Research window: 2026-10-21 08:00 ~ 2026-10-22 08:00 (Beijing time, 24 hours)

Sources: RT-Thread official news API, community forum article API, GitHub (main repo commits / PR / Issue / Releases / tags, RT-Thread-packages organization repos, topic:rt-thread ecosystem search), Google News aggregation (multiple Chinese and English queries, via proxy), HN Algolia, industry media and vendor channel verification (see appendix source list for details)

Index

  • I. Kernel and Version Updates
    • Three-year-old time-slice scheduling proposal re-verified: discriminant converges with #11907, but “deferred READY write” causes double free on single core (10-21)
    • Dynamic module uninitialized global variable fix: four defects including BSS segment allocation pointer not advancing handled together (10-21)
    • Mainline has no new commits since 10-19, v5.4.0 still has only version macros and no release artifacts (10-22)
  • II. Security and Stability Follow-up
    • NFS read path uses server-side count as memcpy length: a single cat can overwrite the return address (10-22)
    • raw-API DHCP server option traversal lacks bounds: overruns 1500-byte buffer by up to 4 bytes (10-21)
    • Fix proposals for the two memory defects from the previous day still under review, none merged this issue (10-21)
  • III. Official and Community Events
    • No new items on the official news API, no brand-new long-form articles in the community forum window (10-22)
    • Ruiqing V1.8.4 release post and livestream preview published the same day, no retrospective seen in the window (10-21)
  • IV. Ecosystem and Vendor Adaptation
    • ESP-IDF v6.1 package-side merge: C3/C6 gain an official switch to replace FreeRTOS with RT-Thread (10-21)
    • BSP-side proposals in the same batch unblocked: all thirteen C3 configurations pass, on-board validation pending (10-21)
    • OSPI and OctaFlash enter the component layer: SFUD supports both 1-1-1 and 8-8-8 modes (10-21)
    • Cortex-A GIC print function format specifier fixed: passing a non-pointer to %p is undefined behavior (10-21)
    • Ruiqing V1.8.4 and new IDE: encoder, MIPI RGB666, GPIO pull-up/pull-down, GD32H7 project support (10-21)
    • GD32 embedded UI example repo created, other main repos in the organization remain silent (10-21)
  • V. Industry Applications
    • Ruiqing V1.8.4 industrial field fixes: EtherCAT interrupt affinity, netstat hang under telnet, UART DMA baud rate (10-21)
  • VI. Summary and Trend Observations
    • Trends this issue
    • Limitations and deduplication notes

I. Kernel and Version Dynamics

1.1 Three-year-old time-slice scheduling proposal re-verified: discriminant converges with #11907, but “deferred READY write” causes double free on single core (10-21)

Date: 2026-10-21 14:16 ~ 14:41 (comment times)　Source: PR #6645, PR #11907

The time-slice scheduling patch submitted on 2022-11-23 (#6645) had long been stuck at Status: waiting for test; community member Yunlk posted three comments within the window to bring it back into review. First, the src/scheduler.c modified by the patch has since been split on the current mainline into scheduler_comm.c, scheduler_up.c, and scheduler_mp.c, so the original patch no longer applies directly; the comments map each change point to its counterpart in the new files. Second, the patch’s core discriminant—only a thread that is “still running and preempted with time slice remaining” is inserted at the head of the queue, everything else goes to the tail—matches exactly the conclusion independently reached in #11907; two paths unaware of each other converged on the same judgment, which the author cites as circumstantial evidence that the direction is sound. Third, the real divergence is in implementation: this patch removes the overwrite that writes READY at the head insertion and instead sets the state uniformly at tail insertion while clearing YIELD, so the thread state remains RUNNING during insertion.

