From 87b013936e46f2764270bc76fc0dafbce2c6e589 Mon Sep 17 00:00:00 2001
From: Eric Wang <eric@rwx.one>
Date: Tue, 28 Jul 2026 13:29:17 -0700
Subject: [PATCH] fix(driver_spi): avoid NULL memcpy when private DMA buffer
 setup fails

Closes https://github.com/espressif/esp-idf/pull/18898
---
 components/esp_driver_spi/src/gpspi/spi_slave.c    | 2 +-
 components/esp_driver_spi/src/gpspi/spi_slave_hd.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/components/esp_driver_spi/src/gpspi/spi_slave.c b/components/esp_driver_spi/src/gpspi/spi_slave.c
index f78bacbc2ed..221438c7768 100644
--- a/components/esp_driver_spi/src/gpspi/spi_slave.c
+++ b/components/esp_driver_spi/src/gpspi/spi_slave.c
@@ -354,7 +354,7 @@ static void SPI_SLAVE_ISR_ATTR spi_slave_uninstall_priv_trans(spi_host_device_t
         if (trans->tx_buffer && (trans->tx_buffer != priv_trans->tx_buffer)) {
             free(priv_trans->tx_buffer);
         }
-        if (trans->rx_buffer && (trans->rx_buffer != priv_trans->rx_buffer)) {
+        if (priv_trans->rx_buffer && (trans->rx_buffer != priv_trans->rx_buffer)) {
             memcpy(trans->rx_buffer, priv_trans->rx_buffer, (trans->length + 7) / 8);
             free(priv_trans->rx_buffer);
         }
diff --git a/components/esp_driver_spi/src/gpspi/spi_slave_hd.c b/components/esp_driver_spi/src/gpspi/spi_slave_hd.c
index 7fb4ba11aad..443035c593b 100644
--- a/components/esp_driver_spi/src/gpspi/spi_slave_hd.c
+++ b/components/esp_driver_spi/src/gpspi/spi_slave_hd.c
@@ -572,7 +572,7 @@ static void s_spi_slave_hd_destroy_priv_trans(spi_host_device_t host, spi_slave_
 {
 #if SOC_CACHE_INTERNAL_MEM_VIA_L1CACHE
     spi_slave_hd_data_t *orig_trans = priv_trans->trans;
-    if (priv_trans->aligned_buffer != orig_trans->data) {
+    if (priv_trans->aligned_buffer && priv_trans->aligned_buffer != orig_trans->data) {
         if (chan == SPI_SLAVE_CHAN_RX) {
             memcpy(orig_trans->data, priv_trans->aligned_buffer, orig_trans->trans_len);
         }