Rahul Tank
1f314eff3e
fix(nimble): Deliver PAwR peripheral CONNECT via sync callback
2026-07-30 16:35:02 +05:30
Jiang Jiang Jian
df8ad67949
Merge branch 'bugfix/fix_espnow_data_rate_error_v5.3' into 'release/v5.3'
...
fix(wifi): fixed espnow data rate overridden by stale rate control (v5.3)
See merge request espressif/esp-idf!51305
2026-07-30 11:52:57 +08:00
Island
7a1c86344a
Merge branch 'change/ble_update_lib_20260717_v5.3' into 'release/v5.3'
...
change(ble): [AUTO_MR] 20260717 - Update ESP BLE Controller Lib (5.3)
See merge request espressif/esp-idf!50929
2026-07-30 10:08:02 +08:00
morris
50967d2dfd
Merge branch 'feat/sec_esp_drivers_v5.3' into 'release/v5.3'
...
fix(drivers): harden multiple peripheral drivers against local DoS and memory corruption (v5.3)
See merge request espressif/esp-idf!50561
2026-07-29 19:23:15 +08:00
morris
faa0bd021c
Merge branch 'bugfix/ppa_buffer_oob_v5.3' into 'release/v5.3'
...
fix(ppa): add checks for input to avoid any OOB access (v5.3)
See merge request espressif/esp-idf!51142
2026-07-29 18:55:37 +08:00
zhangyanjiao
829d43c9ef
fix(wifi): fixed espnow data rate overridden by stale rate control
2026-07-29 17:52:35 +08:00
Rahul Tank
76fa1483ab
Merge branch 'feat/sbom_changes_v5.3' into 'release/v5.3'
...
fix(nimble): update sbom file with cve details (v5.3)
See merge request espressif/esp-idf!51184
2026-07-29 15:03:51 +05:30
Alexey Gerenkov
dd77984ee6
Merge branch 'fix/cxx-tls-destructors_v5.3' into 'release/v5.3'
...
fix(cxx): fix TLS classes destructor call (v5.3)
See merge request espressif/esp-idf!34209
2026-07-29 16:17:58 +08:00
Rahul Tank
2ccfcc7066
fix(nimble): update sbom file with cve details
2026-07-29 12:53:31 +05:30
Jiang Jiang Jian
be0801377d
Merge branch 'bugfix/clear_ifx_tx_queue_v5.3' into 'release/v5.3'
...
bugfix(wifi): Clear Sta TX queue to prevent key 2 send failure (Backport v5.3)
See merge request espressif/esp-idf!50901
2026-07-29 15:16:35 +08:00
Island
6e1600f2f9
Merge branch 'feat/add_bt_common_npl_v5.3' into 'release/v5.3'
...
feat(bt): Add host-agnostic BT OSAL and shared BLE profile task (5.3)
See merge request espressif/esp-idf!51217
2026-07-29 15:00:21 +08:00
akshat
a791b31867
bugfix(wifi): Clear Sta TX queue to prevent key 2 send failure
...
Also, Ensure correct return values for key 2 and key 4.
2026-07-29 10:45:06 +05:30
morris
681fd6177f
fix(sdspi): reject oversized pre-read data before block receive
...
Guard start_command_read_blocks against cards that place TOKEN_BLOCK_START so early that extra_data_size exceeds the bytes expected on the current iteration. Without this check, the unsigned subtraction for will_receive underflows and propagates into memset, SPI transaction length, and memcpy counts against the fixed 516-byte block buffer.
2026-07-29 11:45:31 +08:00
morris
d2984d636d
fix(spi_slave): free DMA-private buffers when transaction queue is full
...
spi_slave_queue_trans calls spi_slave_setup_priv_trans to allocate
DMA buffers, then tries xQueueSend. If the queue is full the function
returns ESP_ERR_TIMEOUT without freeing those buffers, leaking up to
2 * max_transfer_sz per failed call. Call spi_slave_uninstall_priv_trans
before returning the timeout.
2026-07-29 11:45:31 +08:00
morris
421b3f8954
fix(jpeg): release platform mutex on semaphore/pm-lock allocation failure
...
jpeg_acquire_codec_handle acquires s_jpeg_platform.mutex at entry
but two ESP_RETURN_ON_* macros (semaphore-create and PM-lock-create
failure) return without releasing it. Replace with ESP_GOTO_ON_*
that jumps to a cleanup label which frees partial resources, NULLs
the codec pointer, and releases the mutex.
2026-07-29 11:45:31 +08:00
morris
63fa4546a0
fix(i2c): release platform mutex on intr/pm_lock delete failure
...
ESP_RETURN_ON_ERROR inside the s_i2c_platform.mutex critical section
returns without releasing the mutex, permanently blocking all I2C
bus operations. Replace with ESP_GOTO_ON_ERROR that jumps to a
cleanup label releasing the mutex before return.
2026-07-29 11:45:31 +08:00
morris
4f054f74bb
fix(csi): move csi_fsm init before resource allocation to fix err-path leak
...
CSI_FSM_INIT is 1, but the controller struct is zero-allocated.
Any failure before the former csi_fsm assignment (near the end of
esp_cam_new_csi_ctlr) jumped to err: which called s_del_csi_ctlr.
That function bailed out immediately because csi_fsm == 0, leaking
the claimed slot, queue, bridge, DMA channel, PM lock, and backup
buffer. Move csi_fsm = CSI_FSM_INIT right after a successful claim
so the err: path properly tears down all allocated resources.
2026-07-29 11:42:56 +08:00
morris
05ebe7ad4b
fix(adc): add missing input validation for channel and ret_handle
...
- adc_cali_curve_fitting: validate config->chan in check_valid() to
prevent OOB access into s_adc_cali_chan_compens compensation table
- adc_filter: make s_adc_filter_free idempotent on !UNIT_BINDED SoCs
to prevent double-free on repeated adc_del_continuous_iir_filter
- adc_cali_line_fitting(esp32): fix config && config typo to
config && ret_handle, preventing NULL-pointer dereference
2026-07-29 11:42:56 +08:00
Jiang Jiang Jian
ffd6fbd9fc
Merge branch 'bugfix/fix_some_coex_bugs_260727_v5.3' into 'release/v5.3'
...
fix(coex): move 15.4 register configuration to 15.4 init(Backport v5.3)
See merge request espressif/esp-idf!51178
2026-07-29 10:23:34 +08:00
Jiang Jiang Jian
06ec4430d0
Merge branch 'bugfix/roaming_app_issues_v5.3' into 'release/v5.3'
...
Fixed some issues in roaming app found using static analysis(v5.3)
See merge request espressif/esp-idf!49937
2026-07-29 10:17:57 +08:00
Jiang Jiang Jian
74622529fd
Merge branch 'fix/fix_iram_sleep_process_access_cache_v5.3' into 'release/v5.3'
...
fix(esp_hw_support): fix get_act_hp/lp_dbias accessed ext mem (v5.3)
See merge request espressif/esp-idf!51212
2026-07-29 10:15:42 +08:00
Jin Chen
eeecd45929
change(ble): [AUTO_MR] Update lib_esp32c6 to 18aafc6f
...
(cherry picked from commit 624845829a )
Co-authored-by: cjin <jinchen@espressif.com >
2026-07-29 08:42:09 +08:00
Jin Chen
8cdb74f49d
change(ble): [AUTO_MR] Update lib_esp32h2 to 18aafc6f
...
(cherry picked from commit d7b7876c3c )
Co-authored-by: cjin <jinchen@espressif.com >
2026-07-29 08:42:09 +08:00
Wang Meng Yang
9079e1473a
Merge branch 'bugfix/ai_review_avrcp_v5.3' into 'release/v5.3'
...
fix(bt): Fix the critical and high issues related to AVRCP from AI review report (v5.3)
See merge request espressif/esp-idf!50023
2026-07-28 19:59:39 +08:00
Wang Meng Yang
d9f2d61539
Merge branch 'bugfix/hid_host_oob_read_v5.3' into 'release/v5.3'
...
fix(bt/bluedroid): fixed possible 1-byte OOB read in bta_hh_ctrl_dat_act (v5.3)
See merge request espressif/esp-idf!50975
2026-07-28 19:52:02 +08:00
Wang Meng Yang
e13cc8ef6f
Merge branch 'bugfix/bredr_critical_bugs_v5.3' into 'release/v5.3'
...
fix(bt/bluedroid): fixed issues from AI review in GAP, SPP, HID, L2CAP and HCI (v5.3)
See merge request espressif/esp-idf!51081
2026-07-28 19:43:58 +08:00
Hu Rui
194de3ab4b
fix(uhci): rx fsm race condition and buffer size check
...
Closes https://github.com/espressif/esp-idf/issues/18819
Closes https://github.com/espressif/esp-idf/issues/18820
2026-07-28 14:56:43 +08:00
chenjianhua
67960f06d7
feat(bt): Add host-agnostic BT OSAL and shared BLE profile task
...
- Add bt_osal: event queues, mutexes, semaphores, callouts, etc.
- Add the shared BLE profile task and event queue
- Bring both up and tear them down in the host init/deinit paths
- Add unit tests for the OSAL and the profile task
2026-07-27 19:52:30 +08:00
Li Shuai
38c2c69378
change(esp_hw_support): optimize get hp/lp dbias implementation iram or flash usage
2026-07-27 19:14:08 +08:00
Alexey Lapshin
390a496942
fix(cxx): fix TLS classes destructor call
...
Closes https://github.com/espressif/esp-idf/issues/14360
2026-07-27 15:16:36 +07:00
Xu Si Yu
b762a6f5d0
fix(coex): move 15.4 register configuration to 15.4 init
...
