arnavsharma990 opened a new pull request, #20168: URL: https://github.com/apache/nuttx/pull/20168
## Summary Fixes https://github.com/apache/nuttx/issues/20166. `mtdconfig_unregister_by_path()` opened the device with `file_open()`, which runs `mtdconfig_open()` and therefore holds `dev->lock` for the whole lifetime of the temporary file reference. It then destroyed the mutex and freed the private device structure while that reference was still open, so the subsequent `file_close()` reached `mtdconfig_close()`, which performs `nxmutex_unlock()` on freed memory. Both `file_close()` and `unregister_driver()` return values were also discarded with an unconditional `return OK`. Reorder to close -> unregister -> destroy/free and propagate errors, so the private structure is freed only after a successful unregister. This matches the established ordering used by e.g. `bchdev_unregister()`. `mtd_config_nvs.c` intentionally untouched: its open/close are no-ops, so the deterministic close-path UAF does not exist there. ## Impact Removes a deterministic heap UAF on every `mtdconfig_unregister()` / teardown path with `CONFIG_MTD_CONFIG=y`. Error returns are now propagated per the documented API contract instead of masked as `OK`. ## Testing - `sim:configdata` full build + run with the companion `examples/configdata` lifetime test: 934706/934706 checks pass, clean completion. - Negative control (fix stashed, test kept): same run dies with SIGSEGV in `mm_malloc` right after `mtdconfig_unregister_by_path()` returns — the test catches the bug. - `git diff --check` clean. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
