Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-03 11:41:23 +03:00
Code Issues Packages Projects Releases Wiki Activity
52,121 Commits 25 Branches 192 Tags
release/v6.0
Commit Graph
713 Commits
Author SHA1 Message Date
Island 5ac710ee56 Merge branch 'feat/ble_smp_repairing_hardening_v6.0' into 'release/v6.0' 
feat(ble/bluedroid): add Kconfig options for BLE re-pairing hardening (6.0)

See merge request espressif/esp-idf!52421
 2026-09-15 14:12:07 +08:00
Island 602c154453 Merge branch 'feat/support_pawr_connect_evt_v6.0' into 'release/v6.0' 
feat(ble/bluedroid): Support PAWR connection event (6.0)

See merge request espressif/esp-idf!51442
 2026-09-15 14:12:05 +08:00
Jin Cheng b40d860987 fix(bt/bluedroid): fixed OOB read dring mSBC sync word check 2026-09-15 09:34:13 +08:00
Island ba6bbdeb41 Merge branch 'bugfix/fix_bluedroid_find_info_format_mismatch_v6.0' into 'release/v6.0' 
fix(ble/bluedroid): restore find info PDU stop on UUID format mismatch (6.0)

See merge request espressif/esp-idf!52080
 2026-09-10 20:50:30 +08:00
Wang Meng Yang d5f9b93781 Merge branch 'change/refactor_hidh_datapath_v6.0' into 'release/v6.0' 
Change/refactor hidh datapath[backport v6.0]

See merge request espressif/esp-idf!51279
 2026-09-06 11:24:27 +08:00
Wang Meng Yang 06a411f81a Merge branch 'fix/aireview_obex_v6.0' into 'release/v6.0' 
fix(bt_obex): fix some bugs in bluedroid obex (v6.0)

See merge request espressif/esp-idf!52005
 2026-09-06 11:18:52 +08:00
hejiaxin b2c98e72cd fix(bt_avrcp): size some AVRC command buffers 2026-09-04 11:51:39 +08:00
Zhi Wei Jian 2bada5b678 feat(ble/bluedroid): reject LE re-pairing that weakens an existing bond 
Add smp_repairing_is_allowed() behind BT_BLE_SMP_HARDENED_REPAIRING so a
peer cannot replace an existing bond with one that has less MITM
protection, no Secure Connections, or a shorter key. Compare a preceding
Security Request against the pairing command AuthReq, not the
association-model result, and always allow first pairing.

A refusal keeps the stored bond. Pairing-failure erase is split by link
role: default is erase as Central and keep as Peripheral.

Closes BLERP (NDSS 2026) V3, V4 and V6.


(cherry picked from commit 88ea45be73)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-09-04 11:03:52 +08:00
Zhi Wei Jian 6b9b3d969e fix(ble/bluedroid): harden LE bond handling across encryption 
Keep the existing bond until the new pairing is encrypted, and on encryption
failure drop the link instead of clearing keys. Recovering from a peer that
really deleted the bond is opt-in through BT_BLE_SMP_UNBOND_ON_KEY_MISSING.

Closes BLERP (NDSS 2026) V5, and stops an unauthenticated Pairing Request
from dropping the stored keys (V2 exploitation).


(cherry picked from commit f864615d7d)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-09-04 11:03:52 +08:00
hejiaxin 4226c1fdd4 fix(bt_obex): fix some bugs in bluedroid obex 
- fix goepc wait state switch
- fix psm unbind's mismatch
- fix some resources leak
- fix goep connection's incorrect ternimation when congesting
- Add some NULL ptr check
 2026-09-04 10:20:04 +08:00
liqigan 6c27057d67 change(bt/bluedroid): Refactored HCI ACL datapath 2026-09-04 09:32:58 +08:00
Wang Meng Yang 2d5899d022 Merge branch 'fix/bluedroid_aireview_v6.0' into 'release/v6.0' 
Fix/bluedroid aireview (v6.0)

See merge request espressif/esp-idf!51480
 2026-09-04 07:55:43 +08:00
Jiang Jiang Jian 07d868db77 Merge branch 'feat/bt_in_psram_v6.0' into 'release/v6.0' 
feat(bluedroid): Add config to place btu and hci task stack in psram (v6.0)

See merge request espressif/esp-idf!51490
 2026-09-03 19:51:53 +08:00
Jiang Jiang Jian 13c5832753 Merge branch 'fix/aireview_critical_v6.0' into 'release/v6.0' 
fix: Fix some critical bugs in classic bt (v6.0)

See merge request espressif/esp-idf!51289
 2026-09-03 19:50:40 +08:00
Jiang Jiang Jian 3a4bbeb620 Merge branch 'bugfix/strncpy_compilation_issue_v6.0' into 'release/v6.0' 
fix(bluedroid): Fix the compilation issue of BCM_STRNCPY_S (v6.0)

See merge request espressif/esp-idf!51743
 2026-09-03 19:25:46 +08:00
Zhang Hai Peng 83bed68375 fix(ble/bluedroid): restore find info PDU stop on UUID format mismatch 
Restore GATT_NO_RESOURCES when sequential attributes have differing UUID
sizes so gatts_process_find_info() stops building the response PDU.