Ported on this logic to the single-core path, on QEMU vexpress-a9 the semaphore wakeup order was corrected from BA to AB and the startup order from DC to CD, and three-thread time-slice round-robin worked normally, but the scheduler-group utest crashed consistently: an assertion failure in rt_smem_free, with the backtrace rt_free ← rt_defunct_execute ← idle_thread_entry, i.e. the idle thread double-freeing the same TCB when reclaiming a terminated thread, reproduced in the same test case on both runs. An isolation experiment that restored the original YIELD clear in rt_schedule() left the crash unchanged, showing the problem does not come from the clear location but from the “deferred READY write.” After additional testing on SMP (dual-core configuration) the discriminant was likewise effective, and the double free was observed only on the single-core path; the author also corrected his earlier statement that “SMP was untested.” Recommended conclusion: the discriminant is worth keeping, but proceed on the basis of #11907’s “save stat_before first, then judge”; if #6645 is to continue, the single-core double free must be investigated first.

1.2 Fix for uninitialized globals in dynamic modules: four defects including BSS allocation pointer not advancing (10-21)

Date: 2026-10-21 21:09 (creation time)　Source: PR #11915, Issue #5705

Contributor usualtreee opened a fix for #5705, reported in March 2022; the issue is still reproducible on current mainline 1c801efa. The defects are concentrated in the relocatable module (ET_REL) load path dlmodule_load_relocated_object(), the path taken by boards such as Cortex-M with RT_USING_MODULE enabled: first, after loading a BSS section (SHT_NOBITS) the allocation pointer does not advance, so multiple NOBITS sections overlap in the same memory; second, the section-symbol relocation formula lacks the section link-address correction; third, SHN_COMMON symbols (tentatively defined uninitialized globals) are silently skipped because the code reads shdr[0xfff2] to get the section name, obtains garbage, and fails to match; fourth, this path never builds module->symtab, so dlsym() always fails for ET_REL modules.

The fix addresses all four: advance the pointer by section size after loading a BSS section; unify rodata/bss/data section relocation as “section load address − section link address + symbol value”; allocate a separate common block for SHN_COMMON and move that branch ahead of the section-name match to avoid the out-of-bounds read; and collect global function symbols from .symtab to build module->symtab. The change touches two files, +147/-9, and was verified on qemu-vexpress-a9 with three test modules: before the fix dlsym failed for ET_REL modules; after the fix it succeeds, the two uninitialized global variable addresses (0x600d2008 and 0x600d2004) no longer overlap, and writing and reading back sentinel values passes, while the two ET_DYN modules are unchanged. The proposal has passed CLA and is under review by the components group.

1.3 Mainline has no new commits since 10-19; v5.4.0 still has only the version macro and no release artifacts (10-22)

Date: 2026-10-22 (verification time)　Source: main repo commit log, releases, tags

Within the window the mainline saw zero commits and zero merges; the latest is still [bsp][spacemit/k1] first version from 10-19 18:49, and the organization page’s push time likewise stops at 10-19, with the remaining repositories’ most recent activity being rtthread-skills and smart-build on 10-18 and env and the porting-spec repository on 10-17. On the version side nothing has changed: the latest tag and release artifacts are still v5.3.0 from 09-10, and the “Bump version to v5.4.0” commit from 10-17 so far has only the version macro, with no release notes or binaries. All actual code activity this issue falls on proposals under review, defect tickets, and the package repositories on the RT-Thread-packages side.

II. Security and Stability Follow-up

2.1 NFS read path uses server-side count as memcpy length: a single cat can overwrite the return address (10-22)

Date: 2026-10-22 02:13 (created)　Source: Issue #11917, dfs_nfs.c

Contributor XueDugu has opened a new NFS client defect ticket; it is a directly exploitable memory corruption. nfs_read() caps the request length at 1024 bytes, but the copy uses READ3resok.count from the server reply, comparing it neither against the caller’s requested length nor against the data length decoded from the same reply; on the XDR decode side, xdr_bytes(..., ~0) is used as the upper bound, so the length check never fires. The two count fields are independent in the protocol, so a malicious server can respond to an 80-byte request with count = 512 plus 512 bytes of data.

