Commit Graph
49220 Commits
Author SHA1 Message Date
Jimi Chen 9de31f008c SAE: Fix crash due to NULL pointer dereference in H2E parsing
In H2E (Hash-to-Element) mode, sae_parse_commit() parses the optional
Anti-Clogging Token Container by calling sae_parse_token_container().

However, callers of sae_parse_commit() that do not require retrieving
the anti-clogging token (such as PASN initiator/responder and SME auth)
pass NULL for the token and token_len output arguments.

If the peer sends a Commit frame containing a valid Anti-Clogging
Token Container element, sae_parse_token_container() unconditionally
sets *token and *token_len, resulting in a NULL pointer dereference
(SIGSEGV) and crashing wpa_supplicant.

Fix this by adding NULL checks before writing to token and token_len.
Update the debug log to print the token directly using 'pos'.

Fixes: 5e32fb0170f4 ("SAE: Use Anti-Clogging Token Container element with H2E")
Signed-off-by: Amarnath Hullur Subramanyam <amarnathhs@google.com>
2026-09-11 14:24:58 +08:00
Jouni Malinen 9c825298fc Require network_ctx and AKMP match for accepting PMKSA entry
When wpa_supplicant was processing EAPOL-Key msg 1/4 with a PMKID
indicated by the AP/Authenticator, a PMKSA for the same AA was accepted
without enforcing matching network_ctx (i.e., same network configuration
block) and AKMP. This could allow misbehaving APs to make wpa_supplicant
use an unacceptable PMKSA entry that was generated for a different
network for AKMP under certain conditions. This could result in showing
a connection to an incorrect network when an attacker has credentials to
one network in wpa_supplicant configuration, but not to another network.

Fix this by accepting the PMKID to set the PMKSA for an association only
if the PMKSA with the same PMKID is for the same network and was
generated using the same AKMP.

Signed-off-by: Jouni Malinen <jouni.malinen@oss.qualcomm.com>
2026-09-11 14:24:58 +08:00
Aditi 03b3e0217c feat(wpa_supplicant): Match SPA when searching PMKSA cache
Store the supplicant address (SPA) in PMKSA cache entries and match
it when looking up the PMKSA cache.

(partially picked from commit 18cbdbf2b1)
2026-09-11 14:24:58 +08:00
Jiang Jiang Jian d8b677db7e Merge branch 'bugfix/fix_softap_return_home_channel_failed_v5.5' into 'release/v5.5'
fix(scan): prioritize if1_conn check for home channel return logic and fix(wifi): fix wifi scan and wps connect issue v5.5

See merge request espressif/esp-idf!52674
2026-09-11 14:04:53 +08:00
Jiang Jiang Jian 538027f317 Merge branch 'riscv_panic_bp_fix_v5.5' into 'release/v5.5'
fix(esp_system/panic): ensure breakpoint set from panic handler gets hit afterwards (v5.5)

See merge request espressif/esp-idf!51829
2026-09-11 13:59:52 +08:00
Jiang Jiang Jian 7e04f11475 Merge branch 'feature/esp_timer_is_active_when_cb_is_running_v5.5' into 'release/v5.5'
feat(esp_timer): Adds blocking stop API (v5.5)

See merge request espressif/esp-idf!52241
2026-09-11 13:58:12 +08:00
Jiang Jiang Jian a3c9d8da81 Merge branch 'fix/dualcore_branch_predictor_cache_race_v5.5' into 'release/v5.5'
fix(spi_flash): disable branch prediction on the parked core during flash ops (v5.5)

See merge request espressif/esp-idf!52201
2026-09-11 12:16:45 +08:00
Jiang Jiang Jian dd1f19b654 Merge branch 'fix/esp-timer-restart-expiry-race_v5.5' into 'release/v5.5'
fix(esp_timer): prevent restart expiry race (v5.5)

See merge request espressif/esp-idf!51806
2026-09-11 12:14:42 +08:00
Jiang Jiang Jian a44050483b Merge branch 'fix/spi_buslock_unregister_issue_v5.5' into 'release/v5.5'
fix(hw_support): spi buslock fix unregister dev api issue (v5.5)

See merge request espressif/esp-idf!51473
2026-09-11 12:14:33 +08:00
Shu Chen daa6f6a7e5 Merge branch 'fix/openthread-udp-host-interface_v5.5' into 'release/v5.5'
fix(openthread): preserve host interface on UDP receive (v5.5)

See merge request espressif/esp-idf!52691
2026-09-11 03:41:18 +00:00
sibeibei 1381a2510a ci(wpa_supplicant): use large partition table for supplicant test app 2026-09-10 20:43:07 +08:00
Rahul Tank ecd654c861 Merge branch 'bugfix/hardware_error_assert_v5.5' into 'release/v5.5'
fix(nimble): Add hardware error event handling as normal event (v5.5)

See merge request espressif/esp-idf!52554
2026-09-10 17:12:24 +05:30
Jiang Jiang Jian 45d111a6aa Merge branch 'backport/h264_regdma_retention_v5.5' into 'release/v5.5'
feat(esp32p4): add H264 REGDMA link and sleep retention module (v5.5)

