Renz Bagaporo
52f1a8dfda
fix(esp_ringbuf): validate/guard ringbuf size
2026-07-21 10:46:21 +09:00
Renz Bagaporo
379ab73a7c
fix(esp_ringbuf): add test for max item size underflow
2026-07-21 10:46:21 +09:00
Alexey Gerenkov
c0992a3a5a
Merge branch 'sysview_test_fixes_v6.0' into 'release/v6.0'
...
Sysview test fixes v6.0
See merge request espressif/esp-idf!50729
2026-07-20 18:45:30 +08:00
Jiang Jiang Jian
6e1dc59ed9
Merge branch 'fix/blacklist_flag_correction_v6.0' into 'release/v6.0'
...
fix(wifi): Correct blacklist flag(v6.0)
See merge request espressif/esp-idf!50919
2026-07-20 16:17:55 +08:00
morris
9e040f4c20
Merge branch 'bugfix/ana_cmpr_macro_v6.0' into 'release/v6.0'
...
fix(ana_cmpr): Fix swapped POS/NEG cross interrupt masks on ESP32-C5/P4 (v6.0)
See merge request espressif/esp-idf!50799
2026-07-20 14:22:39 +08:00
Jiang Jiang Jian
a2cd919a64
Merge branch 'bugfix/bug_bounty_av_v6.0' into 'release/v6.0'
...
fix(bt/bluedroid): Fix bug bounty issues about A/V from NVIDIA (v6.0)
See merge request espressif/esp-idf!50477
2026-07-20 13:54:41 +08:00
Jiang Jiang Jian
3befd9d774
Merge branch 'bugfix/add_en_rst_in_pvt_func_for_p4_backport_v6.0' into 'release/v6.0'
...
fix(pvt): add en reset in pvt func for p4 on release v6.0
See merge request espressif/esp-idf!50882
2026-07-20 11:39:00 +08:00
Jiang Jiang Jian
f298dd2110
Merge branch 'bugfix/sdmmc-ddr-response-buffer-leak_v6.0' into 'release/v6.0'
...
fix(sdmmc): free DMA response buffer on DDR mode switch failure (v6.0)
See merge request espressif/esp-idf!50886
2026-07-20 10:45:54 +08:00
Jiang Jiang Jian
d1d8dd478d
Merge branch 'bugfix/nvs-flash-erase-partition-leak_v6.0' into 'release/v6.0'
...
fix(nvs_flash): delete temporary NVSPartition after erase (v6.0)
See merge request espressif/esp-idf!50891
2026-07-20 10:45:35 +08:00
Jiang Jiang Jian
f24018d113
Merge branch 'feature/enable_zb_for_esp32p4_v6.0' into 'release/v6.0'
...
feat(soc): enable zb* extensions for esp32p4 greater v3 (v6.0)
See merge request espressif/esp-idf!50779
2026-07-20 10:44:17 +08:00
Jiang Jiang Jian
4f063a3166
Merge branch 'fix/bootloader_anti_rollback_konfig_v6.0' into 'release/v6.0'
...
fix(bootloader): Hide bootloader anti-rollback Kconfig where not supported (v6.0)
See merge request espressif/esp-idf!50817
2026-07-20 10:39:09 +08:00
Jiang Jiang Jian
a1b0ace41b
Merge branch 'fix/keep_use_secure_element_v6.0' into 'release/v6.0'
...
fix(esp-tls): Keep deprecated use_secure_element field for compatibility (v6.0)
See merge request espressif/esp-idf!50780
2026-07-20 10:38:38 +08:00
Jiang Jiang Jian
f5323ed82c
Merge branch 'contrib/github_pr_18817_v6.0' into 'release/v6.0'
...
fix(wear_levelling): guard WL_Flash::write()/read() against size==0 underflow (GitHub PR) (v6.0)
See merge request espressif/esp-idf!50731
2026-07-20 10:36:48 +08:00
Jiang Jiang Jian
21fdc1b01f
Merge branch 'contrib/github_pr_18823_v6.0' into 'release/v6.0'
...