The consequence lands on the built-in cat command: dfs_file.c receives the read into char buffer[81], so a single cat of a file can overrun the buffer tail by up to roughly 430 bytes, overwriting the return address on the finsh thread stack. The defect was introduced by commit 0fbfdec40d on 2010-05-20 and affects every release since v1.2.0, including v5.3.0 and current mainline. The author reproduced it on QEMU vexpress-a9 and on an RP2350 board; the NFS client assembles AUTH_SYS itself and uses unauthenticated UDP, so either the mounted server or an injector on the path can control the overflow contents. The ticket is currently unclaimed.

2.2 raw-API DHCP server option traversal lacks bounds: overruns the 1500-byte buffer by up to 4 bytes (10-21)

Date: 2026-10-21 15:49 (created)　Source: Issue #11913, dhcp_server_raw.c

Another researcher, K-ANOY, reports an out-of-bounds read in the raw-API DHCP server. The option lookup function only guarantees that the returned pointer falls within the buffer; during traversal, buf[1] is not first checked against buf + 1 < end, so an option header with only one byte left at the end reads one byte out of bounds. The caller then reads fixed-width values (4 bytes for requested IP, 1 byte for message type), so placing the option header at the tail lets opt[2]..opt[5] overrun the 1500-byte pbuf heap block by up to 4 bytes. The socket-based dhcp_server.c in the same directory performs exactly these checks—whether the length is out of bounds, whether the declared length is valid, length < 4 and length < 1—which confirms that the raw version is missing precisely these guards.

The trigger is merely any host on the same subnet sending a packet with a truncated option area to UDP/67, with no authentication required; the author completed a logic-level reproduction under ASan and notes that the leaked values are used only for comparison and branching, not directly exfiltrated. The ticket has been tagged bug and component: net and remains unclaimed.

2.3 Fix proposals for the previous day’s two memory defects still under review, none merged this issue (10-21)

Date: 2026-10-21 (review time)　Source: PR #11911, PR #11910

Both memory defects covered in the previous issue have fixes in progress: the proposal to constrain cromfs directory name length (#11911, submitted by the same researcher, corresponding to defect ticket #11905) and the fix for use-after-free when tmpfs truncates to zero length (#11910, submitted by remukisama after reproduction on RT-Smart aarch64). Both saw only status and comment updates within this window and were not merged into mainline, so this issue does not repeat the technical details.

III. Official and Community Activities

3.1 No new items on the official news API; no brand-new long-form posts on the community forum within the window (10-22)

Date: 2026-10-22 (review time)　Source: RT-Thread official news API, community forum article API

The organization category of the official news API still returns 25 archived posts, the latest dated 2026-06-17—more than four months without updates; the official site’s news list page is rendered dynamically on the front end, so scraping yields only an empty loading shell, and the API is the authoritative source for news data. Among the top 25 items on the community article API, there are no brand-new long-form posts within the window; the most recent update is a dual-board collaborative intelligent terminal project at 10-21 10:08, whose technical points were covered in the previous issue and which is treated here as an editorial update. There is also an Edgi-X universal adaptation challenge announcement published on 10-19, which falls outside the window.

3.2 Raoying V1.8.4 release post and livestream preview went live the same day, no recap seen within the window (10-21)

Date: 2026-10-21 11:50 (published)　Source: EE Times China: Raoying Platform V1.8.4 released

The V1.8.4 release post for the Raoying platform went live within the window; its body corroborates the previous day’s livestream preview, with the feature list in 4.5 and industrial-site stability fixes in 5.1. The post still closes with “live hands-on analysis tonight at 20:00,” indicating the livestream had not yet taken place when the article was published; no recap or recording notes for that livestream were found within the window, so this issue makes no assessment of its impact and only records that the version has been released and the IDE upgraded in sync to V1.5.62.

