Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-09-22 13:01:16 +03:00
Code Issues Packages Projects Releases Wiki Activity
46,070 Commits 25 Branches 192 Tags
c4f905e508d3350de1ca1d29737098970abcd6a3
Commit Graph

685 Commits

Author SHA1 Message Date
Island
b65487a0c3 Merge branch 'feat/ble_smp_repairing_hardening_v5.4' into 'release/v5.4' 
feat(ble/bluedroid): add Kconfig options for BLE re-pairing hardening (5.4)

See merge request espressif/esp-idf!52419
 2026-09-15 14:12:10 +08:00
Zhang Hai Peng
c79c6c437f fix(ble/bluedroid): restore find info PDU stop on UUID format mismatch 
Restore GATT_NO_RESOURCES when sequential attributes have differing UUID
sizes so gatts_process_find_info() stops building the response PDU.


(cherry picked from commit 196cb39545)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
 2026-09-07 20:37:53 +08:00
Zhi Wei Jian
5fac3377f3 feat(ble/bluedroid): reject LE re-pairing that weakens an existing bond 
Add smp_repairing_is_allowed() behind BT_BLE_SMP_HARDENED_REPAIRING so a
peer cannot replace an existing bond with one that has less MITM
protection, no Secure Connections, or a shorter key. Compare a preceding
Security Request against the pairing command AuthReq, not the
association-model result, and always allow first pairing.

A refusal keeps the stored bond. Pairing-failure erase is split by link
role: default is erase as Central and keep as Peripheral.

Closes BLERP (NDSS 2026) V3, V4 and V6.


(cherry picked from commit 88ea45be73)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-09-07 19:18:28 +08:00
Zhi Wei Jian
734e55fcbf fix(ble/bluedroid): harden LE bond handling across encryption 
Keep the existing bond until the new pairing is encrypted, and on encryption
failure drop the link instead of clearing keys. Recovering from a peer that
really deleted the bond is opt-in through BT_BLE_SMP_UNBOND_ON_KEY_MISSING.

Closes BLERP (NDSS 2026) V5, and stops an unauthenticated Pairing Request
from dropping the stored keys (V2 exploitation).


(cherry picked from commit f864615d7d)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-09-07 19:18:28 +08:00
hejiaxin
395f5d9404 fix(bt_obex): fix some bugs in bluedroid obex 
- fix goepc wait state switch
- fix psm unbind's mismatch
- fix some resources leak
- fix goep connection's incorrect ternimation when congesting
- Add some NULL ptr check
 2026-09-02 14:30:43 +08:00
hejiaxin
49bac9fbbf fix(bt_avrcp): size some AVRC command buffers 2026-09-01 11:24:18 +08:00
hejiaxin
8ac6aa8aa0 fix(bt_l2cap): size L2CAP ERTM S-frame & RX SDU buffer 2026-09-01 11:24:18 +08:00
hejiaxin
b08f145416 fix(bt_sdp): size SDP TX buffers 2026-09-01 11:24:18 +08:00
hejiaxin
1995bfcb4d fix(bt_rfcomm): size RFCOMM TX buffers by peer MTU 2026-09-01 11:24:18 +08:00
hejiaxin
5036f97cb8 fix(bt_hid): size HID TX buffers to report length 2026-09-01 11:24:17 +08:00
Wang Meng Yang
077bb9ec72 Merge branch 'change/refactor_hidh_datapath_v5.4' into 'release/v5.4' 
Change/refactor hidh datapath[backport v5.4]

See merge request espressif/esp-idf!51281
 2026-08-28 08:55:03 +08:00
yangfeng
37d751375c fix(bt): do not cap AVDTP Discover results by local SEP count 
- Closes https://github.com/espressif/esp-idf/issues/18848
 2026-08-24 19:13:43 +08:00
liqigan
e590b1c8eb change(bt/bluedroid): Refactored HCI ACL datapath 2026-08-24 14:19:05 +08:00
yangfeng
b3370110a6 fix(bluedroid): Fix the compilation issue of BCM_STRNCPY_S 2026-08-17 09:54:33 +08:00
Jiang Jiang Jian
8f810bd44c Merge branch 'feat/support_pawr_connect_evt_v5.4' into 'release/v5.4' 
feat(ble/bluedroid): Support PAWR connection event (5.4)

