From 5d28f2789092736f83ad10f3aacb75110ef4785c Mon Sep 17 00:00:00 2001 From: "sonika.rathi" Date: Mon, 27 Jul 2026 09:26:49 +0200 Subject: [PATCH] fix(nvs_flash): erase handle before delete on deinit --- components/nvs_flash/src/nvs_api.cpp | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/components/nvs_flash/src/nvs_api.cpp b/components/nvs_flash/src/nvs_api.cpp index ec8f4bd774e..068a85e371c 100644 --- a/components/nvs_flash/src/nvs_api.cpp +++ b/components/nvs_flash/src/nvs_api.cpp @@ -82,10 +82,11 @@ static esp_err_t close_handles_and_deinit(const char* part_name) auto it = find_if(begin(s_nvs_handles), end(s_nvs_handles), belongs_to_part); - // Same as nvs_close(): erase from the list and delete the entry (frees NVSHandleSimple). + // Same as nvs_close(): unlink first, then delete. Deleting while still linked + // UAF-corrupts the intrusive list (hangs host tests). while (it != end(s_nvs_handles)) { - delete static_cast(it); s_nvs_handles.erase(it); + delete static_cast(it); it = find_if(begin(s_nvs_handles), end(s_nvs_handles), belongs_to_part); }