Island
e12f87c8e6
Merge branch 'bugfix/fixed_ble_deinit_crash_issue_5.5' into 'release/v5.5'
...
fix(bt): fixed mempool deinit crash issue
See merge request espressif/esp-idf!52142
2026-09-04 14:35:23 +08:00
morris
c07068a9b9
Merge branch 'feat/atomic-internal_v5.5' into 'release/v5.5'
...
fix(driver): allocate driver objects containing atomic variables from internal SRAM (v5.5)
See merge request espressif/esp-idf!52342
2026-09-04 14:25:39 +08:00
Laukik Hase
806eb46c20
Merge branch 'fix/fix_esp_tee_iv_length_check_v5.5' into 'release/v5.5'
...
feat(esp_tee): ESP-TEE Security Audit fixes (v5.5)
See merge request espressif/esp-idf!50970
2026-09-04 10:30:21 +05:30
Shu Chen
d12614a666
Merge branch 'fix/fix_openthread_netif_glue_deinit_issue_v5.5' into 'release/v5.5'
...
fix(openthread): fix stack deinit by reversing netif glue teardown and hardening workflow cleanup (v5.5)
See merge request espressif/esp-idf!52399
2026-09-04 03:48:11 +00:00
Shu Chen
91159942b5
Merge branch 'feat/support_multipan_feature_host_20260813_v5.5' into 'release/v5.5'
...
feat(openthread): add support for the multipan feature on host devices (v5.5)
See merge request espressif/esp-idf!52377
2026-09-04 02:05:53 +00:00
Wang Meng Yang
b58bae632b
Merge branch 'bugfix/avrcp_version_compatibility_v5.5' into 'release/v5.5'
...
fix(bt): Fix the issue of AVRCP version compatibility (v5.5)
See merge request espressif/esp-idf!52088
2026-09-04 09:24:32 +08:00
Wang Meng Yang
79745d864d
Merge branch 'bugfix/qos_div_zero_v5.5' into 'release/v5.5'
...
fix(bt): update ESP32 libbtdm_app.a to fix several issues (v5.5)
See merge request espressif/esp-idf!52054
2026-09-04 08:50:50 +08:00
Xu Si Yu
ab71404e03
fix(openthread): fix stack deinit by reversing netif glue teardown and hardening workflow cleanup
2026-09-03 20:04:03 +08:00
Xu Si Yu
28561a3221
feat(openthread): support multipan feature for host device
2026-09-03 17:48:38 +08:00
Ashish Sharma
4692bfd275
docs(esp_tee): fix AEAD doxygen params after IV moved into the context
2026-09-03 12:15:32 +05:30
Laukik Hase
12fe8f0122
fix(esp_tee): Validate REE-supplied memory bounds (esp_tee_app_config) before use
2026-09-03 12:15:32 +05:30
Laukik Hase
dabd37fae8
fix(esp_tee): Validate the stack pointer at the privilege switch boundary
2026-09-03 12:15:31 +05:30
Laukik Hase
a1bc64d14e
feat(esp_tee): Restrict REE access to TEE-owned secure storage keys
2026-09-03 12:15:31 +05:30
Laukik Hase
6a605263e8
fix(esp_tee): Miscellaneous optimizations and fixes
...
Closes https://github.com/espressif/esp-idf/issues/18591
2026-09-03 12:15:31 +05:30
Ashish Sharma
b23211a287
fix(esp_tee): ensure hal assert is enabled for tee builds
2026-09-03 12:15:30 +05:30
Ashish Sharma
5091e7c874
fix(esp_tee): enforce MMU-map vaddr validity at the REE->TEE boundary
2026-09-03 12:15:30 +05:30
Ashish Sharma
53d6c28d3f
fix(esp_tee): fixes IV length check for TEE AEAD operations
2026-09-03 12:15:30 +05:30
Marius Vikhammer
be8aead3d6
Merge branch 'fix/lightsleep_stress_task_leak_v5.5' into 'release/v5.5'
...
fix(esp_system): wait for idle after light sleep stress tasks (v5.5)
See merge request espressif/esp-idf!52271
2026-09-03 13:18:09 +08:00
Mahavir Jain
3dc1e9cd88
Merge branch 'fix/hmac-ds-reset-corrupts-concurrent-mpi_v5.5' into 'release/v5.5'
...
fix(esp_security): don't reset DS peripheral in esp_hmac_calculate (v5.5)
See merge request espressif/esp-idf!52204
2026-09-03 09:58:22 +05:30
Jin Cheng
b71c37083a
fix(bt): update ESP32 libbtdm_app.a to fix several issues
...
- fixed IntegerDividedByZero during Qos negotiation.
