Skip to content

examples/configdata: exercise unregister/register lifetime - #3787

Merged
xiaoxiang781216 merged 1 commit into
apache:masterfrom
arnavsharma990:fix-20166-configdata-unregister-test
Sep 18, 2026
Merged

xiaoxiang781216 merged 1 commit into
apache:masterfrom
arnavsharma990:fix-20166-configdata-unregister-test

Conversation

@arnavsharma990

Copy link
Copy Markdown
Contributor

Summary

Regression test for apache/nuttx#20166. Extends the configdata example
(which already runs as the init entrypoint of sim:configdata) with a
full /dev/config lifetime cycle after the normal test loops: close,
unregister (must succeed), verify open() fails ENOENT, re-register
the same MTD (must succeed), verify usable, final unregister.

Pre-fix this crashes deterministically (heap UAF in
mtdconfig_unregister_by_path()); post-fix the example completes
cleanly. Uses only generic configdata APIs, so it is neutral under
CONFIG_MTD_CONFIG_NVS.

Impact

Test-only change, runs automatically in sim:configdata builds.

Testing

  • With nuttx fix: sim:configdata run completes, 934706/934706 pass.
  • Without nuttx fix: SIGSEGV in the new test (verified).

@arnavsharma990
arnavsharma990 force-pushed the fix-20166-configdata-unregister-test branch 3 times, most recently from b2f6bb9 to ce8e575 Compare September 16, 2026 19:31
Add a regression test for apache/nuttx#20166 to the configdata
example, which runs automatically in every sim:configdata build.
After the normal configdata test loops, close the long-lived
descriptor and run a full lifetime cycle on /dev/config:

- mtdconfig_unregister() must succeed,
- the unregistered device must no longer be openable (ENOENT),
- the same MTD device must be registerable again and usable,
- a final unregister must succeed, leaving the device unregistered.

Before the driver fix this crashes deterministically: the old
mtdconfig_unregister_by_path() freed the private device structure
before closing its temporary file, so the subsequent open() faults
in mm_malloc on the corrupted heap (SIGSEGV observed on sim right
after unregister returns).  With the fix the whole example,
934706/934706 checks included, completes cleanly.

The test uses only generic configdata APIs, so it also passes
unchanged under CONFIG_MTD_CONFIG_NVS, whose open/close callbacks
are no-ops.

Assisted-by: Claude:claude-opus
Signed-off-by: Arnav Sharma <2006arnavsharma@gmail.com>
@xiaoxiang781216
xiaoxiang781216 merged commit 642720e into apache:master Sep 18, 2026
21 of 41 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants