When a loop is deleted while an internal legacy "cleanup" event is still
queued (posted by a deferred self-unregistration from within a handler),
esp_event_loop_delete() drained the queue but only freed the post payload,
leaking the heap copy of the handler context allocated for the legacy path.
Free ctx->handler_ctx for queued legacy cleanup events while draining the
queue, mirroring the cleanup done in esp_event_loop_run().
Add a regression test that leaves a legacy cleanup event queued and asserts
no memory is leaked on loop deletion.
When esp_event_loop_run() exited via the ticks-expired break path,
loop->running_task was left pointing to the current task handle.
Any subsequent trylock in esp_event_handler_unregister_with_internal()
would see a stale non-NULL running_task and take the wrong code path.
esp_event_post_to() could access loop->queue / loop->mutex after
esp_event_loop_delete() freed them when both ran concurrently.
Introduce esp_event_loop_state_t with:
- posts_in_flight: reference-count incremented atomically (under
state.lock spinlock) before touching any loop resources, decremented
on every exit path via goto on_err.
- deleting: atomic_bool set by esp_event_loop_delete() to block new
posts from entering the critical section.
esp_event_loop_delete() sets deleting=true, then busy-waits (releasing
and re-acquiring loop->mutex each tick) until posts_in_flight reaches
zero before proceeding with teardown.
esp_event_isr_post_to() performs a lock-free atomic_load of deleting as
a best-effort guard; ISR context cannot participate in the spinlock
protocol but the window is documented and accepted.
After processing an esp_event_handler_cleanup sentinel, execution fell
through into the regular dispatch block. Every loop-level (ANY_BASE/
ANY_ID) handler was invoked with base="cleanup" and event_data pointing
at the internal esp_event_remove_handler_context_t struct.
Consequences:
- Information disclosure: internal handler addresses and loop instance
pointer are exposed to every loop-level handler.
- UAF: if a handler stores event_data for later use, post_instance_delete
frees the ctx, turning the stored pointer into a dangling reference.
- Logic corruption: handlers that switch on base with a default branch
misbehave on every unregister anywhere in the system.
Fix: wrap the regular dispatch block in an else clause so it is skipped
entirely for cleanup events. post_instance_delete, ticks accounting, and
xSemaphoreGiveRecursive remain in the shared tail executed for both paths.
Closes SEC_221
1) loop->mutex is created with xSemaphoreCreateRecursiveMutex(). FreeRTOS
requires that recursive mutexes are only acquired and released with
xSemaphoreTakeRecursive / xSemaphoreGiveRecursive.
esp_event_handler_unregister_with_internal() used the non-recursive
xSemaphoreTake(loop->mutex, 0) / xSemaphoreGive(loop->mutex) in the fast
path. The non-recursive Take bypasses uxRecursiveCallCount bookkeeping;
if the same task subsequently takes the mutex recursively (e.g. re-entry
from a handler or a follow-up register), the call count drifts. The
non-recursive Give then unconditionally drops the holder, allowing another
task to acquire the mutex while the original task still believes it holds
the lock — a full lock violation on the handler list leading to UAF and
potential RCE on attacker-driven event floods.
Fix: replace xSemaphoreTake/xSemaphoreGive with the Recursive variants in
the fast (try-take with timeout 0) path of unregister_with_internal.
2) avoid use-after-free when unregistering handler from a callback
The recursive try-lock introduced in SEC-220 succeeds re-entrantly when a
handler unregisters itself from within its own callback, causing the handler
node to be freed immediately while the dispatch loop still writes profiling
counters to it after the callback returns. Route the in-callback case to the
deferred cleanup path and only free directly once no dispatch is active.
Closes SEC_220
esp_event_is_handler_registered() walked loop_nodes, base_nodes, id_nodes
and handler lists with no lock held, then released an unowned mutex at the
'out:' label via xSemaphoreGive().
Concurrent register/unregister/delete operations can free handler nodes
during the unlocked walk (SLIST UAF). The xSemaphoreGive on an unowned
recursive mutex corrupts the recursive call-count of any task that
legitimately holds the mutex.
Fix:
- Take loop->mutex with xSemaphoreTakeRecursive before the traversal.
- Replace xSemaphoreGive at the 'out:' label with xSemaphoreGiveRecursive
so every exit path holds the mutex for exactly one balanced take/give.
Closes SEC_219
When PORT_RX_BUF_LOW_WM is too low, RFCOMM replenishes credits only
after receiving a relatively large number of packets, which may cause
the peer to exhaust its credits and enter a stop-and-wait state.
