I2C Null reference crash after updating to IDF V4.4

[NotMyRealName]

Hi,

I've just noticed an issue with I2C after updating to IDFV4.4.

My I2C master crashes the ESP due to trying to store to a null address. It fixes if I add a null check around the offending assignment.

From the GDB stub I can see it is this line, and that the head pointer (and presumably the next pointer) is null.
components/driver/i2c.c - Line 1289

Code: Select all

static void IRAM_ATTR i2c_master_cmd_begin_static(i2c_port_t i2c_num)
{
    i2c_obj_t *p_i2c = p_i2c_obj[i2c_num];
    portBASE_TYPE HPTaskAwoken = pdFALSE;
    i2c_cmd_evt_t evt = { 0 };
    if (p_i2c->cmd_link.head != NULL && p_i2c->status == I2C_STATUS_READ) {
        i2c_cmd_t *cmd = &p_i2c->cmd_link.head->cmd;
        i2c_hal_read_rxfifo(&(i2c_context[i2c_num].hal), cmd->data + cmd->bytes_used, p_i2c->rx_cnt);
        /* rx_cnt bytes have just been read, increment the number of bytes used from the buffer */
        cmd->bytes_used += p_i2c->rx_cnt;

        /* Test if there are still some remaining bytes to send. */
        if (cmd->bytes_used != cmd->total_bytes) {
            p_i2c->cmd_idx = 0;
        } else {
            p_i2c->cmd_link.head = p_i2c->cmd_link.head->next;
            if(p_i2c->cmd_link.head != NULL){                                 //<---------------------------- ADDED
            	p_i2c->cmd_link.head->cmd.bytes_used = 0;
            }											//<---------------------------- ADDED
        }
        
        ...

V4.3 looks a little different and didn't have this line or something equivalent, and my application works fine. If I put the null check in it also all seems to work?

Might this be a bug in the IDF library?

[NotMyRealName]

Am I posting this in the wrong place? Sorry... Don't have a github account setup. Pretty sure this is a bug?

[boarchuz]

https://github.com/espressif/esp-idf/issues/8348

[NotMyRealName]

https://github.com/espressif/esp-idf/issues/8348

Sorry! Missed that! Thanks.

[NotMyRealName]

I thought it was odd that I missed this because I updated my IDF repo before posting, but this commit is actually already merged into my branch.

My local repo is very slightly modified (not this file). Last commit I merged was 89f57f3402bb0e9fe9bae06a3a30beb7cd4689d8

I'm looking at the same thing slightly higher up in the function. Line 1289

I may be doing odd things because I am sending a single i2c request over two commands. E.g. Start the transfer (no stop), slave gives me a number of bytes, then I start another command to read that number of bytes payload and then send the stop condition.

So... still might be an issue here I think.

[boarchuz]

It might be time to set up that GitHub account!

[NotMyRealName]

Yes. Sorry! Thanks boarchuz.

I've added a comment to that same issue.