Commit Graph
45838 Commits
Author SHA1 Message Date
Sajia 884036b072 fix(wifi): Prevent double free in owe failure path 2026-08-10 12:03:55 +05:30
Jiang Jiang Jian d6ad1232ae Merge branch 'bugfix/dpp_backport_v5.4' into 'release/v5.4'
fix(esp_wifi): Backport dpp and other fixes

See merge request espressif/esp-idf!51411
2026-08-06 16:19:17 +08:00
Jiang Jiang Jian 54d648e703 Merge branch 'fix/154_mac_receive_at_v5.4' into 'release/v5.4'
fix(ieee802154): skip receive_at when rx window already expired (v5.4)

See merge request espressif/esp-idf!51369
2026-08-06 12:29:09 +08:00
Jiang Jiang Jian 6c0799d334 Merge branch 'backport/lp_spi_fix_inline_v5.4' into 'release/v5.4'
fix(ulp/lp_spi): fix stale data in driver (v5.4)

See merge request espressif/esp-idf!51312
2026-08-06 12:02:40 +08:00
Jiang Jiang Jian 4cd8933eb7 Merge branch 'test/run_supported_cmake_tests_v5.4' into 'release/v5.4'
test(tools): Added minimal supported cmake versions build system tests (v5.4)

See merge request espressif/esp-idf!51114
2026-08-06 11:59:50 +08:00
Jiang Jiang Jian 8a5cd6c388 Merge branch 'bugfix/vfs_fat_readdir_stat_cache_v5.4' into 'release/v5.4'
fix(fatfs): move readdir-stat cache to per-DIR stream (v5.4)

See merge request espressif/esp-idf!50906
2026-08-06 11:58:23 +08:00
Jiang Jiang Jian 5e6450fb55 Merge branch 'contrib/github_pr_18829_v5.4' into 'release/v5.4'
fix(spiffs): fix off-by-one in spiffsgen.py obj name length check (GitHub PR) (v5.4)

See merge request espressif/esp-idf!50917
2026-08-06 11:55:13 +08:00
Jiang Jiang Jian 1788bf7d9e Merge branch 'contrib/github_pr_18822_v5.4' into 'release/v5.4'
fix(esp_partition): prevent size_t overflow bypassing bounds checks on linux target (GitHub PR) (v5.4)

See merge request espressif/esp-idf!50910
2026-08-06 11:54:59 +08:00
Jiang Jiang Jian 5b2f687142 Merge branch 'bugfix/sdmmc-ddr-response-buffer-leak_v5.4' into 'release/v5.4'
fix(sdmmc): free DMA response buffer on DDR mode switch failure (v5.4)

See merge request espressif/esp-idf!50888
2026-08-06 11:54:26 +08:00
Jiang Jiang Jian ac3962b03a Merge branch 'test/idf-additions-coverage_v5.4' into 'release/v5.4'
test(freertos): expand IDF additions test coverage (v5.4)

See merge request espressif/esp-idf!50822
2026-08-06 11:51:50 +08:00
Jiang Jiang Jian cc718ffa69 Merge branch 'contrib/github_pr_18823_v5.4' into 'release/v5.4'
fix(vfs): use MAX_FDS instead of VFS_MAX_COUNT when clearing fd table on unregister (GitHub PR) (v5.4)

See merge request espressif/esp-idf!50700
2026-08-06 11:51:18 +08:00
Jiang Jiang Jian f9f69f0cae Merge branch 'lwip/dns_stack_corruption_fix_v5.4' into 'release/v5.4'
docs(lwip): clarify DNS_MAX_HOST_IP range and addr_cnt in Kconfig (v5.4)

See merge request espressif/esp-idf!49194
2026-08-06 11:50:28 +08:00
Jiang Jiang Jian cd6850cf55 Merge branch 'opt/hfp_audio_quality_v5.4' into 'release/v5.4'
change(bt/bluedroid): optimized the HFP example workflow to improve audio quality (v5.4)

