Commit Graph
29582 Commits
Author SHA1 Message Date
radek.tandler 1d8ca0c66b fix(nvs_flash): fixed cleanup after nvs_set_blob failed on ESP_ERR_NVS_NOT_ENOUGH_SPACE
- fixed identification of blob parts to be cleaned by using right starting chunk index
  - improved localisation of blobs for cases where some of pages get reclaimed
  - created host test cases covering the edge cases above
2026-07-14 17:34:41 +02:00
Euripedes Rocha 7a911c980d Merge branch 'fix/w5500_rx_buffer_corruption_recovery_v5.3' into 'release/v5.3'
fix(esp_eth): recover W5500 RX path on corrupted frame length (v5.3)

See merge request espressif/esp-idf!50649
2026-07-14 14:34:00 +02:00
zhiweijian bfdb6f5c9e fix(ble/bluedroid): guard GATT database hash and serialization 2026-07-14 14:59:15 +08:00
Zhi Wei Jian 329c1c8f8e feat(ble/bluedroid): Support bluedroid dual identity
(cherry picked from commit 2358786647)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
2026-07-14 14:26:15 +08:00
Rahul Tank 43280d9be8 Merge branch 'bugfix/fix_bond_store_overflow_v5.3' into 'release/v5.3'
fix(nimble): Fix bond-store overflow when IRK is enabled (v5.3)

See merge request espressif/esp-idf!50627
2026-07-14 11:17:48 +05:30
Zhi Wei Jian ebd9ca130e fix(ble/bluedroid): use BOOLEAN for BLE HCI command builders
(cherry picked from commit abbf001120)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
2026-07-14 12:03:55 +08:00
Zhi Wei Jian 5f7deedd8b fix(ble/bluedroid): clean up LE CoC connect on CCB alloc failure
(cherry picked from commit 4fd1ebb4a9)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
2026-07-14 12:03:54 +08:00
Zhi Wei Jian f080478455 docs(ble/bluedroid): note ISO BIG HCI alloc failure not checked
(cherry picked from commit 34b59d30ae)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
2026-07-14 12:03:54 +08:00
Zhi Wei Jian ea9fdcd2e0 fix(ble/bluedroid): fix direct-connect cleanup and adv bounds
(cherry picked from commit 82e71c1767)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
2026-07-14 12:03:54 +08:00
Zhi Wei Jian 1f3d235a9f fix(ble/bluedroid): validate BLE confirm/OOB and sec-check device
(cherry picked from commit 93ab11d564)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
2026-07-14 12:03:53 +08:00
Zhi Wei Jian 7e677879a6 fix(ble/bluedroid): validate SMP pair-fail reason and OOB device
(cherry picked from commit 98efe02385)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
2026-07-14 12:03:53 +08:00
Zhi Wei Jian de4598284a fix(ble/bluedroid): route ATT indication-conf timeout separately
(cherry picked from commit 6c3267ee84)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
2026-07-14 12:03:52 +08:00
Zhi Wei Jian 315ff40e71 fix(ble/bluedroid): validate ATT PDU sizes
(cherry picked from commit bb00b9817d)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
2026-07-14 12:03:52 +08:00
Zhi Wei Jian c3d78e8c66 fix(ble/bluedroid): re-lookup GATT TCB after enc-complete callback
(cherry picked from commit 37562af0ea)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
2026-07-14 12:03:52 +08:00
Zhi Wei Jian 80992db5a6 fix(ble/bluedroid): fix GATT long read and Service Changed CCC
(cherry picked from commit 4ce692ac0c)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
2026-07-14 12:03:51 +08:00
Zhi Wei Jian c5ee2be0ed fix(ble/bluedroid): validate GATT client discovery handles
(cherry picked from commit ac35ae6f2d)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
2026-07-14 12:03:51 +08:00
Zhi Wei Jian c202b37fa8 fix(ble/bluedroid): cap Read By Type length and free failed service decl
(cherry picked from commit 27ff0cf8c7)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
2026-07-14 12:03:51 +08:00
Zhi Wei Jian 6fa7f4195d fix(ble/bluedroid): fix GATT server busy errors and sr_cmd handling
(cherry picked from commit f86739b03d)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
2026-07-14 12:03:50 +08:00
Zhi Wei Jian a6fed3daae fix(ble/bluedroid): fix GATT teardown and service-change flow
(cherry picked from commit 0645ba469d)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
2026-07-14 12:03:50 +08:00
Zhi Wei Jian 0927c1990d fix(ble/bluedroid): fix GATT service lifecycle leaks
(cherry picked from commit ac93d94958)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
2026-07-14 12:03:49 +08:00
Zhi Wei Jian c33e3c13bc fix(ble/bluedroid): add GATT resource-cleanup helpers
(cherry picked from commit b83327f3ca)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
2026-07-14 12:03:49 +08:00
Zhi Wei Jian 1b3a7a04c2 feat(ble/bluedroid): Support bluedroid LE COC and EATT features
(cherry picked from commit 83f0831c53)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
2026-07-14 11:56:00 +08:00
Zhang Hai Peng 58a777febf fix(ble/bluedroid): downgrade numeric comparison log to warning
(cherry picked from commit 72a49ed53b)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
2026-07-14 10:37:04 +08:00
Zhang Hai Peng f6f9236099 fix(ble/bluedroid): preserve ext adv state when set params fails
Only update extend_adv_cb after HCI Set Extended Advertising
Parameters succeeds, so a failed update does not corrupt cached
legacy_pdu and related fields used by adv data validation.