1. move 15.4 register configuration to 15.4 init
2. fix coex status get issue
2026-07-27 11:41:56 +08:00
morris
25039385e2
Merge branch 'backport/spi_flash_fixes_v5.3' into 'release/v5.3'
...
fix(spi_flash): backport aes-xts error-path & mxic fixes (v5.3)
See merge request espressif/esp-idf!51138
2026-07-27 10:36:36 +08:00
Shreeyash Bhakare
f2b7aa1db8
fix(nimble): Added security related fixes
2026-07-25 13:48:33 +05:30
Astha Verma
8025ab856c
fix(nimble): Restore throughput after switching from LE Coded PHY
2026-07-24 18:08:38 +05:30
Shu Chen
dae526045b
Merge branch 'feat/update_phylib_on_s31_c6_for_track_v5.3' into 'release/v5.3'
...
feat(phy): update phy lib for esp32s31 & esp32c6 for track (v5.3)
See merge request espressif/esp-idf!50794
2026-07-24 11:05:06 +00:00
Rahul Tank
7ec47c264d
Merge branch 'bugfix/red_rem_feat_evt_v5.3' into 'release/v5.3'
...
Handle Read Remote Supported Feature failure (v5.3)
See merge request espressif/esp-idf!50812
2026-07-24 14:28:47 +05:30
Jiang Jiang Jian
8363d0e4d1
Merge branch 'bugfix/a2dp_sbc_v5.3' into 'release/v5.3'
...
fix(bt): Fix the pointer sbc_start_frame is not initialized (v5.3)
See merge request espressif/esp-idf!51020
2026-07-24 16:02:04 +08:00
Song Ruo Jing
134328affb
fix(ppa): add checks for input to avoid any OOB access
2026-07-24 15:39:29 +08:00
C.S.M
c7dd46e84b
fix(spi_flash): Fix spi_flash leaks release aes-xts in error path
...
(cherry picked from commit 305c5869ee )
2026-07-24 15:00:50 +08:00
Shengyu Qu
352d18b48e
fix(spi_flash): add #if check for s_mxic_set_required_regs()
...
Currently, s_mxic_set_required_regs() lacks checking for
CONFIG_SPI_FLASH_SUPPORT_MXIC_OPI_CHIP. And this causes a defined but not
used warning when MXIC flash driver is disabled in project config. So add
a #if check for this to supress warning.
Signed-off-by: Shengyu Qu <wiagn@4d2.org >
(cherry picked from commit 062c948c18 )
2026-07-24 15:00:50 +08:00
zwx
5b13be2889
feat(openthread): use ieee802154 event callback list instead of weak overrides
2026-07-24 14:23:55 +08:00
Island
7efbfbb0a1
Merge branch 'fix/ble_hidd_remove_ccc_gating_v5.3' into 'release/v5.3'
...
fix(esp_hid/bluedroid): remove app-layer CCC gating in HID device (5.3)
See merge request espressif/esp-idf!51004
2026-07-23 19:26:18 +08:00
Wang Meng Yang
9c15348402
Merge branch 'bugfix/low_spp_throughput_v5.3' into 'release/v5.3'
...
change(bt/bluedroid): increased port low watermark of RFCOMM (v5.3)
See merge request espressif/esp-idf!51087
2026-07-23 16:41:33 +08:00
morris
9727ba62c3
Merge branch 'bugfix/ana_cmpr_macro_v5.3' into 'release/v5.3'
...
fix(ana_cmpr): Fix swapped POS/NEG cross interrupt masks on ESP32-C5/P4 (v5.3)
See merge request espressif/esp-idf!50802
2026-07-23 14:56:22 +08:00
Island
8f897fb259
Merge branch 'fix/ble_log_compression_safety_v5.3' into 'release/v5.3'
...
fix(ble_log): fix unaligned access and buffer safety in log compression (5.3)
See merge request espressif/esp-idf!47928
2026-07-23 14:22:57 +08:00
Jin Cheng
ed20c79614
change(bt/bluedroid): increased port low watermark of RFCOMM
...
When PORT_RX_BUF_LOW_WM is too low, RFCOMM replenishes credits only
after receiving a relatively large number of packets, which may cause
the peer to exhaust its credits and enter a stop-and-wait state.
Increase the low watermark to replenish credits more promptly and
reduce the likelihood of the peer stalling while waiting for additional
credits.
2026-07-23 08:11:29 +08:00
Jin Cheng
d70a124dec
fix(bt/bluedroid): fixed issues from AI review in GAP, SPP, HID, L2CAP and HCI
2026-07-23 07:53:22 +08:00
Jack
f69b8bde01
fix(phy): removed all librfate logic from cmake
2026-07-22 20:06:39 +08:00
zhuanghang
0476dfa707
feat(phy): update phy lib for esp32s31 & esp32c6 for track
2026-07-22 20:06:24 +08:00
yangfeng
ff7ce10233
fix(bt): Fix the high issues related to AVRCP from AI review report
...
- SDP/registration: handle SDP record creation and discovery failures safely
- AVRC stack: fix packet checks, fragment leaks, response build, and compile guards
- BTC AVRCP: fix return codes, connection state, metadata parsing, and memory leaks
- AVCTP: fix event passing, L2CAP conflicts, TX queue leaks, and disconnect handling
- Example: remove TG RN capability setup before initialization
2026-07-22 17:33:27 +08:00