See merge request espressif/esp-idf!51551
2026-08-06 11:31:47 +08:00
Jiang Jiang Jian 355264d7f7 Merge branch 'feat/ot_rx_sensitivity_v5.4' into 'release/v5.4'
feat(openthread): use the actual receive sensitivity for link quality evaluation (v5.4)

See merge request espressif/esp-idf!51483
2026-08-06 11:27:25 +08:00
Jiang Jiang Jian 8f810bd44c Merge branch 'feat/support_pawr_connect_evt_v5.4' into 'release/v5.4'
feat(ble/bluedroid): Support PAWR connection event (5.4)

See merge request espressif/esp-idf!51440
2026-08-06 11:25:37 +08:00
Jiang Jiang Jian 5ecf5638ba Merge branch 'fix/resolve_issues_reported_via_bbp_v5.4' into 'release/v5.4'
fix(openthread): fix null pointer deref, uninitialized struct, and unbounded strcpy in spinel/RCP code (v5.4)

See merge request espressif/esp-idf!51371
2026-08-06 11:23:23 +08:00
Jiang Jiang Jian 22ca67b85a Merge branch 'fix/fatfs_vulnerabilities_v5.4' into 'release/v5.4'
fix(fatfs): harden against runZero 2026 FatFs bugs (v5.4)

See merge request espressif/esp-idf!50427
2026-08-06 11:20:41 +08:00
Shreyas Sheth 8a2ad321d5 fix(esp_wifi): Backport dpp and other fixes
1) Fix crash while connecting to dpp akm
2) Fix phy ref cnt for power management for offchannel_tx
3) Introduced a variable to indicate dpp ap for scan results
4) Introduced WIFI_AUTH_UNKNOWN for ap with misconfigured security parameter
2026-08-05 19:55:26 +05:30
Jin Cheng 6d83ab5035 change(bt/bluedroid): optimized the HFP example workflow to improve audio quality
Disabled inquiry scan and page scan after SCO connection establishment
to reduce over-the-air bandwidth usage and improve audio quality by
prevent scan activities from interrupting SCO traffic.
2026-08-05 18:01:21 +08:00
Island c8585795ec Merge branch 'fix/ble_mesh_added_gatt_err_rsp_v5.4' into 'release/v5.4'
fix(ble_mesh): align GATTS read/write response handling with ATT (5.4)

See merge request espressif/esp-idf!51461
2026-08-05 16:03:00 +08:00
zwx 5f725faa7d fix(ieee802154): skip receive_at when rx window already expired 2026-08-05 06:59:17 +00:00
zwx d1af6ebf89 fix(openthread): fix null pointer deref, uninitialized struct, and unbounded strcpy in spinel/RCP code 2026-08-05 06:58:54 +00:00
Wang Meng Yang a3e1f55f3e Merge branch 'feat/bt_in_psram_v5.4' into 'release/v5.4'
feat(bluedroid): Add config to place btu and hci task stack in psram (v5.4)

See merge request espressif/esp-idf!51493
2026-08-05 14:26:37 +08:00
Jiang Jiang Jian 9120300402 Merge branch 'contrib/github_pr_18817_v5.4' into 'release/v5.4'
fix(wear_levelling): guard WL_Flash::write()/read() against size==0 underflow (GitHub PR) (v5.4)

See merge request espressif/esp-idf!50733
2026-08-05 12:23:09 +08:00
Jiang Jiang Jian dc7c4c882c Merge branch 'fix/rtc_retain_mem_sb_fast_wakeup_ptr_v5.4' into 'release/v5.4'
fix(bootloader_support): fix RTC retain mem offset for secure boot fast wakeup (v5.4)

See merge request espressif/esp-idf!51269
2026-08-05 10:44:11 +08:00
Island 8c3500b917 Merge branch 'fix/ble_log_compression_add_local_header_file_v5.4' into 'release/v5.4'
feat(ble_log): mirror local compression headers (5.4)

See merge request espressif/esp-idf!50950
2026-08-05 10:06:54 +08:00
Jiang Jiang Jian 7ef63043e0 Merge branch 'bugfix/nan_vulnerabilities_v5.4' into 'release/v5.4'
fix(nan): Fix bug bounty reported and discovered vulnerabilities in NAN Rx (Backport v5.4)

