Fix DTM TX buffer leak in the BLE controller that could cause memory exhaustion and Interrupt WDT timeout during or after DTM TX tests. (6.0)
See merge request espressif/esp-idf!52615
BDL diskio test part only; the rest of the commit is already on release/v6.0
via 4f7b1af0f9, which predates components/fatfs/test_apps/bdl.
(cherry picked from commit a8b5b8d582)
Just a build issue fix depending on GCC5+ configuration, fixes:
assignment discards 'const' qualifier from pointer target type [-Werror=discarded-qualifiers]
return discards 'const' qualifier from pointer target type [-Werror=discarded-qualifiers]
Signed-off-by: Richard Allen <richard@bryghtlabs.com>
In H2E (Hash-to-Element) mode, sae_parse_commit() parses the optional
Anti-Clogging Token Container by calling sae_parse_token_container().
However, callers of sae_parse_commit() that do not require retrieving
the anti-clogging token (such as PASN initiator/responder and SME auth)
pass NULL for the token and token_len output arguments.
If the peer sends a Commit frame containing a valid Anti-Clogging
Token Container element, sae_parse_token_container() unconditionally
sets *token and *token_len, resulting in a NULL pointer dereference
(SIGSEGV) and crashing wpa_supplicant.
Fix this by adding NULL checks before writing to token and token_len.
Update the debug log to print the token directly using 'pos'.
Fixes: 5e32fb0170f4 ("SAE: Use Anti-Clogging Token Container element with H2E")
Signed-off-by: Amarnath Hullur Subramanyam <amarnathhs@google.com>
When wpa_supplicant was processing EAPOL-Key msg 1/4 with a PMKID
indicated by the AP/Authenticator, a PMKSA for the same AA was accepted
without enforcing matching network_ctx (i.e., same network configuration
block) and AKMP. This could allow misbehaving APs to make wpa_supplicant
use an unacceptable PMKSA entry that was generated for a different
network for AKMP under certain conditions. This could result in showing
a connection to an incorrect network when an attacker has credentials to
one network in wpa_supplicant configuration, but not to another network.
Fix this by accepting the PMKID to set the PMKSA for an association only
if the PMKSA with the same PMKID is for the same network and was
generated using the same AKMP.
Signed-off-by: Jouni Malinen <jouni.malinen@oss.qualcomm.com>
The BLE log compression feature (CONFIG_BT_LOG_CRITICAL_ONLY ->
BLE_COMPRESSED_LOG_ENABLE) failed to build on Windows while working
correctly on Linux, due to two shell/platform-specific issues in the
compression script.
1. Module/source argument quoting. CMakeLists.txt passes the
semicolon-separated module and source lists wrapped in single quotes
("'${MODULES}'") to protect ';' from POSIX shells, which strip them.
cmd.exe does not treat single quotes as quoting characters, so on
Windows the quotes reached the script literally and
args.module.split(';') produced "'BLE_MESH" / "BLE_HOST'" instead of
the clean names. These never matched the YAML module keys, every
module was skipped ("Skipping module ... - config not found"), the
compressed sources were never generated, and the build failed. Strip
surrounding quote characters before splitting; this is a no-op on
Linux/macOS where the shell already removed them.
2. CRLF line endings. With core.autocrlf=true the IDF sources are
checked out as CRLF on Windows. The generated *_log_index.h macros
use backslash-newline line-continuation; a backslash followed by
'\r\n' is not a valid continuation in C, producing floods of syntax
errors when the header is compiled. Write generated headers with
newline='' to force LF, and normalize source content to LF right
after reading so '\r' embedded inside multi-line argument expressions
is also handled. Byte offsets stay consistent because both tree-sitter
parsing and tag replacement operate on the normalized content.
Verified by full clean builds of examples/bluetooth/esp_ble_mesh/
vendor_models/vendor_client (esp32c6, bluedroid + mesh) from both
cmd.exe and PowerShell; both produce an identical vendor_client.bin.
(cherry picked from commit aa9b565a6d)
Co-authored-by: luoxu <luoxu@espressif.com>
bt_mesh_bta_gatts_cb did not always answer ATT Read/Write Requests:
- READ: on a callback error it only logged a warning and sent nothing; a
0-byte read (Read Blob at an offset equal to the value length) also sent
nothing, although it is a successful empty read.
- WRITE: on a callback error it sent nothing, and a partial/zero write was
treated as success.
- Both: when the handle was not found or the attribute had no read/write
callback, the request was silently dropped.
An ATT Request must always be answered:
- READ: len >= 0 is success -> Read Response (a 0-byte read yields an empty
value); len < 0 -> ATT Error Response carrying the callback's error code
(-len, since BLE_MESH_GATT_ERR(x) == -x). The copy length is clamped to
the source buffer size as a defensive bound. If the handle is unknown or
the attribute has no read callback, respond with INVALID_HANDLE /
READ_NOT_PERMITTED.
- WRITE: when need_rsp is set, always reply. len == write length -> Write
Response; otherwise (negative ATT error, partial write, or 0) -> ATT
Error Response (the negative code, or UNLIKELY for partial/0). If the
handle is unknown or the attribute has no write callback, respond with
INVALID_HANDLE / WRITE_NOT_PERMITTED. Write Without Response still sends
no response.
A non-success status passed to BTA_GATTS_SendRsp is turned into an ATT
Error Response by the GATT layer (gatt_sr_process_app_rsp ->
gatt_send_error_rsp).
(cherry picked from commit ed1f4de3a3)
Co-authored-by: luoxu <luoxu@espressif.com>
Jiang Jiang Jian
Wang Meng Yang
Euripedes Rocha
morris
Ondrej Kosta
Island
linruihao
Marius Vikhammer
Mahavir Jain
Shreeyash Bhakare
hejiaxin
Alexey Gerenkov
Rahul Tank
zhaoweiliang
muhaidong
Guillaume Souchere
Ashish Sharma
Shu Chen
Steven (Yang Minghui)
zwx
Martin Vychodil
sonika.rathi
LiPeng
Richard Allen
Jimi Chen
Jouni Malinen
Aditi
Luo Xu