fix(vfs): use MAX_FDS instead of VFS_MAX_COUNT when clearing fd table on unregister (GitHub PR) (v6.0)
See merge request espressif/esp-idf!50698
2026-07-20 10:34:04 +08:00
Euripedes Rocha
493af45bb4
Merge branch 'fix/sec-1162-1189-1190-null-checks_v6.0' into 'release/v6.0'
...
fix(esp_netif): harden NULL and OOM handling in netif APIs (SEC-1162, SEC-1189, SEC-1190) (v6.0)
See merge request espressif/esp-idf!50599
2026-07-20 04:32:58 +02:00
Euripedes Rocha
533fdf256b
Merge branch 'fix/sec-1137-br-glue-double-free_v6.0' into 'release/v6.0'
...
fix(esp_netif): harden br_glue instance-handler cleanup against double-free (SEC-1137) (v6.0)
See merge request espressif/esp-idf!50643
2026-07-20 04:32:26 +02:00
Jiang Jiang Jian
d5e6becd46
Merge branch 'fix/lwip_sec_high_v6.0' into 'release/v6.0'
...
fix(lwip): high severity lwip fixes (v6.0)
See merge request espressif/esp-idf!50591
2026-07-20 10:30:51 +08:00
Jiang Jiang Jian
55afa16a8a
Merge branch 'backport/bdl_ioctl_checker_v6.0' into 'release/v6.0'
...
feat(esp_blockdev): add build-time ioctl command reservation overlap checker (v6.0 backport)
See merge request espressif/esp-idf!50217
2026-07-20 10:21:59 +08:00
Wang Meng Yang
bed9759dbb
Merge branch 'bugfix/avrc_ca_attr_id_check_v6.0' into 'release/v6.0'
...
fix(bt): Fix the validation of AVRCP metadata attr_id in handle_rc_attributes_rsp (v6.0)
See merge request espressif/esp-idf!50550
2026-07-19 14:37:06 +08:00
Wang Meng Yang
e3a54f6673
Merge branch 'bugfix/fix_bredr_inq_crash_v6.0' into 'release/v6.0'
...
fix(bt/bluedroid): fix crash during bredr inquiry when zero-addr device is found (v6.0)
See merge request espressif/esp-idf!50854
2026-07-19 12:45:13 +08:00
yangfeng
ca77dffadc
fix(bt): Fix the validation of AVRCP metadata attr_id in handle_rc_attributes_rsp
2026-07-19 10:26:33 +08:00
yangfeng
e472bc3868
fix(bt/bluedroid): Fix unchecked p_ctrl_cback and p_msg_cback in AVRC
...
Closes SEC-1186
2026-07-19 10:21:29 +08:00
yangfeng
a3088cdce1
fix(bt/bluedroid): Fix missing NULL check on p_cfg in AVDT_ReconfigReq
...
Closes SEC-1187
2026-07-19 10:21:29 +08:00
Rahul Tank
04ccb4c955
Merge branch 'bugfix/add_dis_ieee_udi_to_config_v6.0' into 'release/v6.0'
...
fix(nimble): Add option to disable IEEE and UDI Characteristic in DIS (v6.0)
See merge request espressif/esp-idf!50760
2026-07-18 09:31:45 +05:30
Wang Meng Yang
e743ff2a10
Merge branch 'bugfix/smp_sec_flags_v6.0' into 'release/v6.0'
...
fix(bt/bluedroid): fixed several security issues from NVIDIA (v6.0)
See merge request espressif/esp-idf!50566
2026-07-17 20:04:33 +08:00
tarun.kumar
fd0d67c3dc
fix(wifi): Correct blacklist flag
2026-07-17 17:09:24 +05:30
Wang Meng Yang
27a5aba8e1
Merge branch 'feat/ble_log_compression_module_cfg_update_v6.0' into 'release/v6.0'
...
