arnavsharma990 opened a new pull request, #3785:
URL: https://github.com/apache/nuttx-apps/pull/3785

   Follow-up to apache/nuttx#20146
   Regression coverage for apache/nuttx#20145
   
   #20145 reported a sensor fetch-watchdog lifetime regression: `sensor_poll()` 
arms a per-subscriber `wdog` for fetch-only sensors with a finite interval, but 
`sensor_close()` freed `sensor_user_s` without cancelling it, letting 
`sensor_fetch_expired()` run after free. #20146 fixed teardown by clearing 
`user->fds` and `wd_cancel()`-ing on close.
   
   As suggested by the maintainer, add regression coverage in 
`apps/testing/drivers/drivertest` (`cmocka_driver_sensor`, built when 
`CONFIG_SENSORS` is set). The test sets a finite interval, polls so the 
watchdog can arm, closes, waits past the interval so any stray timer would 
fire, and reopens to prove clean teardown. It skips gracefully when the device 
is absent (sim without hardware).
   
   This does not deterministically reproduce the UAF (race is 
timing-dependent); it verifies repeated poll/close/reopen cycles complete and 
the device stays usable — under KASAN/stress a missing `wd_cancel` in close 
would be caught here.
   
   Validation:
   - `nxstyle`/`checkpatch` clean; `gcc -fsyntax-only` clean
   - `sim:nsh` + `CONFIG_SENSORS + CONFIG_TESTING_CMOCKA + 
CONFIG_TESTING_DRIVER_TEST` builds (`apps_cmocka_driver_sensor`, full `nuttx` 
link OK)
   - on sim without `sensor_baro0` the test reports skip + `PASS` (`Sensor 
device /dev/uorb/sensor_baro0 not present, skipping test`)
   
   The test is intentionally minimal (236 lines, comparable to existing 
drivertests) and preserves single-threaded `poll`/`close` semantics — no 
concurrent poll/close testing, no hardware claim.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to