arnavsharma990 opened a new issue, #20145:
URL: https://github.com/apache/nuttx/issues/20145
### Description / Steps to reproduce the issue
### Steps to reproduce the issue
`sensor_fetch_expired()` can access a freed `sensor_user_s` when
`sensor_close()` races with an armed fetch watchdog.
`sensor_poll()` teardown cancels the watchdog and clears subscriber state:
```c
user->fds = NULL;
fds->priv = NULL;
wd_cancel(&user->wdog);
```
However, `sensor_close()` (`drivers/sensors/sensor.c:819-868`) frees `user`
without cancelling the watchdog or clearing `user->fds`. The preceding
`sensor_update_interval(..., UINT32_MAX)` call does not cancel the watchdog
either.
If the watchdog fires after `sensor_user_s` has been freed,
`sensor_fetch_expired()` (`:694-709`) can dereference the freed object and
potentially re-arm the watchdog using freed memory.
This watchdog-based pacing was introduced by #19596.
#### Steps to reproduce
1. Open a fetch-only sensor such as `sensor_accel0`.
2. Configure a finite fetch interval:
```c
ioctl(fd, SNIOC_SET_INTERVAL, 100000);
```
3. Call `poll(POLLIN)` to arm `user->wdog`.
4. Close the descriptor while the watchdog is pending or firing.
5. The watchdog callback can execute against the freed `sensor_user_s`.
#### Expected behavior
`sensor_close()` should cancel the active watchdog and clear subscriber
state before freeing `sensor_user_s`, consistent with `sensor_poll()` teardown.
#### Actual behavior
The watchdog can remain active after `sensor_user_s` is freed, resulting in
a potential use-after-free and re-arm of the watchdog against freed memory.
#### Relevant code
* `sensor.c:694-709` — `sensor_fetch_expired()`
* `sensor.c:819-868` — `sensor_close()`
* `sensor.c:1190-1238` — watchdog handling in `sensor_poll()`
* `sensor.c:258-340` — `sensor_update_interval()`
The issue was observed on both local `master` and `upstream/master`.
### On which OS does this issue occur?
[OS: Mac]
### What is the version of your OS?
Darwin 25.6.0
### NuttX Version
`master` / `upstream/master` revisions examined during investigation
### Issue Architecture
[Arch: arm], [Arch: all]
### Issue Area
[Area: Drivers], [Area: Sensors]
### Host information
Not applicable to the issue.
### Verification
- [x] I have verified before submitting the report.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