See merge request espressif/esp-idf!51440
 2026-08-06 11:25:37 +08:00
hejiaxin
7c48812de9 feat(bluedroid): Add config to place btu and hci task stack in psram 
- Also adjust the osi_thread_stop implementation.
 2026-08-04 14:56:04 +08:00
Wang Meng Yang
8945329c8b Merge branch 'fix/aireview_critical_v5.4' into 'release/v5.4' 
fix: Fix some critical bugs in classic bt (v5.4)

See merge request espressif/esp-idf!51291
 2026-08-04 14:16:22 +08:00
Zhi Wei Jian
b5dfde1c9e feat(ble/bluedroid): Support PAWR connection event 
(cherry picked from commit 7da7fa42ac)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-08-03 15:25:46 +08:00
hejiaxin
3552cb670a fix(bt_stack): Fix some critical bugs in classic_bt stack 
related: obex, smp, pbap, sdp, rfcomm, stack_dm

- Deinit function doesn't delete connection when OBEX_DYNAMIC_MEMORY is on
- Union tGOEPC_DATA sometimes is free by osi_free in some cases when it contains mtu_id
- Add correct free and return solution after fail
- Fix symbol mistake in mod calculation
- Fix pointer-related UAF problems and memory free problems
- Fix buffer overflows and out-of-bounds access
- Fix infinite loops triggered by integer overflow wraparound
- Fix double free
- Change layer_specific usage to avoid heap overflow
- Add some NULL check for pointers
- Fix sdp_db free function
- Fix state table mismatch
 2026-07-31 10:46:31 +08:00
Jin Cheng
1ddbe558c4 fix(bt/bluedroid): fixed incorrect eSCO packet type validation under secure connection mode in BlueDroid 2026-07-29 17:30:30 +08:00
hejiaxin
829bdd89b5 fix(bt): Fix some bug in stm_sco.c 
- Memory safety
- State machine & logic integrity
- Resource leaks
- Edge cases check
 2026-07-29 17:30:30 +08:00
Jin Cheng
b19ab411cb fix(bt/bluedroid): fixed issues from AI review in GAP, SPP, HID, L2CAP and HCI 2026-07-23 07:52:39 +08:00
Jiang Jiang Jian
1e96e00456 Merge branch 'bugfix/avrc_ca_attr_id_check_v5.4' into 'release/v5.4' 
fix(bt): Fix the validation of AVRCP metadata attr_id in handle_rc_attributes_rsp (v5.4)

See merge request espressif/esp-idf!50552
 2026-07-20 11:36:03 +08:00
Wang Meng Yang
591ea73bfb Merge branch 'bugfix/bug_bounty_av_v5.4' into 'release/v5.4' 
fix(bt/bluedroid): Fix bug bounty issues about A/V from NVIDIA (v5.4)

See merge request espressif/esp-idf!50479
 2026-07-19 10:25:16 +08:00
Wang Meng Yang
a2e4ad5602 Merge branch 'bugfix/fix_bredr_inq_crash_v5.4' into 'release/v5.4' 
fix(bt/bluedroid): fix crash during bredr inquiry when zero-addr device is found (v5.4)

See merge request espressif/esp-idf!50856
 2026-07-19 10:06:49 +08:00
yangfeng
6c7135e869 fix(bt): Fix the validation of AVRCP metadata attr_id in handle_rc_attributes_rsp 2026-07-17 20:11:41 +08:00
Wang Meng Yang
8063006d12 Merge branch 'bugfix/smp_sec_flags_v5.4' into 'release/v5.4' 
fix(bt/bluedroid): fixed several security issues from NVIDIA (v5.4)

See merge request espressif/esp-idf!50568
 2026-07-17 20:10:02 +08:00
linruihao
1c2eb36135 fix(bt/bluedroid): fix crash during bredr inquiry when zero-addr device is found 2026-07-17 10:39:30 +08:00
Island
a1f767668c Merge branch 'bugfix/fix_bluedroid_read_multi_v5.4' into 'release/v5.4' 
fix(ble/bluedroid): fix GATT Read Multiple response handling (5.4)

