This is an automated email from the ASF dual-hosted git repository.
xiaoxiang781216 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/nuttx.git
The following commit(s) were added to refs/heads/master by this push:
new 0ccd15d166a drivers/sensors/sensor: cancel fetch watchdog on close to
fix UAF
0ccd15d166a is described below
commit 0ccd15d166a4219d6ba7989686c0c55d75c8ff46
Author: arnavsharma990 <[email protected]>
AuthorDate: Mon Sep 14 23:24:17 2026 +0530
drivers/sensors/sensor: cancel fetch watchdog on close to fix UAF
sensor_poll() arms a per-subscriber watchdog for fetch()-only sensors
with a requested interval. The watchdog handler sensor_fetch_expired()
dereferences the subscriber and re-arms itself unless user->fds is NULL.
sensor_poll() teardown clears user->fds and cancels the watchdog, but
sensor_close() removed the subscriber from the user list and freed it
without doing either. A close() racing an armed timer therefore lets
the handler run after the subscriber is freed, causing a timer-context
use-after-free and re-arm of a freed watchdog.
Mirror the poll teardown in sensor_close(): clear user->fds and cancel
user->wdog under upper->lock before notifying other users and freeing
the subscriber.
Fixes #20145.
Signed-off-by: arnavsharma990 <[email protected]>
---
drivers/sensors/sensor.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/sensors/sensor.c b/drivers/sensors/sensor.c
index b9344577686..95ad1b52ead 100644
--- a/drivers/sensors/sensor.c
+++ b/drivers/sensors/sensor.c
@@ -865,6 +865,8 @@ static int sensor_close(FAR struct file *filep)
}
list_delete(&user->node);
+ user->fds = NULL;
+ wd_cancel(&user->wdog);
/* The user is closed, notify to other users */