IV. Ecosystem and Vendor Adaptation

4.1 ESP-IDF v6.1 package-side merge: official switch to replace FreeRTOS with RT-Thread appears for C3/C6 (10-21)

Date: 2026-10-21 15:23 (merge time)　Source: RT-Thread-packages/esp-idf PR #18

The esp-idf package under RT-Thread-packages completed a full upgrade from 5.1 to 6.1.0 and was merged, touching over 20,000 files. Relative to upstream v6.1, this merge carries three structural changes on the RT-Thread side: a new components/rtthread/ (port layer for C3/C6, rtconfig.h, board/context, CMake and linker scripts), a new components/riscv/vectors_rtthread.S, and CONFIG_IDF_RTOS_RTTHREAD switch paths added in FreeRTOS, esp_system, esp_timer and elsewhere; the corresponding menuconfig entry is “Component config → FreeRTOS → Extra → Replace FreeRTOS with RT-Thread”. For RISC-V, the significance of this step is that C3 and C6 use RISC-V cores (unlike the Xtensa-based S2/S3); previously RT-Thread could only run on IDF 5.x via the old integration approach, whereas now there is a 6.1 base plus an officially sanctioned kernel-replacement channel.

4.2 BSP-side companion proposal unblocked: all thirteen C3 configurations pass, on-board validation pending (10-21)

Date: 2026-10-21 15:24 (comment time)　Source: PR #11870

The main-repo proposal #11870 that pairs with the package-side work received a maintainer reply in this window stating “esp-idf has been merged,” clearing the previous blocker. The proposal changes 55 files +4554/-333: C3 and C6 are each adapted to the ESP-IDF v6.1 compatibility surface (portmacro.h FreeRTOS V11 declarations, sections.ld, port.c, main.c, rtconfig.py, and minor ADC/SPI driver changes), and the RISC-V toolchain is upgraded from gcc 11.2 (esp-2022r1) to gcc 15.2 (esp-15.2.0_20251204), with CI workflow, docker and tools/ci adjusted accordingly. The author’s validation is that all thirteen attachconfig configurations for C3 compile and the C6 default configuration compiles and links; on-board hardware validation is still pending. The ESP32-S3 port and FreeRTOS compatibility-layer changes are filed as a separate proposal and are not part of this one.

4.3 OSPI and OctaFlash enter the component layer: SFUD supports both 1-1-1 and 8-8-8 modes (10-21)

Date: 2026-10-21 15:22 (creation time)　Source: PR #11912

The existing driver layer only has SPI and QSPI paths, so there is no native route to eight-line Flash via SFUD. This proposal adds OSPI at the component layer: new bus, device, configuration and message definitions plus transfer helpers, while retaining the existing SPI/QSPI paths; OSPI transfers and device probing are wired into SFUD, covering read, write, erase and status query, and MX25LM51245G is added to the device table for validation. To exercise the full chain, it also adds a generic STM32 OctoSPI low-level driver drv_ospi.c (504 lines) and an L4-series configuration header, plus OCTOSPI1 pin, clock and MSP configuration and helper functions for entering OPI STR/DTR mode on the stm32l4r9-st-eval board, incidentally fixing a .bss overlap caused by that board’s heap and linker layout. The change spans 32 files +3728/-956 across four commits; the CLA is signed and review has been assigned to three STM32 group maintainers. The author reports building and running on real hardware with GCC, with both 1-1-1 and 8-8-8 modes recognized by SFUD.

4.4 Cortex-A GIC print functions fix format specifiers: passing a non-pointer to %p is undefined behavior (10-21)

Date: 2026-10-21 18:00 (creation time)　Source: PR #11914

The GICv2 and GICv3 info-printing functions under libcpu/arm/cortex-a have four kinds of format-specifier/argument type mismatches: physical addresses are rt_uint32_t but printed with %p, which is undefined behavior; the GIC version number is unsigned long, and the maximum interrupt number and interrupt number are unsigned int, yet all are printed with %d. All of these warn when compiling Cortex-A board support with -Wall -Wformat. The proposal changes %p to 0x%08x and %d to %u, and adds an explicit unsigned int cast for the version number extracted from 0xfUL; two files +64/-40, touching only format specifiers and not runtime logic.

