From 789d017b10c833bf75d63a531790c7d28872af7e Mon Sep 17 00:00:00 2001 From: yi chen <94xhn1@gmail.com> Date: Sun, 12 Jul 2026 03:38:04 +0800 Subject: [PATCH] fix(vfs): use MAX_FDS instead of VFS_MAX_COUNT when clearing fd table on unregister esp_vfs_unregister_with_id() scanned only the first VFS_MAX_COUNT (default 8, max 20) slots of s_fd_table[MAX_FDS] (MAX_FDS = FD_SETSIZE, 64 on non-Cygwin targets) when clearing stale references to the unregistered VFS. Every other loop over s_fd_table in this file (and in vfs_calls.c) correctly bounds on MAX_FDS. Any global fd >= VFS_MAX_COUNT that was still open against the VFS being unregistered was left with a stale vfs_index pointing at a slot that esp_get_free_index() can immediately hand out to the next esp_vfs_register*() call, causing later operations on that fd to be routed into an unrelated filesystem's context. Signed-off-by: yi chen <94xhn1@gmail.com> --- components/vfs/vfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/components/vfs/vfs.c b/components/vfs/vfs.c index 39d11432f3e..ad5ea6aa1ac 100644 --- a/components/vfs/vfs.c +++ b/components/vfs/vfs.c @@ -575,7 +575,7 @@ esp_err_t esp_vfs_unregister_with_id(esp_vfs_id_t vfs_id) _lock_acquire(&s_fd_table_lock); // Delete all references from the FD lookup-table - for (int j = 0; j < VFS_MAX_COUNT; ++j) { + for (int j = 0; j < MAX_FDS; ++j) { if (s_fd_table[j].vfs_index == vfs_id) { s_fd_table[j] = FD_TABLE_ENTRY_UNUSED; }