Increase the low watermark to replenish credits more promptly and
reduce the likelihood of the peer stalling while waiting for additional
credits.
The BLE log compression feature (CONFIG_BT_LOG_CRITICAL_ONLY ->
BLE_COMPRESSED_LOG_ENABLE) failed to build on Windows while working
correctly on Linux, due to two shell/platform-specific issues in the
compression script.
1. Module/source argument quoting. CMakeLists.txt passes the
semicolon-separated module and source lists wrapped in single quotes
("'${MODULES}'") to protect ';' from POSIX shells, which strip them.
cmd.exe does not treat single quotes as quoting characters, so on
Windows the quotes reached the script literally and
args.module.split(';') produced "'BLE_MESH" / "BLE_HOST'" instead of
the clean names. These never matched the YAML module keys, every
module was skipped ("Skipping module ... - config not found"), the
compressed sources were never generated, and the build failed. Strip
surrounding quote characters before splitting; this is a no-op on
Linux/macOS where the shell already removed them.
2. CRLF line endings. With core.autocrlf=true the IDF sources are
checked out as CRLF on Windows. The generated *_log_index.h macros
use backslash-newline line-continuation; a backslash followed by
'\r\n' is not a valid continuation in C, producing floods of syntax
errors when the header is compiled. Write generated headers with
newline='' to force LF, and normalize source content to LF right
after reading so '\r' embedded inside multi-line argument expressions
is also handled. Byte offsets stay consistent because both tree-sitter
parsing and tag replacement operate on the normalized content.
Verified by full clean builds of examples/bluetooth/esp_ble_mesh/
vendor_models/vendor_client (esp32c6, bluedroid + mesh) from both
cmd.exe and PowerShell; both produce an identical vendor_client.bin.
1. Added validation for password and reserved data length in ESPTouch v2
2. Added bound check for data index in ESPTouch v1 HT40
3. prevent buffer overflow when parsing MBSSID beacon
Move the following modules from the hal component into a new dedicated
esp_hal_debug_assist component, following the esp_hal_timg pattern:
- assist_debug (hal + target-specific LL headers)
- debug_probe (types + target-specific LL headers)
- riscv_trace (hal + types + source + target-specific LL headers)
- trace_ll (esp32/esp32s2/esp32s3 target-specific LL headers)
Update the following components to depend on esp_hal_debug_assist:
esp_system, riscv, bootloader_support, esp_hw_support, esp_riscv_trace
Remove riscv_trace_hal.c from the hal component.
heap_caps_calloc_base() calls heap_caps_malloc_base() from the same
translation unit (heap_caps_base.c). GNU ld --wrap only redirects
undefined references, so that intra-object call binds to the real
heap_caps_malloc_base and never enters __wrap_heap_caps_malloc_base.
As a result, allocations made through heap_caps_calloc() were never
recorded by heap tracing, silently hiding potentially large INTERNAL
leaks (e.g. mbedtls SSL buffers via MALLOC_CAP_INTERNAL).
Add heap_caps_calloc_base to the --wrap list and implement
__wrap_heap_caps_calloc_base, which records the allocation via a
noinline trace_calloc helper (mirroring trace_malloc so the recorded
call stack depth stays consistent) and calls __real_heap_caps_calloc_base.
The inner malloc_base call remains same-TU and unwrapped, so each
calloc produces exactly one trace record (no double counting).
The task dispatch method for the esp_timer could stall even if it is
armed if ther ISR dispatch alarm triggers close to the task dispatch.
This MR fixes a bug where the esp_timer cleared the incorrect cached
array timer index and subsequently the timer task is never woken up.
Closes https://github.com/espressif/esp-idf/issues/18808
Use dedicated encrypted runners so I2S tests cover the actual flash encryption data path.
This replaces coverage that only observed the virtual eFuse software state.
Co-authored-by: Cursor <cursoragent@cursor.com>
yi chen
Konstantin Kondrashov
Adam Múdry
Konstantin Kondrashov
Jin Cheng
Zhou Xiao
luoxu
Chen Ji Chang
zhangyanjiao
morris
Jiang Jiang Jian
Island
Fu Hanxi
Sudeep Mohanty
Erhan Kurubas
zhanghaipeng
Chen ChenandCursor
muhaidong
Marius Vikhammer
Mahavir Jain
Wang Meng Yang
cjin
Ma Jing Jing