(cherry picked from commit 31bd80fee8)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
2026-07-14 10:37:02 +08:00
Zhang Hai Peng 0b0eaf2db4 fix(ble/bluedroid): reject invalid ATT error code 0x00 on client
Map received error reason 0x00 to GATT_UNKNOWN_ERROR so the client
does not report GATT_SUCCESS with zero-length data on malformed errors.


(cherry picked from commit 1b6f9380f4)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
2026-07-14 10:36:03 +08:00
Zhang Hai Peng 01066c125b fix(ble/bluedroid): use sr_cmd status for GATT server error rsp
When sending an ATT error response after a failed server operation,
use p_tcb->sr_cmd.status instead of the last app callback status so
invalid error code 0x00 is not sent to the peer.


(cherry picked from commit 4c0488d92a)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
2026-07-14 10:36:03 +08:00
Zhang Hai Peng 2fe6c39b83 fix(ble/bluedroid): match read-multiple-var responses by handle
(cherry picked from commit 979c7dc567)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
2026-07-14 10:36:02 +08:00
Zhang Hai Peng bc4889662b fix(ble/bluedroid): match read-multiple responses by handle
Read Multiple may mix stack auto-responses with app async responses,
so multi_rsp_q order can differ from the request handle order. Look up
each response by handle (with occurrence for duplicates) instead of
walking the queue by index, and treat opcode-only buffers as empty.


(cherry picked from commit f91a41510c)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
2026-07-14 10:36:01 +08:00
Island 9c65614fa5 Merge branch 'fix/ble_mesh_fixed_issues_v5.3' into 'release/v5.3'
Resolve reported BLE mesh stack issues (5.3)

See merge request espressif/esp-idf!50404
2026-07-14 10:16:53 +08:00
Guilherme Ferreira 724897ecc2 fix(esp_eth): recover W5500 RX path on corrupted frame length
Reject an implausible SPI-read frame-length header and drain the
socket RX buffer to resync Sn_RX_RD, instead of looping forever on
the unrecoverable descriptor and starving the system.
2026-07-10 23:06:13 +00:00
Euripedes Rocha b6234bb6fc Merge branch 'fix/sec-347-hostname-null-check_v5.3' into 'release/v5.3'
fix(esp_netif): reject NULL hostname in esp_netif_set_hostname_api (SEC_347) (v5.3)

