ESP32-S2 disables the brownout detector before deep sleep; if sleep is
rejected, re-init it so BOD is not left disabled (PM-519).
Co-authored-by: Cursor <cursoragent@cursor.com>
Fix DTM TX buffer leak in the BLE controller that could cause memory exhaustion and Interrupt WDT timeout during or after DTM TX tests. (5.4)
See merge request espressif/esp-idf!52613
Just a build issue fix depending on GCC5+ configuration, fixes:
assignment discards 'const' qualifier from pointer target type [-Werror=discarded-qualifiers]
return discards 'const' qualifier from pointer target type [-Werror=discarded-qualifiers]
Signed-off-by: Richard Allen <richard@bryghtlabs.com>
In H2E (Hash-to-Element) mode, sae_parse_commit() parses the optional
Anti-Clogging Token Container by calling sae_parse_token_container().
However, callers of sae_parse_commit() that do not require retrieving
the anti-clogging token (such as PASN initiator/responder and SME auth)
pass NULL for the token and token_len output arguments.
If the peer sends a Commit frame containing a valid Anti-Clogging
Token Container element, sae_parse_token_container() unconditionally
sets *token and *token_len, resulting in a NULL pointer dereference
(SIGSEGV) and crashing wpa_supplicant.
Fix this by adding NULL checks before writing to token and token_len.
Update the debug log to print the token directly using 'pos'.
Fixes: 5e32fb0170f4 ("SAE: Use Anti-Clogging Token Container element with H2E")
Signed-off-by: Amarnath Hullur Subramanyam <amarnathhs@google.com>
When wpa_supplicant was processing EAPOL-Key msg 1/4 with a PMKID
indicated by the AP/Authenticator, a PMKSA for the same AA was accepted
without enforcing matching network_ctx (i.e., same network configuration
block) and AKMP. This could allow misbehaving APs to make wpa_supplicant
use an unacceptable PMKSA entry that was generated for a different
network for AKMP under certain conditions. This could result in showing
a connection to an incorrect network when an attacker has credentials to
one network in wpa_supplicant configuration, but not to another network.
Fix this by accepting the PMKID to set the PMKSA for an association only
if the PMKSA with the same PMKID is for the same network and was
generated using the same AKMP.
Signed-off-by: Jouni Malinen <jouni.malinen@oss.qualcomm.com>
These per-event traces fire on every async dispatch and flood BT logs
without aiding diagnosis; higher-layer traces remain for debugging.
(cherry picked from commit b9b9b8633f)
Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
When the bond list is full, drop the oldest disconnected device instead
of the oldest NVS entry, and allow a per-bond except flag so selected
devices are never auto-removed.
(cherry picked from commit bf86892eef)
Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
Restore GATT_NO_RESOURCES when sequential attributes have differing UUID
sizes so gatts_process_find_info() stops building the response PDU.
(cherry picked from commit 196cb39545)
Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
Add smp_repairing_is_allowed() behind BT_BLE_SMP_HARDENED_REPAIRING so a
peer cannot replace an existing bond with one that has less MITM
protection, no Secure Connections, or a shorter key. Compare a preceding
Security Request against the pairing command AuthReq, not the
association-model result, and always allow first pairing.
A refusal keeps the stored bond. Pairing-failure erase is split by link
role: default is erase as Central and keep as Peripheral.
Closes BLERP (NDSS 2026) V3, V4 and V6.
(cherry picked from commit 88ea45be73)
Co-authored-by: zhiweijian <zhiweijian@espressif.com>
Keep the existing bond until the new pairing is encrypted, and on encryption
failure drop the link instead of clearing keys. Recovering from a peer that
really deleted the bond is opt-in through BT_BLE_SMP_UNBOND_ON_KEY_MISSING.
Closes BLERP (NDSS 2026) V5, and stops an unauthenticated Pairing Request
from dropping the stored keys (V2 exploitation).
(cherry picked from commit f864615d7d)
Co-authored-by: zhiweijian <zhiweijian@espressif.com>
