arnavsharma990 opened a new pull request, #3785: URL: https://github.com/apache/nuttx-apps/pull/3785
Follow-up to apache/nuttx#20146 Regression coverage for apache/nuttx#20145 #20145 reported a sensor fetch-watchdog lifetime regression: `sensor_poll()` arms a per-subscriber `wdog` for fetch-only sensors with a finite interval, but `sensor_close()` freed `sensor_user_s` without cancelling it, letting `sensor_fetch_expired()` run after free. #20146 fixed teardown by clearing `user->fds` and `wd_cancel()`-ing on close. As suggested by the maintainer, add regression coverage in `apps/testing/drivers/drivertest` (`cmocka_driver_sensor`, built when `CONFIG_SENSORS` is set). The test sets a finite interval, polls so the watchdog can arm, closes, waits past the interval so any stray timer would fire, and reopens to prove clean teardown. It skips gracefully when the device is absent (sim without hardware). This does not deterministically reproduce the UAF (race is timing-dependent); it verifies repeated poll/close/reopen cycles complete and the device stays usable — under KASAN/stress a missing `wd_cancel` in close would be caught here. Validation: - `nxstyle`/`checkpatch` clean; `gcc -fsyntax-only` clean - `sim:nsh` + `CONFIG_SENSORS + CONFIG_TESTING_CMOCKA + CONFIG_TESTING_DRIVER_TEST` builds (`apps_cmocka_driver_sensor`, full `nuttx` link OK) - on sim without `sensor_baro0` the test reports skip + `PASS` (`Sensor device /dev/uorb/sensor_baro0 not present, skipping test`) The test is intentionally minimal (236 lines, comparable to existing drivertests) and preserves single-threaded `poll`/`close` semantics — no concurrent poll/close testing, no hardware claim. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