(cherry picked from commit 196cb39545)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
 2026-08-26 14:43:55 +08:00
yangfeng 02f41c63b7 fix(bt): do not cap AVDTP Discover results by local SEP count 
- Closes https://github.com/espressif/esp-idf/issues/18848
 2026-08-13 19:31:52 +08:00
yangfeng 991ee96741 fix(bluedroid): Fix the compilation issue of BCM_STRNCPY_S 2026-08-13 19:16:03 +08:00
hejiaxin 744c1b0474 feat(bluedroid): Add config to place btu and hci task stack in psram 
- Also adjust the osi_thread_stop implementation.
 2026-08-04 14:55:54 +08:00
Jin Cheng 3361e9363f fix(bt/bluedroid): fixed incorrect eSCO packet type validation under secure connection mode in BlueDroid 2026-08-04 14:30:20 +08:00
hejiaxin e9f80c32ef fix(bt): Fix some bug in stm_sco.c 
- Memory safety
- State machine & logic integrity
- Resource leaks
- Edge cases check
 2026-08-04 14:30:20 +08:00
Zhi Wei Jian 551c40ed07 feat(ble/bluedroid): Support PAWR connection event 
(cherry picked from commit 7da7fa42ac)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-08-03 15:26:01 +08:00
hejiaxin 7f42eabb08 fix(bt_stack): Fix some critical bugs in classic_bt stack 
related: obex, smp, pbap, sdp, rfcomm, stack_dm

- Deinit function doesn't delete connection when OBEX_DYNAMIC_MEMORY is on
- Union tGOEPC_DATA sometimes is free by osi_free in some cases when it contains mtu_id
- Add correct free and return solution after fail
- Fix symbol mistake in mod calculation
- Fix pointer-related UAF problems and memory free problems
- Fix buffer overflows and out-of-bounds access
- Fix infinite loops triggered by integer overflow wraparound
- Fix double free
- Change layer_specific usage to avoid heap overflow
- Add some NULL check for pointers
- Fix sdp_db free function
- Fix state table mismatch
 2026-07-29 17:05:31 +08:00
Jiang Jiang Jian f01548cfd9 Merge branch 'bugfix/bredr_critical_bugs_v6.0' into 'release/v6.0' 
fix(bt/bluedroid): fixed issues from AI review in GAP, SPP, HID, L2CAP and HCI (v6.0)

See merge request espressif/esp-idf!51077
 2026-07-24 16:12:26 +08:00
Jin Cheng fdcb70e608 fix(bt/bluedroid): fixed issues from AI review in GAP, SPP, HID, L2CAP and HCI 2026-07-23 07:42:23 +08:00
Zhang Hai Peng 824621c324 fix(ble/bluedroid): track ext scan state for rand addr check 
Update inq_var.state only after btsnd_hcic_ble_ext_scan_enable succeeds.
Clear BTM_BLE_SCANNING on explicit stop and controller scan timeout.


(cherry picked from commit 23519567e4)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
 2026-07-21 10:53:26 +08:00
Jiang Jiang Jian a2cd919a64 Merge branch 'bugfix/bug_bounty_av_v6.0' into 'release/v6.0' 
fix(bt/bluedroid): Fix bug bounty issues about A/V from NVIDIA (v6.0)

See merge request espressif/esp-idf!50477
 2026-07-20 13:54:41 +08:00
Wang Meng Yang bed9759dbb Merge branch 'bugfix/avrc_ca_attr_id_check_v6.0' into 'release/v6.0' 
fix(bt): Fix the validation of AVRCP metadata attr_id in handle_rc_attributes_rsp (v6.0)

See merge request espressif/esp-idf!50550
 2026-07-19 14:37:06 +08:00
Wang Meng Yang e3a54f6673 Merge branch 'bugfix/fix_bredr_inq_crash_v6.0' into 'release/v6.0' 
fix(bt/bluedroid): fix crash during bredr inquiry when zero-addr device is found (v6.0)