4.5 Ruiching V1.8.4 and new IDE: encoder, MIPI RGB666, GPIO pull-up/pull-down, GD32H7 project support (10-21)

Date: 2026-10-21 11:50 (publish time)　Source: EE Times China: Ruiching Platform V1.8.4 released, Ruiching Documentation Center

The Ruiching platform released V1.8.4, with 6 additions and 4 fixes on the SDK side, and RuiChingStudio IDE upgraded to V1.5.62 in tandem. The new capabilities center on RC3506 peripherals and display: a QY1503 absolute rotary encoder driver over the SSI interface with a quadrature-pulse PWM output example, aimed at motor closed-loop control and angle measurement; MIPI DSI gains RGB666 (18-bit color depth) support, with display format and lane count configured via device tree; a mipi_display_start() interface is exposed so applications can decide when display initialization happens, making it easier to sequence display and backlight power-up; GPIO adds PIN_MODE_INPUT_PULLUP and PIN_MODE_INPUT_PULLDOWN input modes, eliminating external pull resistors; and a new amp_device debug command shows device ownership under the AMP architecture (RT-Thread side or Linux side), interrupt affinity and clock frequency. On the IDE side, project creation, build and J-Link/DAP-Link download-and-debug support for the GD32H7 series are added, and the linking flow for GD32H7 and RK3576 projects is optimized; the full changelog and SDK have been synced to the documentation center.

4.6 GD32 embedded UI demo repo created; other main repos in the org remain quiet (10-21)

Date: 2026-10-21 17:58 (commit time)　Source: GD32EmbeddedUI-demos

GD32EmbeddedUI-demos was added under the RT-Thread-packages organization, created within this window by maintainer Rbb666; it currently holds only an Initial commit and the content has not yet taken shape, so this issue records only the repo creation. No new pushes to other repos in the organization: the main repo is at 10-19, rtthread-skills and smart-build at 10-18, env and the porting-spec repo at 10-17, and the packages index at 10-14; the FreeRTOS compatibility layer and n32h7xx standard drivers last saw pushes on 10-16 and 10-14 respectively. On the ecosystem side, several personal repos appeared within the window (rt-thread-am, rtthread-nano-fw, an initcall framework extraction, a Studio completion plugin, etc.), all newly created repos with single-digit stars that do not constitute reportable project activity.

V. Industry Applications

5.1 Ruiching V1.8.4’s industrial-site fixes: EtherCAT interrupt affinity, netstat hang under telnet, UART DMA baud rate (10-21)

Date: 2026-10-21 11:50 (publish time)　Source: EE Times China: Ruiching Platform V1.8.4 released, Ruiching changelog

All four fixes in the same release point at industrial sites: EtherCAT tasks and interrupts were previously not bound to the same CPU, with interrupts defaulting to CPU0, causing occasional access conflicts and crashes during multitasking; after the fix the two are bound to the same core. Running netstat remotely over telnet would block with no response, now fixed. The UART DMA example failed to set the baud rate, rooted in the DMA serial initialization flow, now corrected. The 4.3-inch screen example raises the backlight PWM for better outdoor visibility. Together with the EG1200 industrial gateway virtual network interface and NFS mounting reported in the previous issue, and the RC-Pi-3506-based ROS2 hub-motor motion control solution, what the Ruiching product line shows in this issue is two parallel advances—”networking capability on the gateway side” and “real-time performance on the motion control side”—and the fixes mostly come from real project feedback rather than internal testing.

