From 497cb3addc552c8c17a42609098cdb5c833b06ed Mon Sep 17 00:00:00 2001 From: KeithCoreDumped Date: Wed, 21 Jan 2026 00:25:56 +0800 Subject: [PATCH 1/3] fix: flght controller hard fault caused by insufficient CRSF rx buffer size when connected via TCP --- src/main/telemetry/crsf.h | 4 ++-- src/main/telemetry/msp_shared.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/src/main/telemetry/crsf.h b/src/main/telemetry/crsf.h index bfe9b9e4f3c..65565888486 100644 --- a/src/main/telemetry/crsf.h +++ b/src/main/telemetry/crsf.h @@ -20,8 +20,8 @@ #include "common/time.h" #include "rx/crsf.h" -#define CRSF_MSP_RX_BUF_SIZE 128 -#define CRSF_MSP_TX_BUF_SIZE 128 +#define CRSF_MSP_RX_BUF_SIZE 512 +#define CRSF_MSP_TX_BUF_SIZE 512 void initCrsfTelemetry(void); bool checkCrsfTelemetryState(void); diff --git a/src/main/telemetry/msp_shared.c b/src/main/telemetry/msp_shared.c index 4c60a90e707..986c0c3e1aa 100644 --- a/src/main/telemetry/msp_shared.c +++ b/src/main/telemetry/msp_shared.c @@ -68,12 +68,12 @@ void initSharedMsp(void) mspPackage.requestBuffer = (uint8_t *)&mspRxBuffer; mspPackage.requestPacket = &mspRxPacket; mspPackage.requestPacket->buf.ptr = mspPackage.requestBuffer; - mspPackage.requestPacket->buf.end = mspPackage.requestBuffer; + mspPackage.requestPacket->buf.end = mspPackage.requestBuffer + sizeof(mspRxBuffer); mspPackage.responseBuffer = (uint8_t *)&mspTxBuffer; mspPackage.responsePacket = &mspTxPacket; mspPackage.responsePacket->buf.ptr = mspPackage.responseBuffer; - mspPackage.responsePacket->buf.end = mspPackage.responseBuffer; + mspPackage.responsePacket->buf.end = mspPackage.responseBuffer + sizeof(mspTxBuffer); } static void processMspPacket(void) From 4c4430ef90f89653c2115074c8c5737a28a1da74 Mon Sep 17 00:00:00 2001 From: KeithCoreDumped Date: Wed, 4 Feb 2026 17:49:20 +0800 Subject: [PATCH 2/3] fix data length overflow --- src/main/telemetry/msp_shared.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/main/telemetry/msp_shared.c b/src/main/telemetry/msp_shared.c index 986c0c3e1aa..5897b1ce557 100644 --- a/src/main/telemetry/msp_shared.c +++ b/src/main/telemetry/msp_shared.c @@ -217,7 +217,7 @@ bool sendMspReply(uint8_t payloadSize, mspResponseFnPtr responseFn) } sbufWriteU8(payloadBuf, status); - const uint8_t size = sbufBytesRemaining(txBuf); + const uint16_t size = sbufBytesRemaining(txBuf); if (lastRequestVersion == 1) { // MSPv1 sbufWriteU8(payloadBuf, size); sbufWriteU8(payloadBuf, mspPackage.responsePacket->cmd); From 922536955546e0a9ddcbbd868e11e54a516eba25 Mon Sep 17 00:00:00 2001 From: KeithCoreDumped Date: Wed, 4 Feb 2026 17:49:52 +0800 Subject: [PATCH 3/3] fix: resolve MSP connection hangs due to packet truncation and buffer initialization when connected via TCP --- src/main/telemetry/msp_shared.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/main/telemetry/msp_shared.c b/src/main/telemetry/msp_shared.c index 5897b1ce557..1589a513596 100644 --- a/src/main/telemetry/msp_shared.c +++ b/src/main/telemetry/msp_shared.c @@ -80,7 +80,8 @@ static void processMspPacket(void) { mspPackage.responsePacket->cmd = 0; mspPackage.responsePacket->result = 0; - mspPackage.responsePacket->buf.end = mspPackage.responseBuffer; + mspPackage.responsePacket->buf.ptr = mspPackage.responseBuffer; + mspPackage.responsePacket->buf.end = mspPackage.responseBuffer + sizeof(mspTxBuffer); mspPostProcessFnPtr mspPostProcessFn = NULL; if (mspFcProcessCommand(mspPackage.requestPacket, mspPackage.responsePacket, &mspPostProcessFn) == MSP_RESULT_ERROR) { @@ -231,7 +232,7 @@ bool sendMspReply(uint8_t payloadSize, mspResponseFnPtr responseFn) sbufWriteU8(payloadBuf, (seq++ & TELEMETRY_MSP_SEQ_MASK) | (lastRequestVersion << TELEMETRY_MSP_VER_SHIFT)); // header without 'start' flag } - const uint8_t bufferBytesRemaining = sbufBytesRemaining(txBuf); + const uint16_t bufferBytesRemaining = sbufBytesRemaining(txBuf); const uint8_t payloadBytesRemaining = sbufBytesRemaining(payloadBuf); uint8_t frame[payloadBytesRemaining];