See merge request espressif/esp-idf!52666
2026-09-10 17:36:48 +08:00
zwx 9396199a22 fix(openthread): preserve host interface on UDP receive 2026-09-10 16:44:46 +08:00
Jiang Jiang Jian fc488e14d4 Merge branch 'fix/brownout_restore_after_deepsleep_reject_v5.5' into 'release/v5.5'
fix(esp_hw_support): restore brownout after deep sleep rejection on ESP32-S2 (v5.5)

See merge request espressif/esp-idf!52646
2026-09-10 15:55:10 +08:00
Jiang Jiang Jian e8669c03e7 Merge branch 'fix-ieee802154-teardown-order_v5.5' into 'release/v5.5'
ieee802154: Fix teardown order (v5.5)

See merge request espressif/esp-idf!52662
2026-09-10 15:53:59 +08:00
morris d126d086d0 Merge branch 'fix/mcpwm_cap_prescale_v5.5' into 'release/v5.5'
fix(mcpwm): correct the wrong capture prescale (v5.5)

See merge request espressif/esp-idf!52506
2026-09-10 14:46:53 +08:00
sibeibei d537815bb0 fix(scan): prioritize if1_conn check for home channel return logic 2026-09-10 12:25:05 +08:00
Jiang Jiang Jian f402ab1c18 Merge branch 'fix/fix_issues_when_support_multiple_phy_init_data_v5.5' into 'release/v5.5'
Fix/fix issues when support multiple phy init data v5.5(backport v5.5)

See merge request espressif/esp-idf!52586
2026-09-10 11:26:09 +08:00
Jiang Jiang Jian 28cef9e926 Merge branch 'fix/lp_core_rc_fast_delay_freq_v5.5' into 'release/v5.5'
fix(ulp): hardcode LP core RC_FAST frequency per target (v5.5)

See merge request espressif/esp-idf!52672
2026-09-10 11:07:43 +08:00
Jiang Jiang Jian a8e0939c4b Merge branch 'docs/mcpwm_deadtime_descrption_v5.5' into 'release/v5.5'
docs(mcpwm): add note for deadtime config (v5.5)

See merge request espressif/esp-idf!52641
2026-09-10 11:07:15 +08:00
Jiang Jiang Jian 175a1a582f Merge branch 'fix/esp32-ble-dtm-txbuf-leak_v5.5' into 'release/v5.5'
Fix DTM TX buffer leak in the BLE controller that could cause memory exhaustion and Interrupt WDT timeout during or after DTM TX tests. (5.5)

See merge request espressif/esp-idf!52614
2026-09-10 11:03:54 +08:00
Jiang Jiang Jian 593476dfb9 Merge branch 'contrib/github_pr_18818_v5.5' into 'release/v5.5'
fix(esp_http_client): fix parser wedge and dead error-classification branches on read timeout (GitHub PR) (v5.5)

See merge request espressif/esp-idf!52619
2026-09-10 11:00:57 +08:00
Jiang Jiang Jian ca1b526f67 Merge branch 'feat/opt_prefer_bond_device_when_evicting_overflow_bonds_v5.5' into 'release/v5.5'
fix(bt/bluedroid): prefer disconnected peers when evicting overflow bonds (5.5)

See merge request espressif/esp-idf!52609
2026-09-10 11:00:18 +08:00
Jiang Jiang Jian f23060d30c Merge branch 'bugfix/spp_deinit_fail_v5.5' into 'release/v5.5'
fix(bt/bluedroid): fixed JV disable event has no handler in Bluedroid (v5.5)

See merge request espressif/esp-idf!52595
2026-09-10 10:57:42 +08:00
Jiang Jiang Jian 1f1ed91bf7 Merge branch 'fix/ecdsa_hmac_ds_locking_v5.5' into 'release/v5.5'
fix(esp_security): Stop ECDSA and Key Manager resets from corrupting concurrent crypto (v5.5)

See merge request espressif/esp-idf!52579
2026-09-10 10:56:28 +08:00
Jiang Jiang Jian 8c7be0ba6e Merge branch 'feat/support_fixed_ampdu_rate_v5.5' into 'release/v5.5'
feat/support fixed ampdu rate v5.5(backport v5.5)

See merge request espressif/esp-idf!52535
2026-09-10 10:54:40 +08:00
Jiang Jiang Jian 14f7f76572 Merge branch 'fix/resolve_issues_reported_via_bbp_v5.5' into 'release/v5.5'
fix(openthread): fix null pointer deref, uninitialized struct, and unbounded strcpy in spinel/RCP code (v5.5)

See merge request espressif/esp-idf!51375
2026-09-10 10:52:24 +08:00
Jiang Jiang Jian a276ed9440 Merge branch 'feat/ble_smp_repairing_hardening_v5.5' into 'release/v5.5'
feat(ble/bluedroid): add Kconfig options for BLE re-pairing hardening (5.5)

