Skip to content

fix(esp-bootloader-esp-idf): allow FlashRegion::erase up to partition end#5580

Open
adstep wants to merge 1 commit into
esp-rs:mainfrom
adstep:upstream-fix/bootloader-erase-end-boundary
Open

fix(esp-bootloader-esp-idf): allow FlashRegion::erase up to partition end#5580
adstep wants to merge 1 commit into
esp-rs:mainfrom
adstep:upstream-fix/bootloader-erase-end-boundary

Conversation

@adstep

@adstep adstep commented May 17, 2026

Copy link
Copy Markdown

Submission Checklist 📝

  • I have updated existing examples or added new ones (if applicable).
  • I have used cargo xtask fmt-packages command to ensure that all changed code is formatted correctly.
  • I have added changelog entries and/or migration guide notes in the sections below, or I will ask a maintainer to add the skip-changelog or manual-changelog label as appropriate.
  • My changes are in accordance to the esp-rs developer guidelines

Extra:

Pull Request Details 📖

Description

FlashRegion::erase(from, to) rejects to == partition_end with Error::OutOfBounds, even though that is the natural and correct value for "erase the whole slot." embedded_storage::nor_flash::NorFlash::erase documents its to parameter as the exclusive end of the range, so erasing an N-byte partition aligned to its start needs to pass to = N — which today fails.

Root cause. The two address_to bounds checks both use Range::contains, which has half-open [start, end) semantics and rejects exactly address_to == range.end. The sibling write/read impls in the same file use the in_range helper, which does the upper bound the right way (address + len <= range.end); erase is the odd one out.

Fix. Replace the half-open check with an inclusive upper-bound comparison, and add a defensive to < from guard the original code happened not to have.

… end

`FlashRegion::erase(from, to)` rejected `to == partition_end` because both
`address_to` bounds checks used `Range::contains`, which has half-open
[start, end) semantics. The `NorFlash::erase` trait documents `to` as the
exclusive end of the range, so erasing an N-byte partition aligned to its
start requires passing `to = N` -- which the current implementation refuses.

Replace the half-open check with an inclusive upper-bound comparison
matching the trait contract, and add a defensive `to < from` guard. The
sibling `write`/`read` impls in the same file already use the in-range
helper, which does this correctly.
Copilot AI review requested due to automatic review settings May 17, 2026 05:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant