maxikrie opened a new pull request, #20912:
URL: https://github.com/apache/nuttx/pull/20912
## Summary
`esp32s3_spi_poll_exchange()` overruns the caller's buffers when a transfer
length is not a multiple of 4 bytes.
The poll path copies data to and from the W0-W15 data registers one 32-bit
word at a time and always copies a full word. The final word of a transfer
like this is partial, so:
- on TX, the last `memcpy()` reads up to 3 bytes past the end of `txbuffer`;
- on RX, the last `memcpy()` writes up to 3 bytes past the end of `rxbuffer`,
silently corrupting whatever follows the buffer in memory.
This PR copies only the bytes that remain in the final word, in both
directions. Full-word transfers behave exactly as before.
## Impact
- ESP32-S3 SPI master with `CONFIG_ESP32S3_SPI_DMA` disabled, or any transfer
that goes through the poll path: transfers of any length are now safe.
Before, a length that wasn't a multiple of 4 corrupted up to 3 bytes of
memory after the RX buffer.
- No change for word-aligned transfer lengths, or for the DMA path.
- No Kconfig, API or build changes.
## Testing
Host: Debian Linux (kernel 6.1), x86_64.
Toolchain: `xtensa-esp-elf-gcc (crosstool-NG esp-14.2.0_20241119) 14.2.0`
- `esp32s3-devkit:spi` (SPI2, DMA off) builds on current `master` with
`EXTRAFLAGS=-Werror`; `tools/checkpatch.sh` passes.
- Hardware: a custom ESP32-S3 board with a Qorvo DW3000 UWB transceiver on
SPI2, DMA disabled, running NuttX 12.13 with the same change. Reading
a 125-byte RX frame (64 + 61 bytes per register-buffer chunk) corrupted the
struct field directly after the receive buffer. With the fix the
corruption is gone; it has been running on a network of these boards since.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
