input: release touch handles before deleting the i2c bus
What the developer wrote
Authored by Gustavo Cateim
input: release touch handles before deleting the i2c bus
Since ESP-IDF v5.5 (espressif/esp-idf@e73d78ba) i2c_del_master_bus()
refuses to delete a bus that still has devices attached and returns
ESP_ERR_INVALID_STATE. The touchscreen task registers a panel IO
device on the bus but never releases it, so under IDF 5.5.4 the first
touchscreen_deinit() fails and aborts via ESP_ERROR_CHECK.
On boards that panic with PRINT_HALT, such as the Waveshare S3 Touch
LCD 2, this freezes the device on the boot splash screen while
gathering camera entropy, and also hangs the QR scanner and the
camera exit path, since the touchscreen is restarted around every
camera start/stop (see #306).
Releasing the touch handle and the panel IO device (which removes it
from the bus) before deleting the bus restores the deinit/init cycle,
and also fixes a heap leak present under IDF 5.4 where both handles
leaked on every cycle.
Co-authored-by: oroderico <oroderico@users.noreply.github.com>
What changed, and why it matters
This commit fixes a bug where the touchscreen driver failed to clean up internal handles when shutting down. On newer ESP-IDF firmware, this cleanup failure caused the device to panic and freeze during boot and when using the camera or QR scanner. The fix releases the touch and panel IO handles before deleting the I2C bus, preventing freezes and a memory leak. There is no evidence this is a security vulnerability or exploitable by an attacker.
Treat as a reliability/functional bug fix, not a security patch. Apply the commit to prevent device freezes and memory leaks on ESP-IDF v5.5+ builds. No special security response is indicated.
Security signals we found
Device freeze/DoS-like symptom on affected hardware
Memory leak fixed
No input validation, authentication, or cryptographic weakness visible
No attacker-controlled code path identified
Evidence from the diff
The patch adds two deletion calls in touchscreen_task() before _i2c_deinit(): esp_lcd_touch_del(ret_touch) and esp_lcd_panel_io_del(tp_io_handle). Previously, the panel IO device remained attached to the I2C bus, so ESP-IDF v5.5’s i2c_del_master_bus() returned ESP_ERR_INVALID_STATE and the ESP_ERROR_CHECK aborted. This caused a panic/halt on boards using PRINT_HALT, freezing the device during boot entropy collection and camera start/stop cycles. The same leak occurred under IDF 5.4 but did not abort. The fix restores proper deinit/init cycling and eliminates a heap leak of both handles.
Changed components
main/input/touchscreen.inctouchscreen task deinit pathI2C bus / LCD touch panel IO teardownInspect captured patch +3 / −0
diff --git a/main/input/touchscreen.inc b/main/input/touchscreen.inc
index 7607db0..4f1540f 100644
--- a/main/input/touchscreen.inc
+++ b/main/input/touchscreen.inc
@@ -91,6 +91,9 @@ static void touchscreen_task(void* ignored)
}
vTaskDelay(20 / portTICK_PERIOD_MS);
}
+ // Since IDF 5.5 the i2c bus cannot be deleted while devices are still attached
+ ESP_ERROR_CHECK(esp_lcd_touch_del(ret_touch));
+ ESP_ERROR_CHECK(esp_lcd_panel_io_del(tp_io_handle));
ESP_ERROR_CHECK(_i2c_deinit(touch_i2c_handle));
shutdown_finished = true;
vTaskDelete(NULL);
Why this scored 27/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.