -m -g  907a521b15db6b1dceb4159ce1921c4f77124895..HEAD
❌ Missing Signed-off-by
Used config files:
    1: .codespellrc
Some checks failed. For contributing guidelines, see:
  https://github.com/apache/nuttx/blob/master/CONTRIBUTING.md
Error: Process completed with exit code 1.

@hritikkumar07

Copy link
Copy Markdown
Author

Hey @Abhishekmishra2808 and @xiaoxiang781216 ,
Thanks for pointing this out. I’ll fix the missing Signed-off-by in the commit message and push the updated commit shortly.

vsnprintf() returns the total formatted string length even when truncated to info->line. Passing this untruncated length to procfs_memcpy causes a read beyond the 64-byte line staging buffer.

Fixes apache#20011

Signed-off-by: Hritik Naik <hritiknaik16@gmail.com>
@hritikkumar07
hritikkumar07 force-pushed the fix/mount-sprintf-buffer-overflow branch from cc2df0b to 4ca7c59 Compare September 3, 2026 18:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Area: File System File System issues Size: XS The size of the change in this PR is very small

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[BUG] buffer overflow in mount_sprintf

4 participants