Zhi Wei Jian
b5dfde1c9e
feat(ble/bluedroid): Support PAWR connection event
...
(cherry picked from commit 7da7fa42ac )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-08-03 15:25:46 +08:00
Jin Cheng
b19ab411cb
fix(bt/bluedroid): fixed issues from AI review in GAP, SPP, HID, L2CAP and HCI
2026-07-23 07:52:39 +08:00
Jiang Jiang Jian
1e96e00456
Merge branch 'bugfix/avrc_ca_attr_id_check_v5.4' into 'release/v5.4'
...
fix(bt): Fix the validation of AVRCP metadata attr_id in handle_rc_attributes_rsp (v5.4)
See merge request espressif/esp-idf!50552
2026-07-20 11:36:03 +08:00
Wang Meng Yang
591ea73bfb
Merge branch 'bugfix/bug_bounty_av_v5.4' into 'release/v5.4'
...
fix(bt/bluedroid): Fix bug bounty issues about A/V from NVIDIA (v5.4)
See merge request espressif/esp-idf!50479
2026-07-19 10:25:16 +08:00
Wang Meng Yang
a2e4ad5602
Merge branch 'bugfix/fix_bredr_inq_crash_v5.4' into 'release/v5.4'
...
fix(bt/bluedroid): fix crash during bredr inquiry when zero-addr device is found (v5.4)
See merge request espressif/esp-idf!50856
2026-07-19 10:06:49 +08:00
yangfeng
6c7135e869
fix(bt): Fix the validation of AVRCP metadata attr_id in handle_rc_attributes_rsp
2026-07-17 20:11:41 +08:00
Wang Meng Yang
8063006d12
Merge branch 'bugfix/smp_sec_flags_v5.4' into 'release/v5.4'
...
fix(bt/bluedroid): fixed several security issues from NVIDIA (v5.4)
See merge request espressif/esp-idf!50568
2026-07-17 20:10:02 +08:00
linruihao
1c2eb36135
fix(bt/bluedroid): fix crash during bredr inquiry when zero-addr device is found
2026-07-17 10:39:30 +08:00
Island
a1f767668c
Merge branch 'bugfix/fix_bluedroid_read_multi_v5.4' into 'release/v5.4'
...
fix(ble/bluedroid): fix GATT Read Multiple response handling (5.4)
See merge request espressif/esp-idf!50707
2026-07-15 15:38:55 +08:00
Zhi Wei Jian
0532d07a86
feat(ble/bluedroid): Support bluedroid dual identity
...
(cherry picked from commit 2358786647 )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-07-14 14:22:39 +08:00
Zhi Wei Jian
7a80e9b127
fix(ble/bluedroid): use BOOLEAN for BLE HCI command builders
...
(cherry picked from commit abbf001120 )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-07-14 12:04:10 +08:00
Zhi Wei Jian
00960a5dac
fix(ble/bluedroid): clean up LE CoC connect on CCB alloc failure
...
(cherry picked from commit 4fd1ebb4a9 )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-07-14 12:04:09 +08:00
Zhi Wei Jian
3deee8d3e2
docs(ble/bluedroid): note ISO BIG HCI alloc failure not checked
...
(cherry picked from commit 34b59d30ae )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-07-14 12:04:08 +08:00
Zhi Wei Jian
e2735b1bb5
fix(ble/bluedroid): fix direct-connect cleanup and adv bounds
...
(cherry picked from commit 82e71c1767 )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-07-14 12:04:08 +08:00
Zhi Wei Jian
1330f558e1
fix(ble/bluedroid): validate BLE confirm/OOB and sec-check device
...
(cherry picked from commit 93ab11d564 )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-07-14 12:04:07 +08:00
Zhi Wei Jian
fab68dc82f
fix(ble/bluedroid): validate SMP pair-fail reason and OOB device
...
(cherry picked from commit 98efe02385 )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-07-14 12:04:07 +08:00
Zhi Wei Jian
d2f755b735
fix(ble/bluedroid): route ATT indication-conf timeout separately
...
(cherry picked from commit 6c3267ee84 )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-07-14 12:04:07 +08:00
Zhi Wei Jian
12b6beff43
fix(ble/bluedroid): validate ATT PDU sizes
...
(cherry picked from commit bb00b9817d )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-07-14 12:04:06 +08:00
Zhi Wei Jian
7637a46169
fix(ble/bluedroid): re-lookup GATT TCB after enc-complete callback
...