See merge request espressif/esp-idf!51303
2026-08-04 20:37:26 +08:00
Euripedes Rocha 6dccb29a0f Merge branch 'fix/sec-1129-l2tap-close-rollback_v5.4' into 'release/v5.4'
fix(esp_netif): roll back l2tap_close on semaphore/task create failure (SEC-1129) (v5.4)

See merge request espressif/esp-idf!51400
2026-08-04 09:07:46 +02:00
hejiaxin 7c48812de9 feat(bluedroid): Add config to place btu and hci task stack in psram
- Also adjust the osi_thread_stop implementation.
2026-08-04 14:56:04 +08:00
Rahul Tank 6891e46417 Merge branch 'bugfix/add_nimble_cve_v5.4' into 'release/v5.4'
fix(nimble): Fixes for various NimBLE CVEs (v5.4)

See merge request espressif/esp-idf!51203
2026-08-04 12:15:02 +05:30
Shu Chen 3c7136dbff feat(openthread): use the actual receive sensitivity for link quality evaluation 2026-08-04 14:40:46 +08:00
Wang Meng Yang 8945329c8b Merge branch 'fix/aireview_critical_v5.4' into 'release/v5.4'
fix: Fix some critical bugs in classic bt (v5.4)

See merge request espressif/esp-idf!51291
2026-08-04 14:16:22 +08:00
Wang Meng Yang 5340a84fc8 Merge branch 'fix/bluedroid_aireview_v5.4' into 'release/v5.4'
Fix/bluedroid aireview (v5.4)

See merge request espressif/esp-idf!51296
2026-08-04 14:12:25 +08:00
Luo Xu e2114de7b0 feat(ble_log): mirror local compression headers
(cherry picked from commit ee732a4591)

Co-authored-by: luoxu <luoxu@espressif.com>
2026-08-04 11:53:15 +08:00
Rahul Tank 81d5a89bd9 fix(nimble): Fixes for various NimBLE CVEs 2026-08-03 23:47:07 +05:30
Euripedes Rocha Filho 24c3b92449 fix(esp_netif): Avoid socket to stay in closing state in l2tap closing 2026-08-03 16:14:32 +02:00
Luo Xu 696ea1bb08 fix(ble_mesh): align GATTS read/write response handling with ATT
bt_mesh_bta_gatts_cb did not always answer ATT Read/Write Requests:
- READ: on a callback error it only logged a warning and sent nothing; a
  0-byte read (Read Blob at an offset equal to the value length) also sent
  nothing, although it is a successful empty read.
- WRITE: on a callback error it sent nothing, and a partial/zero write was
  treated as success.
- Both: when the handle was not found or the attribute had no read/write
  callback, the request was silently dropped.

An ATT Request must always be answered:

- READ: len >= 0 is success -> Read Response (a 0-byte read yields an empty
  value); len < 0 -> ATT Error Response carrying the callback's error code
  (-len, since BLE_MESH_GATT_ERR(x) == -x). The copy length is clamped to
  the source buffer size as a defensive bound. If the handle is unknown or
  the attribute has no read callback, respond with INVALID_HANDLE /
  READ_NOT_PERMITTED.
- WRITE: when need_rsp is set, always reply. len == write length -> Write
  Response; otherwise (negative ATT error, partial write, or 0) -> ATT
  Error Response (the negative code, or UNLIKELY for partial/0). If the
  handle is unknown or the attribute has no write callback, respond with
  INVALID_HANDLE / WRITE_NOT_PERMITTED. Write Without Response still sends
  no response.

A non-success status passed to BTA_GATTS_SendRsp is turned into an ATT
Error Response by the GATT layer (gatt_sr_process_app_rsp ->
gatt_send_error_rsp).