See merge request espressif/esp-idf!50854
 2026-07-19 12:45:13 +08:00
yangfeng ca77dffadc fix(bt): Fix the validation of AVRCP metadata attr_id in handle_rc_attributes_rsp 2026-07-19 10:26:33 +08:00
yangfeng e472bc3868 fix(bt/bluedroid): Fix unchecked p_ctrl_cback and p_msg_cback in AVRC 
Closes SEC-1186
 2026-07-19 10:21:29 +08:00
yangfeng a3088cdce1 fix(bt/bluedroid): Fix missing NULL check on p_cfg in AVDT_ReconfigReq 
Closes SEC-1187
 2026-07-19 10:21:29 +08:00
Wang Meng Yang e743ff2a10 Merge branch 'bugfix/smp_sec_flags_v6.0' into 'release/v6.0' 
fix(bt/bluedroid): fixed several security issues from NVIDIA (v6.0)

See merge request espressif/esp-idf!50566
 2026-07-17 20:04:33 +08:00
linruihao eb81835174 fix(bt/bluedroid): fix crash during bredr inquiry when zero-addr device is found 2026-07-17 10:39:19 +08:00
Island 2dc3285e57 Merge branch 'bugfix/fix_bluedroid_read_multi_v6.0' into 'release/v6.0' 
fix(ble/bluedroid): fix GATT Read Multiple response handling (6.0)

See merge request espressif/esp-idf!50709
 2026-07-15 15:38:50 +08:00
Zhi Wei Jian 1ade9c6f0e feat(ble/bluedroid): Support bluedroid dual identity 
(cherry picked from commit 2358786647)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-14 14:17:33 +08:00
Zhi Wei Jian 279ad49fb0 fix(ble/bluedroid): use BOOLEAN for BLE HCI command builders 
(cherry picked from commit abbf001120)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-14 12:04:31 +08:00
Zhi Wei Jian 05e35f842a fix(ble/bluedroid): clean up LE CoC connect on CCB alloc failure 
(cherry picked from commit 4fd1ebb4a9)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-14 12:04:25 +08:00
Zhi Wei Jian 656af102e8 docs(ble/bluedroid): note ISO BIG HCI alloc failure not checked 
(cherry picked from commit 34b59d30ae)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-14 12:04:25 +08:00
Zhi Wei Jian 8efe8f6ff4 fix(ble/bluedroid): fix direct-connect cleanup and adv bounds 
(cherry picked from commit 82e71c1767)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-14 12:04:24 +08:00
Zhi Wei Jian 395229d444 fix(ble/bluedroid): validate BLE confirm/OOB and sec-check device 
(cherry picked from commit 93ab11d564)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-14 12:04:24 +08:00
Zhi Wei Jian 273c463497 fix(ble/bluedroid): validate SMP pair-fail reason and OOB device 
(cherry picked from commit 98efe02385)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-14 12:04:23 +08:00
Zhi Wei Jian 179ea3578f fix(ble/bluedroid): route ATT indication-conf timeout separately 
(cherry picked from commit 6c3267ee84)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-14 12:04:23 +08:00
Zhi Wei Jian 0e4c3ca05d fix(ble/bluedroid): validate ATT PDU sizes 
(cherry picked from commit bb00b9817d)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-14 12:04:23 +08:00
Zhi Wei Jian 7383c07af9 fix(ble/bluedroid): re-lookup GATT TCB after enc-complete callback 
(cherry picked from commit 37562af0ea)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-14 12:04:22 +08:00
Zhi Wei Jian c7d6a7ce9e fix(ble/bluedroid): fix GATT long read and Service Changed CCC 
(cherry picked from commit 4ce692ac0c)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-14 12:04:22 +08:00
Zhi Wei Jian bd8ce47005 fix(ble/bluedroid): validate GATT client discovery handles 
(cherry picked from commit ac35ae6f2d)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-14 12:04:21 +08:00
Zhi Wei Jian 98a8e41c83 fix(ble/bluedroid): cap Read By Type length and free failed service decl 
(cherry picked from commit 27ff0cf8c7)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-14 12:04:21 +08:00
Zhi Wei Jian 418cf61513 fix(ble/bluedroid): guard GATT database hash and serialization 
(cherry picked from commit 995c1508e8)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-14 12:04:21 +08:00
Zhi Wei Jian de2544c5de fix(ble/bluedroid): fix GATT server busy errors and sr_cmd handling 
(cherry picked from commit f86739b03d)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-14 12:04:20 +08:00