See merge request espressif/esp-idf!52420
2026-09-10 10:51:24 +08:00
Jiang Jiang Jian ec6877d459 Merge branch 'fix/fxied_wrong_h2_ble_lib_issue_v5.5' into 'release/v5.5'
fix(ble): Check if there are illegal library files in controller lib path (5.5)

See merge request espressif/esp-idf!52190
2026-09-10 10:47:04 +08:00
Konstantin Kondrashov 0382b59e21 feat(esp_timer): Adds blocking stop function 2026-09-10 10:45:24 +08:00
Konstantin Kondrashov db31a63351 refactor(esp_timer): Remove unnecessary nested list lock 2026-09-10 10:45:24 +08:00
Konstantin Kondrashov 581b967a59 feat(esp_timer): esp_timer_is_active while callback is running 2026-09-10 10:45:24 +08:00
wuzhenghui 3631cf2537 fix(spi_flash): integrate branch prediction control during cache operations 2026-09-10 10:45:03 +08:00
Ashish Sharma 8996d1aef0 fix(spi_flash): disable branch prediction on the parked core during flash ops 2026-09-10 10:45:03 +08:00
Jiang Jiang Jian e9986e0e0c Merge branch 'bugfix/fix_bluedroid_find_info_format_mismatch_v5.5' into 'release/v5.5'
fix(ble/bluedroid): restore find info PDU stop on UUID format mismatch (5.5)

See merge request espressif/esp-idf!52079
2026-09-10 10:44:16 +08:00
Jiang Jiang Jian 91917c67e2 Merge branch 'feat/bt_osal_build_configurable_v5.5' into 'release/v5.5'
feat(bt): Add Kconfig option to build the BT OSAL conditionally (5.5)

See merge request espressif/esp-idf!51515
2026-09-10 10:39:48 +08:00
Jiang Jiang Jian 2fe571159c Merge branch 'fix/mmap_cache_flash_wr_v5.5' into 'release/v5.5'
fix(mmap): fixed mmap read data wrong when flash being erased/written and cache not disabled (v5.5)

See merge request espressif/esp-idf!50144
2026-09-10 10:39:35 +08:00
Jiang Jiang Jian 28eb1cb54b Merge branch 'fix/heap-trace-calloc_v5.5' into 'release/v5.5'
fix(heap): trace heap_caps_calloc allocations in standalone heap tracing (v5.5)

See merge request espressif/esp-idf!51052
2026-09-10 10:39:15 +08:00
Samuel Obuch 3f4b304719 fix(esp_system/panic): ensure breakpoint set from panic handler gets hit afterwards 2026-09-10 10:38:51 +08:00
Jiang Jiang Jian 93ba4e6fd5 Merge branch 'idf/ble_mesh_iv_recover_v5.5' into 'release/v5.5'
feat(ble_mesh): Enable IV Index recovery by default (5.5)

See merge request espressif/esp-idf!51971
2026-09-10 10:38:02 +08:00
wanckl 876f607703 fix(driver_spi): slave hd append fix wrong dma param 2026-09-10 10:36:37 +08:00
Eric Wang 6c1f0e7b59 fix(driver_spi): avoid NULL memcpy when private DMA buffer setup fails
Closes https://github.com/espressif/esp-idf/pull/18898
2026-09-10 10:36:37 +08:00
wanckl 3b833a1184 fix(hw_support): spi buslock fix unregister dev api issue 2026-09-10 10:36:37 +08:00
Jiang Jiang Jian db93793288 Merge branch 'fix/lp_core_gpio_wakeup_v5.5' into 'release/v5.5'
fix(ulp): wake pin wakes ESP32-P4 from deep sleep on P4 (v5.5)

See merge request espressif/esp-idf!50995
2026-09-10 10:33:11 +08:00
yinqingzhao 52aad1e1f3 feat(wifi): support disable dfs channels in apsta example 2026-09-10 10:09:54 +08:00
yinqingzhao 5511e8730f feat(wifi): support fixed ampdu rate 2026-09-10 10:09:41 +08:00
Marius Vikhammer dea7ed2b38 fix(ulp): hardcode LP core RC_FAST frequency per target
The SoC RC_FAST approximation is a nominal figure that can be off by ~10%
from the clock the LP core actually runs at, which made
ulp_lp_core_delay_us() over-delay by up to 9% and the LP core delay test
flake on ESP32-C5 and ESP32-C6.

Use a measured per-target value instead, and fail the build for targets
that have no measured value so that new chips cannot silently inherit a
wrong one.
2026-09-10 09:24:26 +08:00
Jiang Jiang Jian 69d02a9f0e Merge branch 'bugfix/fix_disconnect_failure_issue_v5.5' into 'release/v5.5'
fix(wifi): fix disconnect failure issue(Backport v5.5)

See merge request espressif/esp-idf!52536
2026-09-09 20:42:00 +08:00
muhaidong 25b1862d73 fix(wifi): fix disconnect failure issue 2026-09-09 19:36:52 +08:00