(cherry picked from commit ed1f4de3a3)

Co-authored-by: luoxu <luoxu@espressif.com>
2026-08-03 21:43:43 +08:00
Zhi Wei Jian d7ae97ec69 fix(ble/bluedroid): Build LE event mask from host feature macros
(cherry picked from commit 68dff5d798)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
2026-08-03 15:25:46 +08:00
Zhi Wei Jian b5dfde1c9e feat(ble/bluedroid): Support PAWR connection event
(cherry picked from commit 7da7fa42ac)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
2026-08-03 15:25:46 +08:00
Island ccd00fb116 Merge branch 'fix/ble_log_compression_issue_on_windows_v5.4' into 'release/v5.4'
fix(bt): fix BLE log compression build on Windows (5.4)

See merge request espressif/esp-idf!51244
2026-08-03 11:31:06 +08:00
Island 102d8c1141 Merge branch 'feat/update_mesh_lib_to_supported_get_lib_ver_v5.4' into 'release/v5.4'
Feat/update mesh lib to supported get lib ver (5.4)

See merge request espressif/esp-idf!51171
2026-08-03 11:30:27 +08:00
Martin Vychodil 102a347903 Merge branch 'bugfix/idfci-12815-12072-timeout_v5.4' into 'release/v5.4'
fix(storage): mark storage pytest apps flaky in CI (v5.4)

See merge request espressif/esp-idf!51338
2026-08-02 16:40:10 +08:00
Abhik Roy 6625eb9e44 docs(lwip): document LWIP_DNS_MAX_HOST_IP range and addr_cnt usage
The DNS buffer overflow fix (esp-lwip@6233a1561) is already included in
release/v5.4 via 882843dbf8. This commit only adds Kconfig documentation
for the DNS_MAX_HOST_IP range and addr_cnt API contract.
2026-07-31 21:21:50 +10:00
sonika.rathi bdeb413603 fix(storage): mark storage pytest apps flaky in CI 2026-07-31 08:55:18 +02:00
Akshat Agrawal b08c5f7a22 fix(nan): Fix bug bounty reported and discovered vulnerabilities in NAN Rx 2026-07-31 11:38:48 +05:30
Island ffc7e0dd66 Merge branch 'fix/fix_some_ble_sleep_issues_v5.4' into 'release/v5.4'
Fix/fix some ble sleep issues (5.4)

See merge request espressif/esp-idf!51317
2026-07-31 11:10:02 +08:00
harshal.patil 6618558e7b refactor(esp_system): deduplicate ROM fast wake RTC digest reservation
The digest length and the condition that reserves it at the end of RTC RAM were
duplicated in seven places. Hold the reservation in a hidden Kconfig value that
is zero when the feature does not apply, so every consumer subtracts it
unconditionally, and derive ESP_SECURE_BOOT_DIGEST_LEN from it.
2026-07-31 11:05:47 +08:00
hejiaxin 3552cb670a fix(bt_stack): Fix some critical bugs in classic_bt stack
related: obex, smp, pbap, sdp, rfcomm, stack_dm

- Deinit function doesn't delete connection when OBEX_DYNAMIC_MEMORY is on
- Union tGOEPC_DATA sometimes is free by osi_free in some cases when it contains mtu_id
- Add correct free and return solution after fail
- Fix symbol mistake in mod calculation
- Fix pointer-related UAF problems and memory free problems
- Fix buffer overflows and out-of-bounds access
- Fix infinite loops triggered by integer overflow wraparound
- Fix double free
- Change layer_specific usage to avoid heap overflow
- Add some NULL check for pointers
- Fix sdp_db free function
- Fix state table mismatch
2026-07-31 10:46:31 +08:00
Luo XuandWang Mengyang 6d21650c9c fix(bt): Fixed build error on array-bounds in HFP AG
(cherry picked from commit bbd20cae01)

Co-authored-by: Wang Mengyang <wangmengyang@espressif.com>
2026-07-31 00:04:50 +08:00
Rahul Tank 4f16f3d939 Merge branch 'bugfix/fix_pawr_conn_event_v5.4' into 'release/v5.4'
fix(nimble):  Deliver PAwR peripheral CONNECT via sync callback (v5.4)

See merge request espressif/esp-idf!51255
2026-07-30 20:40:27 +05:30