- Add sdp_seq to avoid p_ccb being free during sdp
- Changed some BTA_Pba functions to return non-void value
- Improve error catching and report
- Refactor bta_pba_client_response to avoid UAF problem
- Rearrange btc_pba_client init flag to avoid some disturbing bug
Add smp_repairing_is_allowed() behind BT_BLE_SMP_HARDENED_REPAIRING so a
peer cannot replace an existing bond with one that has less MITM
protection, no Secure Connections, or a shorter key. Compare a preceding
Security Request against the pairing command AuthReq, not the
association-model result, and always allow first pairing.
A refusal keeps the stored bond. Pairing-failure erase is split by link
role: default is erase as Central and keep as Peripheral.
Closes BLERP (NDSS 2026) V3, V4 and V6.
(cherry picked from commit 88ea45be73)
Co-authored-by: zhiweijian <zhiweijian@espressif.com>
Keep the existing bond until the new pairing is encrypted, and on encryption
failure drop the link instead of clearing keys. Recovering from a peer that
really deleted the bond is opt-in through BT_BLE_SMP_UNBOND_ON_KEY_MISSING.
Closes BLERP (NDSS 2026) V5, and stops an unauthenticated Pairing Request
from dropping the stored keys (V2 exploitation).
(cherry picked from commit f864615d7d)
Co-authored-by: zhiweijian <zhiweijian@espressif.com>
Do not reject osi_thread_post_event() when only POSTING is set.
QUEUED already prevents double-queueing; rejecting POSTING caused
HCI downstream lost wakeup. Add generic osi_event and hci downstream
diagnostics for post failures.
- Gate bta_sys_event() on both 'is_reg' and 'reg[id]' to prevent
stale event delivery.
- Defer bta_sys_deregister() to the end of profile disable handlers
to ensure pending DISABLE events are processed.
- Add disabling flag to HFP AG for tracking asynchronous teardown.
Sort bond entries by bond_count after in-place updates to maintain correct
eviction order, and log IRK resolving-list failures instead of failing the bond.
- Add bt_osal: event queues, mutexes, semaphores, callouts, etc.
- Add the shared BLE profile task and event queue
- Bring both up and tear them down in the host init/deinit paths
- Add unit tests for the OSAL and the profile task
Co-authored-by: Cursor <cursoragent@cursor.com>
Restore GATT_NO_RESOURCES when sequential attributes have differing UUID
sizes so gatts_process_find_info() stops building the response PDU.
(cherry picked from commit 196cb39545)
Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
- fixed IntegerDividedByZero during Qos negotiation.
Closes https://github.com/espressif/esp-idf/issues/18951
- ignored the check for bandwidth and retransmission effort when Host
accepts the SCO connection request.
Bool symbols in nimble, BTDM, and two examples used invalid default
literals. The parser already falls back to 'n'; set that explicitly.
Co-authored-by: Cursor <cursoragent@cursor.com>