See merge request espressif/esp-idf!50593
2026-07-10 14:14:51 +02:00
Euripedes Rocha Filho 53e0944889 fix(esp_netif): Removes double-free path and NULL dereference in bridge 2026-07-10 14:13:13 +02:00
wuzhenghui a3515f31fb fix(esp_hw_support): update memory pointer checks for SPM support 2026-07-10 17:18:42 +08:00
Rahul Tank dd42e3ced3 fix(nimble): Fix bond-store overflow when IRK is enabled 2026-07-10 13:31:39 +05:30
morris e11c30437a Merge branch 'fix/uhci_rx_fsm_v5.3' into 'release/v5.3'
fix(uhci): rx fsm race condition (v5.3)

See merge request espressif/esp-idf!50581
2026-07-10 11:22:38 +08:00
Jiang Jiang Jian f6bad005cf Merge branch 'change/change_regdma_malloc_caps_v5.3' into 'release/v5.3'
change(esp_hw_support): change regdma malloc caps to allow getting memory in the DMA pool (v5.3)

See merge request espressif/esp-idf!50261
2026-07-10 10:28:44 +08:00
David Cermak 2e2d398904 fix(lwip): Adds nullchecks after DHCP server alloc'd pools 2026-07-09 16:09:22 +02:00
David Cermak 3c4d786a2c fix(lwip): reject invalid DHCP MTU option values
Validate MTU from DHCP option 26 against RFC 2132 minimum (68 bytes)
before applying to netif->mtu, preventing rogue DHCP servers from
setting MTU to 0 or other dangerously low values that cause integer
wraparound in IPv4 fragmentation.
2026-07-09 16:09:21 +02:00
Euripedes Rocha Filho 5e65088205 fix(esp_netif): reject NULL hostname in esp_netif_set_hostname_api
esp_netif_set_hostname_api() dereferenced hostname via strlen() without
checking it for NULL first, causing a NULL pointer dereference.
2026-07-09 16:08:17 +02:00
Hu Rui 9bcf04ab89 fix(uhci): rx fsm race condition
Closes https://github.com/espressif/esp-idf/issues/18746
2026-07-09 19:06:08 +08:00
Zhang Wen Xu b6860b2db5 Merge branch 'feat/update_openthread_submodule_and_br_lib_20260624_v5.3' into 'release/v5.3'
feat(openthread): update openthread submodule (v5.3)

See merge request espressif/esp-idf!50521
2026-07-09 10:16:54 +00:00
wuzhenghui 82712313ea change(heap): reserve DMA pool with low priority MALLOC_CAP_DEFAULT caps 2026-07-09 17:37:14 +08:00
Jin Cheng ff88e7a635 fix(bt/bluedroid): fixed stuck sec_state on authention HCI command send failure
Closes SEC-1164
2026-07-09 17:20:40 +08:00
Jin Cheng db6cd2a300 fix(bt/bluedroid): fixed HID host slot leak on local VUP ACL drop
Closes SEC-1169
2026-07-09 17:20:40 +08:00
Jin Cheng 70a7fea55f fix(bt/bluedroid): fixed NULL dereference in remote legacy authentication handler
Closes SEC-1143
2026-07-09 17:20:40 +08:00
Jin Cheng eb9ad41c9b fix(bt/bluedroid): fixed integer overflow in HID report descriptor parser
Closes SEC-084
2026-07-09 17:20:40 +08:00
Jin Cheng 72aaf89016 fix(bt/bluedroid): fixed wrong link key flag cleared on legacy BR/EDR authentication failure
Stale bond trust state cound remain after authenticaion failure, causing
incorrect bond status and link key auto-reply behavior.

Closes SEC-1153
2026-07-09 17:20:40 +08:00
Hu Rui 730120e90b fix(dac): dac_continuous set is_cyclic flag in async mode 2026-07-09 11:21:08 +08:00
Song Ruo Jing ca2a029722 fix(dma2d): fix non-usable DMA2D_CSC_TX_SCRAMBLE option 2026-07-08 23:03:41 +08:00
Song Ruo JingandCursor 278e2c2b41 fix(dma2d): fix race with dma2d_force_end and ISR
free_up_channels can only be called once for a started transaction.
Double free will undesirely stop the next picked 2D-DMA transaction on the same channel.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-07-08 23:03:40 +08:00