See merge request espressif/esp-idf!50707
 2026-07-15 15:38:55 +08:00
Zhi Wei Jian
0532d07a86 feat(ble/bluedroid): Support bluedroid dual identity 
(cherry picked from commit 2358786647)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-14 14:22:39 +08:00
Zhi Wei Jian
7a80e9b127 fix(ble/bluedroid): use BOOLEAN for BLE HCI command builders 
(cherry picked from commit abbf001120)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-14 12:04:10 +08:00
Zhi Wei Jian
00960a5dac fix(ble/bluedroid): clean up LE CoC connect on CCB alloc failure 
(cherry picked from commit 4fd1ebb4a9)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-14 12:04:09 +08:00
Zhi Wei Jian
3deee8d3e2 docs(ble/bluedroid): note ISO BIG HCI alloc failure not checked 
(cherry picked from commit 34b59d30ae)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-14 12:04:08 +08:00
Zhi Wei Jian
e2735b1bb5 fix(ble/bluedroid): fix direct-connect cleanup and adv bounds 
(cherry picked from commit 82e71c1767)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-14 12:04:08 +08:00
Zhi Wei Jian
1330f558e1 fix(ble/bluedroid): validate BLE confirm/OOB and sec-check device 
(cherry picked from commit 93ab11d564)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-14 12:04:07 +08:00
Zhi Wei Jian
fab68dc82f fix(ble/bluedroid): validate SMP pair-fail reason and OOB device 
(cherry picked from commit 98efe02385)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-14 12:04:07 +08:00
Zhi Wei Jian
d2f755b735 fix(ble/bluedroid): route ATT indication-conf timeout separately 
(cherry picked from commit 6c3267ee84)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-14 12:04:07 +08:00
Zhi Wei Jian
12b6beff43 fix(ble/bluedroid): validate ATT PDU sizes 
(cherry picked from commit bb00b9817d)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-14 12:04:06 +08:00
Zhi Wei Jian
7637a46169 fix(ble/bluedroid): re-lookup GATT TCB after enc-complete callback 
(cherry picked from commit 37562af0ea)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-14 12:04:06 +08:00
Zhi Wei Jian
b7fde3a96c fix(ble/bluedroid): fix GATT long read and Service Changed CCC 
(cherry picked from commit 4ce692ac0c)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-14 12:04:05 +08:00
Zhi Wei Jian
0b515686dd fix(ble/bluedroid): validate GATT client discovery handles 
(cherry picked from commit ac35ae6f2d)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-14 12:04:05 +08:00
Zhi Wei Jian
b0e64dbbd5 fix(ble/bluedroid): cap Read By Type length and free failed service decl 
(cherry picked from commit 27ff0cf8c7)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-14 12:04:05 +08:00
Zhi Wei Jian
af043ccffa fix(ble/bluedroid): guard GATT database hash and serialization 
(cherry picked from commit 995c1508e8)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-14 12:04:04 +08:00
Zhi Wei Jian
c48e5a30e9 fix(ble/bluedroid): fix GATT server busy errors and sr_cmd handling 
(cherry picked from commit f86739b03d)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-14 12:04:04 +08:00
Zhi Wei Jian
e7f6bf115e fix(ble/bluedroid): fix GATT teardown and service-change flow 
(cherry picked from commit 0645ba469d)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-14 12:04:04 +08:00
Zhi Wei Jian
a9c2816caf fix(ble/bluedroid): fix GATT service lifecycle leaks 
(cherry picked from commit ac93d94958)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-14 12:04:03 +08:00
Zhi Wei Jian
de2578d083 fix(ble/bluedroid): add GATT resource-cleanup helpers 
(cherry picked from commit b83327f3ca)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-14 12:03:58 +08:00
Zhi Wei Jian
95bd892dba feat(ble/bluedroid): Support bluedroid LE COC and EATT features 
(cherry picked from commit 83f0831c53)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-14 11:56:02 +08:00
Zhang Hai Peng
f84d0bb8eb fix(ble/bluedroid): downgrade numeric comparison log to warning 
(cherry picked from commit 72a49ed53b)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
 2026-07-14 10:37:09 +08:00
Zhang Hai Peng
a817312106 fix(ble/bluedroid): preserve ext adv state when set params fails 
Only update extend_adv_cb after HCI Set Extended Advertising
Parameters succeeds, so a failed update does not corrupt cached
legacy_pdu and related fields used by adv data validation.


(cherry picked from commit 31bd80fee8)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
 2026-07-14 10:37:08 +08:00