From 3dbbafbbb399670681c2796aee38410f0d7d9db5 Mon Sep 17 00:00:00 2001
From: ShenWeilong <shenweilong@espressif.com>
Date: Wed, 26 Aug 2026 11:41:51 +0800
Subject: [PATCH 1/2] fix(bt): fixed mempool deinit crash issue

---
 components/bt/controller/CMakeLists.txt       |  2 +-
 components/bt/host/nimble/nimble              |  2 +-
 components/bt/porting/include/os/os_mempool.h | 23 +++++++++++++++++++
 components/bt/porting/mem/os_mempool.c        | 23 ++++++++++++++++++-
 4 files changed, 47 insertions(+), 3 deletions(-)

diff --git a/components/bt/controller/CMakeLists.txt b/components/bt/controller/CMakeLists.txt
index 6c1dfe5340f..ac83694592f 100644
--- a/components/bt/controller/CMakeLists.txt
+++ b/components/bt/controller/CMakeLists.txt
@@ -33,7 +33,7 @@ function(register_bt_ctrl_libs)
         set(lib_path "${CMAKE_CURRENT_FUNCTION_LIST_DIR}/lib_${TARGET_SRC_NAME}/${TARGET_SRC_NAME}-bt-lib")
         # BLE controller library
         if(NOT CONFIG_BT_DUAL_MODE_ARCH OR CONFIG_BT_CTRL_BLE_ENABLE)
-            if(EXISTS "${lib_path}/libble_app.a")
+            if(NOT EXISTS "${lib_path}/${idf_target}")
                 if(CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY AND EXISTS "${lib_path}/libble_app_flash.a")
                     add_prebuilt_library(libble_app "${lib_path}/libble_app_flash.a" REQUIRES esp_phy bt)
                 else()
diff --git a/components/bt/host/nimble/nimble b/components/bt/host/nimble/nimble
index 96ab0e4d864..8d18f6d4ac8 160000
--- a/components/bt/host/nimble/nimble
+++ b/components/bt/host/nimble/nimble
@@ -1 +1 @@
-Subproject commit 96ab0e4d864090777512cddbb4aa8609d598c000
+Subproject commit 8d18f6d4ac821e139bb0ffa72f3eddde9edac42f
diff --git a/components/bt/porting/include/os/os_mempool.h b/components/bt/porting/include/os/os_mempool.h
index 4363d7474c4..825018a7160 100644
--- a/components/bt/porting/include/os/os_mempool.h
+++ b/components/bt/porting/include/os/os_mempool.h
@@ -358,6 +358,29 @@ void os_mempool_flags_set(struct os_mempool *mp, uint8_t flags);
  */
 void os_mempool_flags_clear(struct os_mempool *mp, uint8_t flags);
 
+/**
+ * @brief Deinitialize a memory pool.
+ *
+ * @param mp Pointer to memory pool
+ */
+void os_mempool_deinit(struct os_mempool *mp);
+
+ /**
+ * @brief Deinitialize all of memory pools.
+ *
+ * @param is_controller Whether called from controller.
+ *
+ * @return OS_OK on success; OS_INVALID_PARM if not found corresponding memory pools.
+ */
+os_error_t os_mempool_deinit_all(bool is_controller);
+
+/**
+ * @brief Check if there are any live memory pools.
+ *
+ * @return true if there are any live memory pools; false otherwise.
+ */
+bool os_mempool_has_live_pool(void);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/components/bt/porting/mem/os_mempool.c b/components/bt/porting/mem/os_mempool.c
index 6f8314c69dc..03b2e599d0a 100644
--- a/components/bt/porting/mem/os_mempool.c
+++ b/components/bt/porting/mem/os_mempool.c
@@ -735,6 +735,11 @@ os_mempool_module_init(void)
 static os_error_t
 os_mempool_mem_free(struct os_mempool *mp)
 {
+    /*  Extended mempool has its own free logic */
+    if (mp->mp_flags & OS_MEMPOOL_F_EXT) {
+        return OS_OK;
+    }
+
     /* For runtime allocation mode, check whether all blocks have been freed */
     if (!(mp->mp_flags & OS_MEMPOOL_F_RUNTIME)) {
         return OS_EINVAL;
@@ -767,8 +772,15 @@ os_mempool_mem_free(struct os_mempool *mp)
 #endif
 
 void
-os_mempool_deinit(bool is_controller)
+os_mempool_deinit(struct os_mempool *mp)
 {
+    os_mempool_unregister(mp);
+}
+
+os_error_t
+os_mempool_deinit_all(bool is_controller)
+{
+    os_error_t err = OS_INVALID_PARM;
     struct os_mempool *mp = NULL;
     struct os_mempool *next = NULL;
 
@@ -780,8 +792,17 @@ os_mempool_deinit(bool is_controller)
             next = STAILQ_NEXT(mp, mp_list);
             os_mempool_unregister(mp);
             mp = next;
+            err = OS_OK;
         } else {
             mp = STAILQ_NEXT(mp, mp_list);
         }
     }
+
+    return err;
+}
+
+bool
+os_mempool_has_live_pool(void)
+{
+    return !STAILQ_EMPTY(&g_os_mempool_list);
 }

From d3b4dd958423ca0af88bc8171947daf70a39232d Mon Sep 17 00:00:00 2001
From: ShenWeilong <shenweilong@espressif.com>
Date: Fri, 28 Aug 2026 19:20:18 +0800
Subject: [PATCH 2/2] fix(ble): Check if there are illegal library files in
 controller lib path

---
 components/bt/controller/CMakeLists.txt             | 7 +++++++
 components/bt/controller/lib_esp32h2/esp32h2-bt-lib | 2 +-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/components/bt/controller/CMakeLists.txt b/components/bt/controller/CMakeLists.txt
index ac83694592f..2327cf3915d 100644
--- a/components/bt/controller/CMakeLists.txt
+++ b/components/bt/controller/CMakeLists.txt
@@ -40,6 +40,13 @@ function(register_bt_ctrl_libs)
                     add_prebuilt_library(libble_app "${lib_path}/libble_app.a" REQUIRES esp_phy bt)
                 endif()
             else()
+                file(GLOB ILLEGAL_LIB_FILES "${lib_path}/*.a")
+                if(ILLEGAL_LIB_FILES)
+                    message(FATAL_ERROR
+                        "${lib_path} should not contain the library files!"
+                    )
+                endif()
+
                 if(CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY AND EXISTS "${lib_path}/${idf_target}/libble_app_flash.a")
                     add_prebuilt_library(libble_app "${lib_path}/${idf_target}/libble_app_flash.a" REQUIRES esp_phy bt)
                 else()
diff --git a/components/bt/controller/lib_esp32h2/esp32h2-bt-lib b/components/bt/controller/lib_esp32h2/esp32h2-bt-lib
index df0cbaba7e2..b7db86bd4d5 160000
--- a/components/bt/controller/lib_esp32h2/esp32h2-bt-lib
+++ b/components/bt/controller/lib_esp32h2/esp32h2-bt-lib
@@ -1 +1 @@
-Subproject commit df0cbaba7e2cb665352358799c1063258c32e7b0
+Subproject commit b7db86bd4d579055c4a47ca849575513f00a23f9