fix(esp_tee): Validate the stack pointer at the privilege switch boundary
Closes IDF-15974, IDF-15977, and IDF-15994
See merge request espressif/esp-idf!50647
The Key Manager hardware peripheral in its current form needs further
design changes before it can be offered as a production feature.
Until a revised peripheral design is available, withdraw ESP-IDF
support for it on all Key Manager capable targets.
riscv_trace_ll_enable_bus_clock and riscv_trace_ll_reset_register operate
on shared HP_SYS_CLKRST registers and were called concurrently from both
cores during SECONDARY init, creating RMW race conditions.
Move the clock/reset logic out of the HAL layer into
esp_riscv_trace_early_init, protected by PERIPH_RCC_ATOMIC() spinlock.
Wrap the LL functions with macros that enforce the caller must be inside
a PERIPH_RCC_ATOMIC() critical section at compile time.
In the Bluetooth connections with some smartphones, communication can possibly be blocked
during packet type negotation, when ESP32-S31 attempts to finalize the ACL-U transmission
and waits for the last Tx ACL-U packet to be transmitted, but peer device rejects the
packet with FLOW=STOP in its packet, thus causing a deadlock.
Closes https://github.com/espressif/esp-idf/issues/18797
fix(wifi): added validation for password and reserved data length in ESPTouch v2
Closes WIFI-7448, WIFI-7484, WIFI-7482, and WIFI-7444
See merge request espressif/esp-idf!50110
When a loop is deleted while an internal legacy "cleanup" event is still
queued (posted by a deferred self-unregistration from within a handler),
esp_event_loop_delete() drained the queue but only freed the post payload,
leaking the heap copy of the handler context allocated for the legacy path.
Free ctx->handler_ctx for queued legacy cleanup events while draining the
queue, mirroring the cleanup done in esp_event_loop_run().
Add a regression test that leaves a legacy cleanup event queued and asserts
no memory is leaked on loop deletion.
When esp_event_loop_run() exited via the ticks-expired break path,
loop->running_task was left pointing to the current task handle.
Any subsequent trylock in esp_event_handler_unregister_with_internal()
would see a stale non-NULL running_task and take the wrong code path.
esp_event_post_to() could access loop->queue / loop->mutex after
esp_event_loop_delete() freed them when both ran concurrently.
Introduce esp_event_loop_state_t with:
- posts_in_flight: reference-count incremented atomically (under
state.lock spinlock) before touching any loop resources, decremented
on every exit path via goto on_err.
- deleting: atomic_bool set by esp_event_loop_delete() to block new
posts from entering the critical section.
esp_event_loop_delete() sets deleting=true, then busy-waits (releasing
and re-acquiring loop->mutex each tick) until posts_in_flight reaches
zero before proceeding with teardown.
esp_event_isr_post_to() performs a lock-free atomic_load of deleting as
a best-effort guard; ISR context cannot participate in the spinlock
protocol but the window is documented and accepted.
After processing an esp_event_handler_cleanup sentinel, execution fell
through into the regular dispatch block. Every loop-level (ANY_BASE/
ANY_ID) handler was invoked with base="cleanup" and event_data pointing
at the internal esp_event_remove_handler_context_t struct.
Consequences:
- Information disclosure: internal handler addresses and loop instance
pointer are exposed to every loop-level handler.
- UAF: if a handler stores event_data for later use, post_instance_delete
frees the ctx, turning the stored pointer into a dangling reference.
- Logic corruption: handlers that switch on base with a default branch
misbehave on every unregister anywhere in the system.
Fix: wrap the regular dispatch block in an else clause so it is skipped
entirely for cleanup events. post_instance_delete, ticks accounting, and
xSemaphoreGiveRecursive remain in the shared tail executed for both paths.
Closes SEC_221