Feat/ble log compression module cfg update (6.0)
See merge request espressif/esp-idf!49875
2026-07-17 19:35:49 +08:00
Martin Vychodil
326a998708
Merge branch 'fix/sdmmc_cmd_err_switch_case_handling_v6.0' into 'release/v6.0'
...
fix(sdmmc): sdmmc_cmd.c fixed error handling in certain if and switch statements (v6.0)
See merge request espressif/esp-idf!50683
2026-07-17 18:23:40 +08:00
Sumeet Singh
73ef4148a8
fix(nimble): Add option to disable IEEE and UDI Characteristic in DIS (v6.0)
2026-07-17 14:57:20 +05:30
sonika.rathi
3ad5251819
fix(nvs_flash): delete temporary NVSPartition after erase
2026-07-17 10:57:27 +02:00
sonika.rathi
849a342fe0
fix(sdmmc): free DMA response buffer on DDR mode switch failure
2026-07-17 10:47:47 +02:00
wuzhenghui
5d528ee6d4
feat(esp_hw_support): fix esp32p4 PVT retention link
2026-07-17 16:24:05 +08:00
yanzihan@espressif.com
d6e6ee1dbb
feat(pvt): add en reset in pvt func for p4 on master
2026-07-17 16:23:53 +08:00
Jiang Jiang Jian
a89931243c
Merge branch 'bugfix/change_pvt_timer_target_param_backport_v6.0' into 'release/v6.0'
...
feat(pvt): change pvt timer target & limit on release v6.0
See merge request espressif/esp-idf!50814
2026-07-17 16:13:16 +08:00
Rahul Tank
6a24b81921
Merge branch 'bugfix/add_extra_prints_v6.0' into 'release/v6.0'
...
fix(nimble): Remove SOC_ESP_NIMBLE_CONTROLLER from unnecessary locations (v6.0)
See merge request espressif/esp-idf!50095
2026-07-17 10:42:27 +05:30
morris
afb9f5a719
Merge branch 'feat/csi_error_event_v6.0' into 'release/v6.0'
...
Add MIPI-CSI error event (v6.0)
See merge request espressif/esp-idf!50681
2026-07-17 12:17:02 +08:00
Jiang Jiang Jian
7c49a6a4d8
Merge branch 'fix/move_cache_lock_workaround_out_of_ipc_stall_v6.0' into 'release/v6.0'
...
fix(esp_hw_support): disable esp32 livelock workaround before stall another core (v6.0)
See merge request espressif/esp-idf!50770
2026-07-17 11:26:23 +08:00
linruihao
eb81835174
fix(bt/bluedroid): fix crash during bredr inquiry when zero-addr device is found
2026-07-17 10:39:19 +08:00
Aditya Patwardhan
cc2cfc17ba
Merge branch 'fix/nvs-encrypted-partition-destructor-zeroize_v6.0' into 'release/v6.0'
...
fix(nvs_flash): zeroize XTS contexts when encrypted partition is destroyed (v6.0)
See merge request espressif/esp-idf!50806
2026-07-16 22:32:40 +05:30
morris
8ca8e00621
Merge branch 'feat/uhci_send_multi_buffer_v6.0' into 'release/v6.0'
...
feat(uhci): support transmit multi buffer (v6.0)
See merge request espressif/esp-idf!50777
2026-07-16 19:26:34 +08:00
morris
80f969e279
Merge branch 'isp_dma_one_frame_v6.0' into 'release/v6.0'
...
feat(isp): support isp dma input and add example (v6.0)
See merge request espressif/esp-idf!50755
2026-07-16 17:17:25 +08:00
luoxu
47e012a968
feat(ble): reorganize log compression Kconfig
...
Move log-compression Kconfig files to host/ and profile/mesh/ directories and update source paths.