(cherry picked from commit 37562af0ea )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-07-14 12:04:06 +08:00
Zhi Wei Jian
b7fde3a96c
fix(ble/bluedroid): fix GATT long read and Service Changed CCC
...
(cherry picked from commit 4ce692ac0c )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-07-14 12:04:05 +08:00
Zhi Wei Jian
0b515686dd
fix(ble/bluedroid): validate GATT client discovery handles
...
(cherry picked from commit ac35ae6f2d )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-07-14 12:04:05 +08:00
Zhi Wei Jian
b0e64dbbd5
fix(ble/bluedroid): cap Read By Type length and free failed service decl
...
(cherry picked from commit 27ff0cf8c7 )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-07-14 12:04:05 +08:00
Zhi Wei Jian
af043ccffa
fix(ble/bluedroid): guard GATT database hash and serialization
...
(cherry picked from commit 995c1508e8 )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-07-14 12:04:04 +08:00
Zhi Wei Jian
c48e5a30e9
fix(ble/bluedroid): fix GATT server busy errors and sr_cmd handling
...
(cherry picked from commit f86739b03d )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-07-14 12:04:04 +08:00
Zhi Wei Jian
e7f6bf115e
fix(ble/bluedroid): fix GATT teardown and service-change flow
...
(cherry picked from commit 0645ba469d )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-07-14 12:04:04 +08:00
Zhi Wei Jian
a9c2816caf
fix(ble/bluedroid): fix GATT service lifecycle leaks
...
(cherry picked from commit ac93d94958 )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-07-14 12:04:03 +08:00
Zhi Wei Jian
de2578d083
fix(ble/bluedroid): add GATT resource-cleanup helpers
...
(cherry picked from commit b83327f3ca )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-07-14 12:03:58 +08:00
Zhi Wei Jian
95bd892dba
feat(ble/bluedroid): Support bluedroid LE COC and EATT features
...
(cherry picked from commit 83f0831c53 )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-07-14 11:56:02 +08:00
Zhang Hai Peng
f84d0bb8eb
fix(ble/bluedroid): downgrade numeric comparison log to warning
...
(cherry picked from commit 72a49ed53b )
Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com >
2026-07-14 10:37:09 +08:00
Zhang Hai Peng
a817312106
fix(ble/bluedroid): preserve ext adv state when set params fails
...
Only update extend_adv_cb after HCI Set Extended Advertising
Parameters succeeds, so a failed update does not corrupt cached
legacy_pdu and related fields used by adv data validation.
(cherry picked from commit 31bd80fee8 )
Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com >
2026-07-14 10:37:08 +08:00
Zhang Hai Peng
8b7b4e73f5
fix(ble/bluedroid): reject invalid ATT error code 0x00 on client
...
Map received error reason 0x00 to GATT_UNKNOWN_ERROR so the client
does not report GATT_SUCCESS with zero-length data on malformed errors.
(cherry picked from commit 1b6f9380f4 )
Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com >
2026-07-14 10:36:13 +08:00
Zhang Hai Peng
bb2610b445
fix(ble/bluedroid): use sr_cmd status for GATT server error rsp
...
When sending an ATT error response after a failed server operation,
use p_tcb->sr_cmd.status instead of the last app callback status so
invalid error code 0x00 is not sent to the peer.
(cherry picked from commit 4c0488d92a )
Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com >
2026-07-14 10:36:12 +08:00
Zhang Hai Peng
b56947d28e
fix(ble/bluedroid): match read-multiple-var responses by handle
...
(cherry picked from commit 979c7dc567 )
Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com >
2026-07-14 10:36:11 +08:00
Zhang Hai Peng
21159c5826
fix(ble/bluedroid): match read-multiple responses by handle
...
Read Multiple may mix stack auto-responses with app async responses,
so multi_rsp_q order can differ from the request handle order. Look up
each response by handle (with occurrence for duplicates) instead of
walking the queue by index, and treat opcode-only buffers as empty.
(cherry picked from commit f91a41510c )
Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com >
2026-07-14 10:36:10 +08:00
Jin Cheng
5ba5b3bc0b
fix(bt/bluedroid): fixed stuck sec_state on authention HCI command send failure
...
Closes SEC-1164
2026-07-09 17:14:03 +08:00
Jin Cheng
b6d199ea34
fix(bt/bluedroid): fixed NULL dereference in remote legacy authentication handler
...