VI. Summary and Trend Observations

  • Scheduler discussion moves from “each proposing their own” to “comparing implementations”: The three-year-stalled #6645 was re-examined, and its discriminator independently converged with #11907, but the two implementation approaches diverge on memory safety—deferring the READY write triggers a double-free via the idle reclamation path on single-core, while the approach that saves the old state does not. This kind of cross-proposal horizontal comparison is more decision-relevant than a single patch, and effectively makes #11907 the baseline for progress.
  • Defect reports continue to be driven by external researchers, and come with full impact scope: Two memory issues in one day—the NFS stack overflow’s introducing commit traces back to 2010 and affects all versions since v1.2.0, while the DHCP out-of-bounds read is proven missing by the check item of another implementation in the same directory. Both reports provide reproduction environments and trigger conditions, greatly reducing fix cost.
  • The RISC-V side gains a kernel replacement channel: After the full ESP-IDF 6.1 upgrade was merged, C3/C6 can replace FreeRTOS with RT-Thread via CONFIG_IDF_RTOS_RTTHREAD, and the toolchain simultaneously jumps to GCC 15.2; the blocker for the main-repo BSP proposal was cleared the same day, leaving only on-board verification. This is the most significant RISC-V-related step in this cycle.
  • Mainline static, version stuck at September: Three consecutive days of zero commits and zero merges, with v5.4.0 containing only version macros. All activity is concentrated in pending proposals, defect tickets, and the package repository, forming the same rhythm as the official channel’s halt in updates.
  • Vendor platforms iterate steadily by version and fold field issues into fixes: The six additions and four fixes in Ruiqing V1.8.4 all correspond to specific scenarios (encoder closed loop, MIPI screen adaptation, AMP debugging, EtherCAT affinity), and the IDE simultaneously expands to GD32H7—showing that competitiveness in industrial platforms is shifting from “can it run” to “is it stable in the field.”

6.2 Limitations and Deduplication Notes

  • This issue covers a 24-hour window (10-21 08:00 ~ 10-22 08:00), not a Monday, so no multi-day merge is performed.
  • The main repository had zero commits and zero merges within the window; all entries come from pending proposals, defect tickets, RT-Thread-packages side repositories, and vendor releases, with status noted for each.
  • Deduplication against the previous issue: #11907, #11909, #11911, #11910, #11903, and #11870 were all covered in the previous issue; this issue only writes conclusions newly added within the window (#11870 confirmed by maintainers as merged into esp-idf, the re-examination data for #6645, and the process status of #11910 and #11911).
  • In the search results, #11815 (lwip macro switch) and #11814 (RA6W1 resource allocation) show as updated within the window, but their actual merge times were 10-14 and 10-15 respectively; only comments and status changes occurred within the window, so they are not newly included.
  • The forum article API only returns the first 25 entries, and the latest one is an editorial update to a work already covered in the previous issue; the official news list page is front-end rendered, so the API is authoritative for news.
  • Google News returned zero hits for English over three days, and the only valid Chinese article within the three-day window was Ruiqing V1.8.4; Ruiqing queries remain flooded by same-named automotive articles, which were filtered out by title semantics.
  • Under the local machine’s anonymous GitHub rate limit, no organization-level full push verification was performed; instead, the repository commit stream and organization page were cross-verified, and the RT-Thread-packages organization page push times were checked repository by repository.

Appendix: Source Verification Table

Source Verification Result
RT-Thread official news API (organization category) No new items; the latest of 25 archived posts remains 06-17
Official website news list page Client-side dynamic rendering; scraping only returns an empty shell
Community forum article API No brand-new long-form articles among the first 25; the latest is an editorial update to a piece already covered in the previous issue (10-21 10:08)
GitHub main repo commits 0 in the window; the latest remains the K1 first release from 10-19
GitHub main repo PRs 13 updates in the window, 4 newly opened (#11912, #11914, #11915; #11916 is a test draft and not counted), none merged
GitHub main repo Issues 2 newly opened (#11913, #11917), neither claimed
GitHub main repo releases / tags No new releases; the latest remains v5.3.0 from 09-10
GitHub RT-Thread-packages esp-idf #18 merged (10-21), GD32EmbeddedUI-demos repo created (10-21), FreeRTOS-Wrapper stalled since 10-16
Other repos in the GitHub organization rtthread-skills, smart-build stalled since 10-18; env, spec repos stalled since 10-17; packages stalled since 10-14
GitHub topic:rt-thread ecosystem search A few personal repos created in the past week; none are project-level developments, not included
Google News aggregation (Chinese, via proxy) 1 valid article in the three-day window (Ruiching V1.8.4); the rest is same-name noise
Google News aggregation (English) Zero hits in the three-day window
HN Algolia All candidates in the window were “threads” false matches; no related discussion
Industry media and vendor channels Ruiching V1.8.4 release post and documentation center changelog

Full Source List