2026-07-16 16:58:00 +08:00
sonika.rathi
0545b56e7a
fix(wear_levelling): shorten zero-size guard comments
2026-07-16 09:35:43 +02:00
Rahul Tank
bf03b83dfe
fix(nimble): Fix ECC HW byte-order and dropped SOC_ESP_NIMBLE_CONTROLLER
2026-07-16 12:29:32 +05:30
Konstantin Kondrashov
d5869bb6ee
fix(bootloader): Hide bootloader anti-rollback Kconfig where not supported
2026-07-16 09:38:04 +03:00
yanzihan@espressif.com
77effaabb2
feat(pvt): change pvt timer target & limit
2026-07-16 14:14:14 +08:00
Aditya Patwardhan
970b54962f
fix(nvs_flash): zeroize XTS contexts when encrypted partition is destroyed
...
NVSEncryptedPartition held two XTS_CONTEXT members (mEctxt, mDctxt) for
encryption / decryption. Their AES round keys are derived from the NVS
encryption key (HMAC-derived or plaintext from nvs_keys partition) and
therefore are sensitive secrets.
The destructor was empty, so when the NVS encrypted partition object
was destroyed -- on nvs_flash_deinit_partition(), on initialization
errors, and on any other teardown path -- the XTS round keys were left
in DRAM until the freed object's memory happened to be overwritten by
a later allocation. A subsequent stack/heap leak primitive would
recover the AES key from those bytes.
Fix:
* Initialize both XTS contexts in the constructor so the destructor's
free path is always safe (previously xts_init was only called in
init(); destruction before init() would have run xts_free on an
uninitialized struct).
* Provide a real destructor that calls XTS_FUNC(xts_free) on both
contexts, which performs mbedtls_platform_zeroize / esp_aes_xts free
semantics on the underlying AES contexts.
2026-07-16 10:34:01 +05:30
Tiago Medicci
a4239cab38
test(ana_cmpr): Add edge-specific interrupt direction test case
...
Add a Unity test case that arms only ANA_CMPR_CROSS_POS (resp. only
ANA_CMPR_CROSS_NEG) on a unit and asserts that a real transition of
the matching direction fires the callback exactly once, while a
transition of the opposite (never-armed) direction does not fire at
all.
This closes a gap in the existing test_apps: none of the current
cases isolate cross direction, so a swapped POS/NEG interrupt mask in
the LL layer (fixed in the previous commit) previously went
undetected.
On the scan-based comparator IP (ESP32-H4/S31), a crossing is only
sampled/latched when a scan is explicitly triggered, so the new test
case also triggers a scan after each level change on that IP, plus
one extra priming scan right after enabling the unit so the internal
compare state starts in sync with the already-set initial GPIO level.
Signed-off-by: Tiago Medicci <tiago.medicci@espressif.com >
2026-07-16 11:42:00 +08:00
Tiago Medicci
9014e35377
fix(ana_cmpr): Fix swapped POS/NEG cross interrupt masks on ESP32-C5/P4/C61
...
In components/soc/esp32c5/register/soc/gpio_ext_struct.h (ESP32-C5),
components/soc/esp32c61/register/soc/gpio_ext_struct.h (ESP32-C61),
and components/soc/esp32p4/register/hw_ver3/soc/gpio_struct.h
(ESP32-P4), the analog comparator raw/status/enable/clear register
fields are named comp_neg_0_*/comp0_neg_* for bit 0 and
comp_pos_0_*/comp0_pos_* for bit 1, but each field's own comment says
the opposite: bit 0 is documented as "analog comparator pos edge
interrupt raw/status/enable/clear" and bit 1 as the "neg" counterpart.
The LL masks were defined from the field names rather than from this
documented behavior, so ANALOG_CMPR_LL_POS_CROSS_INTR_MASK() ended up
selecting bit 1 and ANALOG_CMPR_LL_NEG_CROSS_INTR_MASK() bit 0.
A new test case, added in the following commit, arms only one cross
direction at a time and checks that a matching transition fires the
callback while the opposite, never-armed direction does not; without
this fix it reproducibly fails on ESP32-C5, ESP32-P4, and ESP32-C61.
Signed-off-by: Tiago Medicci <tiago.medicci@espressif.com >
2026-07-16 11:29:17 +08:00
luoxu
5f25d81bed
feat(ble): split log compression Kconfig into separate mesh and host files
2026-07-16 11:24:47 +08:00