From 7f591008b3bca0e594f2655a73f57e6b857fb845 Mon Sep 17 00:00:00 2001
From: Eric Wang <eric@rwx.one>
Date: Tue, 28 Jul 2026 13:29:17 -0700
Subject: [PATCH 1/2] fix(driver_spi): avoid NULL memcpy when private DMA
 buffer setup fails

Closes https://github.com/espressif/esp-idf/pull/18898
---
 components/esp_driver_spi/src/gpspi/spi_master.c   | 2 +-
 components/esp_driver_spi/src/gpspi/spi_slave.c    | 2 +-
 components/esp_driver_spi/src/gpspi/spi_slave_hd.c | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/components/esp_driver_spi/src/gpspi/spi_master.c b/components/esp_driver_spi/src/gpspi/spi_master.c
index e2dc26bec85..7b09f236cfc 100644
--- a/components/esp_driver_spi/src/gpspi/spi_master.c
+++ b/components/esp_driver_spi/src/gpspi/spi_master.c
@@ -1165,7 +1165,7 @@ static SPI_MASTER_ISR_ATTR void uninstall_priv_desc(spi_trans_priv_t* trans_buf)
 
     // copy data from temporary DMA-capable buffer back to trans_desc buffer and free the temporary one.
     void *orig_rx_buffer = (trans_desc->flags & SPI_TRANS_USE_RXDATA) ? trans_desc->rx_data : trans_desc->rx_buffer;
-    if (trans_buf->buffer_to_rcv != orig_rx_buffer) {
+    if (trans_buf->buffer_to_rcv && trans_buf->buffer_to_rcv != orig_rx_buffer) {
         memcpy(orig_rx_buffer, trans_buf->buffer_to_rcv, (trans_desc->rxlength + 7) / 8);
         free(trans_buf->buffer_to_rcv);
     }
diff --git a/components/esp_driver_spi/src/gpspi/spi_slave.c b/components/esp_driver_spi/src/gpspi/spi_slave.c
index 9beff65602a..ec041bb5c43 100644
--- a/components/esp_driver_spi/src/gpspi/spi_slave.c
+++ b/components/esp_driver_spi/src/gpspi/spi_slave.c
@@ -413,7 +413,7 @@ static void SPI_SLAVE_ISR_ATTR spi_slave_uninstall_priv_trans(spi_host_device_t
         if (trans->tx_buffer && (trans->tx_buffer != priv_trans->tx_buffer)) {
             free(priv_trans->tx_buffer);
         }
-        if (trans->rx_buffer && (trans->rx_buffer != priv_trans->rx_buffer)) {
+        if (priv_trans->rx_buffer && (trans->rx_buffer != priv_trans->rx_buffer)) {
             size_t compatible_len = trans->rx_length ? trans->rx_length : trans->length;
             memcpy(trans->rx_buffer, priv_trans->rx_buffer, (MIN(compatible_len, trans->trans_len) + 7) / 8);
             free(priv_trans->rx_buffer);
diff --git a/components/esp_driver_spi/src/gpspi/spi_slave_hd.c b/components/esp_driver_spi/src/gpspi/spi_slave_hd.c
index c08001749b6..663258ff196 100644
--- a/components/esp_driver_spi/src/gpspi/spi_slave_hd.c
+++ b/components/esp_driver_spi/src/gpspi/spi_slave_hd.c
@@ -698,7 +698,7 @@ static SPI_SLAVE_ISR_ATTR void s_spi_slave_hd_append_legacy_isr(void *arg)
 static void s_spi_slave_hd_destroy_priv_trans(spi_host_device_t host, spi_slave_hd_trans_priv_t *priv_trans, spi_slave_chan_t chan)
 {
     spi_slave_hd_data_t *orig_trans = priv_trans->trans;
-    if (priv_trans->aligned_buffer != orig_trans->data) {
+    if (priv_trans->aligned_buffer && priv_trans->aligned_buffer != orig_trans->data) {
         if (chan == SPI_SLAVE_CHAN_RX) {
             memcpy(orig_trans->data, priv_trans->aligned_buffer, orig_trans->trans_len);
         }

From 07612291c6464f0f781e0d1770b810bd88fb51fb Mon Sep 17 00:00:00 2001
From: wanckl <wanlei@espressif.com>
Date: Thu, 30 Jul 2026 16:01:27 +0800
Subject: [PATCH 2/2] fix(driver_spi): slave hd append fix wrong dma param

---
 components/esp_driver_spi/src/gpspi/spi_slave_hd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/components/esp_driver_spi/src/gpspi/spi_slave_hd.c b/components/esp_driver_spi/src/gpspi/spi_slave_hd.c
index 663258ff196..ea004ba2001 100644
--- a/components/esp_driver_spi/src/gpspi/spi_slave_hd.c
+++ b/components/esp_driver_spi/src/gpspi/spi_slave_hd.c
@@ -792,7 +792,7 @@ esp_err_t s_spi_slave_hd_append_rxdma(spi_slave_hd_slot_t *host, uint8_t *data,
         return ESP_ERR_INVALID_STATE;
     }
 
-    spicommon_dma_desc_setup_link(hal->rx_cur_desc->desc, data, len, false);
+    spicommon_dma_desc_setup_link(hal->rx_cur_desc->desc, data, len, true);
     hal->rx_cur_desc->arg = arg;
 
     if (!hal->rx_used_desc_cnt) {