The return value of on_color_trans_done ("whether a high priority task
has been waken up by this function", see esp_lcd_types.h) was discarded
by the SPI backend. A task unblocked from inside the callback (e.g. via
xSemaphoreGiveFromISR) therefore did not get scheduled until the next
FreeRTOS tick, adding up to 10 ms of latency per color transfer with the
default CONFIG_FREERTOS_HZ=100. The i80 backend already honors the
contract (need_yield -> portYIELD_FROM_ISR); do the same here.
The generated assembly emitted <name>_length immediately after the raw
payload bytes, so the 32-bit word landed misaligned whenever the data
size was not a multiple of 4. Consumers declare it as a 32-bit object
(e.g. `extern const size_t <name>_length` in the ULP firmware loaders),
so the compiler emits an alignment-assuming word load, which is a
misaligned flash read prone to spurious load faults on chips with
SOC_CPU_MISALIGNED_ACCESS_ON_PMP_MISMATCH_ISSUE (ESP32-C6/H2/H21).
The offset table and the per-cert length fields of the certificate
bundle were read through uint16_t*/uint32_t* casts, which compile to
halfword/word loads at addresses with no alignment guarantee: bundles
supplied via esp_crt_bundle_set() can start anywhere, and cert entries
are byte-packed, so their 16-bit fields land at arbitrary offsets.
On chips with SOC_CPU_MISALIGNED_ACCESS_ON_PMP_MISMATCH_ISSUE (DIG-694:
ESP32-C6/H2/H21) a misaligned load from memory-mapped flash can take a
spurious "Load access fault" when it sits within two instructions of an
access to a differently-permissioned region, observed as a crash in
esp_crt_check_bundle()/CA callback during TLS handshakes with a bundle
that happened to be placed at an odd address.
- Add sdp_seq to avoid p_ccb being free during sdp
- Changed some BTA_Pba functions to return non-void value
- Improve error catching and report
- Refactor bta_pba_client_response to avoid UAF problem
- Rearrange btc_pba_client init flag to avoid some disturbing bug
Add smp_repairing_is_allowed() behind BT_BLE_SMP_HARDENED_REPAIRING so a
peer cannot replace an existing bond with one that has less MITM
protection, no Secure Connections, or a shorter key. Compare a preceding
Security Request against the pairing command AuthReq, not the
association-model result, and always allow first pairing.
A refusal keeps the stored bond. Pairing-failure erase is split by link
role: default is erase as Central and keep as Peripheral.
Closes BLERP (NDSS 2026) V3, V4 and V6.
(cherry picked from commit 88ea45be73)
Co-authored-by: zhiweijian <zhiweijian@espressif.com>
Keep the existing bond until the new pairing is encrypted, and on encryption
failure drop the link instead of clearing keys. Recovering from a peer that
really deleted the bond is opt-in through BT_BLE_SMP_UNBOND_ON_KEY_MISSING.
Closes BLERP (NDSS 2026) V5, and stops an unauthenticated Pairing Request
from dropping the stored keys (V2 exploitation).
(cherry picked from commit f864615d7d)
Co-authored-by: zhiweijian <zhiweijian@espressif.com>
Do not reject osi_thread_post_event() when only POSTING is set.
QUEUED already prevents double-queueing; rejecting POSTING caused
HCI downstream lost wakeup. Add generic osi_event and hci downstream
diagnostics for post failures.
- Gate bta_sys_event() on both 'is_reg' and 'reg[id]' to prevent
stale event delivery.
- Defer bta_sys_deregister() to the end of profile disable handlers
to ensure pending DISABLE events are processed.
- Add disabling flag to HFP AG for tracking asynchronous teardown.
Island
morris
YoungsunLi
Alexey Gerenkov
Rahul Tank
Fu Hanxi
Mahavir Jain
wuzhenghui
Laukik Hase
Ashish Sharma
hejiaxin
Zhi Wei Jian
ShenWeilong
Shu Chen
Matteo Sandrin
yangfeng
liqigan
zhanghaipeng
Jin Cheng
Wang Meng Yang