Closes SEC-1143
2026-07-09 17:14:02 +08:00
Jin Cheng
eb31ebd509
fix(bt/bluedroid): fixed wrong link key flag cleared on legacy BR/EDR authentication failure
...
Stale bond trust state cound remain after authenticaion failure, causing
incorrect bond status and link key auto-reply behavior.
Closes SEC-1153
2026-07-09 17:14:02 +08:00
yangfeng
110f766ef1
fix(bt/bluedroid): Fix unchecked p_ctrl_cback and p_msg_cback in AVRC
...
Closes SEC-1186
2026-07-08 15:20:19 +08:00
yangfeng
6964180fb1
fix(bt/bluedroid): Fix missing NULL check on p_cfg in AVDT_ReconfigReq
...
Closes SEC-1187
2026-07-08 15:20:19 +08:00
Wang Meng Yang
36e78269b8
Merge branch 'bugfix/bbp_issues_v5.4' into 'release/v5.4'
...
Bugfix/bbp issues v5.4
See merge request espressif/esp-idf!50191
2026-07-06 11:16:44 +08:00
Wang Meng Yang
1ce3dfb50c
Merge branch 'bugfix/ai_review_btu_common_v5.4' into 'release/v5.4'
...
fix: Fix the critical issues of btu and bt_common from AI review report (v5.4)
See merge request espressif/esp-idf!50124
2026-06-30 19:24:27 +08:00
Wang Meng Yang
d3d0963239
Merge branch 'bugfix/ai_review_a2dp_v5.4' into 'release/v5.4'
...
fix(bt): Fix the critical issues related to A2DP from AI review report (v5.4)
See merge request espressif/esp-idf!50130
2026-06-30 19:23:54 +08:00
Jin Cheng
66be8af7ee
fix(bt/bluedroid): fixed possible OOB read/write in process_l2cap_cmd
2026-06-30 15:10:44 +08:00
Island
416cd10dd5
Merge branch 'bugfix/fix_bluedroid_static_random_conn_rpa_v5.4' into 'release/v5.4'
...
fix(ble/bluedroid): skip identity conversion for static random direct connect (5.4)
See merge request espressif/esp-idf!50083
2026-06-30 10:24:53 +08:00
yangfeng
f164a75569
fix(bt): Fix the critical issues related to A2DP from AI review report
...
AVDT:
- Roll back CCB allocation when cmd/rsp queue creation fails
- Free media packet on invalid handle in AVDT_WriteReqOpt
- Zero-init timeout failure message before GETCAP callback
- Initialize lcid_tbl to 0xFF to avoid mapping to tc_tbl[0]
BTA/AVRCP:
- Use size_t for AVRC message copy buffer allocation
- Allocate before register in BTA_AvEnable
- Guard BTA_AvRegister callback when enable never completed
- Remove invalid free of inline Cover Art image_descriptor
A2DP BTC/API:
- Default g_a2dp_on_deinit to true before profile init
- Add shutdown state check in btc_a2dp_sink_shutdown
- Guard A2DP source timer against freed dynamic local param
2026-06-29 15:06:38 +08:00
yangfeng
3437c34c17
fix: Fix the critical issues of btu and bt_common from AI review report
...
- advance connect queue on synchronous connect_cb failure
- lock bta_alarm_hash_map in all BTA timer APIs
- free controller params after stack disable; cleanup on init fail
- handle BTE_InitStack failure and signal init future
- validate HCI remote name event length before parse
- drop stale L2CAP quick-timer alarm events
2026-06-29 14:49:19 +08:00
Zhi Wei Jian
1b340fe82b
feat(ble/bluedroid): add CS Security Requirements host support (Core 6.3)
...
(cherry picked from commit 919622c01c )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-06-26 20:37:44 +08:00
Zhi Wei Jian
aed8603a42
feat(ble/bluedroid): add LE UTP host support (Core 6.2)
...
(cherry picked from commit 3844e24207 )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-06-26 20:37:44 +08:00
Zhi Wei Jian and Cursor
661e297e87
feat(ble/bluedroid): add Shorter Connection Intervals host support (Core 6.2)
...
Co-authored-by: Cursor <cursoragent@cursor.com >
(cherry picked from commit 2a8a96d650 )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-06-26 20:37:44 +08:00
Zhi Wei Jian
c72a639097
feat(ble/bluedroid): add LL Extended Feature Set host support (Core 6.0)
...
(cherry picked from commit d568f2f151 )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-06-26 20:37:44 +08:00