Closes https://github.com/espressif/esp-idf/issues/18951
- ignored the check for bandwidth and retransmission effort when Host
accepts the SCO connection request.
2026-09-03 11:27:05 +08:00
morris
37758ef327
fix(driver): allocate driver objects containing atomic variables from internal SRAM
...
Objects with atomic members must not be allocated to PSRAM, otherwise
the ordering guarantee of atomic accesses is weakened due to a hardware
behavior on ESP32 chips. Explicitly request MALLOC_CAP_INTERNAL |
MALLOC_CAP_8BIT for:
- i2c master bus object (atomic status/trans_idx)
- ISP processor and AE/AF/AWB/HIST controllers (atomic fsm)
- JPEG decoder/encoder dma2d transaction descriptors (atomic started)
- PPA transaction storage embedding dma2d_trans_t
- dma2d m2m test transaction embedding dma2d_trans_t
2026-09-03 09:46:48 +08:00
Mahavir Jain
ffac0bf942
Merge branch 'fix/esp_image_format_v5.5' into 'release/v5.5'
...
fix(esp_image_format): Fix some memory-safety issues (v5.5)
See merge request espressif/esp-idf!50181
2026-09-02 14:56:09 +05:30
Mahavir Jain
051e7d6a90
Merge branch 'fix/crt_bundle_cert_header_oob_v5.5' into 'release/v5.5'
...
Validate cert header extent before reading it in bundle check (v5.5)
See merge request espressif/esp-idf!52185
2026-09-02 11:52:45 +05:30
Wang Meng Yang
144e211509
Merge branch 'fix/bt_memory_v5.5' into 'release/v5.5'
...
fix(bt_memory): Reduce memory usage in transfer (v5.5)
See merge request espressif/esp-idf!52277
2026-09-02 14:12:07 +08:00
morris
ed20c20246
Merge branch 'ci/fix_the_parlio_rx_spi_test_case_v5.5' into 'release/v5.5'
...
ci(parlio_rx): fixed the parlio rx spi test case (v5.5)
See merge request espressif/esp-idf!52162
2026-09-02 10:49:48 +08:00
Jiang Jiang Jian
f883a0592f
Merge branch 'bugfix/dpp_stray_auth_confirm_v5.5' into 'release/v5.5'
...
fix(esp_wifi): Fix pm call for roc done cb and dpp stray confirm v5.5
See merge request espressif/esp-idf!51989
2026-09-02 10:38:02 +08:00
hejiaxin
3d56f31133
fix(bt_avrcp): size some AVRC command buffers
2026-09-01 11:24:02 +08:00
hejiaxin
49c18b3aaf
fix(bt_l2cap): size L2CAP ERTM S-frame & RX SDU buffer
2026-09-01 11:24:02 +08:00
hejiaxin
5e8f5c85fb
fix(bt_sdp): size SDP TX buffers
2026-09-01 11:24:02 +08:00
hejiaxin
6bfe3c70e3
fix(bt_rfcomm): size RFCOMM TX buffers by peer MTU
2026-09-01 11:23:59 +08:00
hejiaxin
3e9012b5e3
fix(bt_hid): size HID TX buffers to report length
2026-09-01 11:21:41 +08:00
Marius Vikhammer
85bb3faa5f
fix(esp_system): delay after light sleep stress cleanup
2026-09-01 10:39:56 +08:00
Marius Vikhammer
283d7b5ebd
fix(esp_system): wait for idle after light sleep stress tasks
...
Self-deleted worker tasks are only freed once idle runs. A 500us
periodic esp_timer can starve that cleanup and trip Unity's leak check.
2026-09-01 10:30:42 +08:00
Shreyas Sheth
eb0df1622d
fix(esp_wifi): Harden dpp Auth confirm and drop mismatched auth confirms
2026-08-31 14:04:19 +05:30
harshal.patil
347727b122
fix(mbedtls): validate cert header extent before reading it in bundle check
...
esp_crt_check_bundle() read the 4-byte certificate header (name_len,
key_len) via esp_crt_get_len() after only checking that the cert's
start offset lies inside the bundle, so a crafted bundle whose first
or last certificate starts within the final 3 bytes caused a transient
out-of-bounds read of up to 3 bytes before the extent check rejected
it. Require the whole header to lie inside the bundle before reading
it.
2026-08-31 10:25:48 +05:30
morris
210ac40082
Merge branch 'fix/jpeg_enc_header_oob_v5.5' into 'release/v5.5'
...
fix(jpeg): validate encoder buffer sizes before header/DMA access (backport v5.5)
See merge request espressif/esp-idf!52123
2026-08-31 11:11:01 +08:00
Ashish Sharma
28268f348c
fix(esp_security): don't reset DS peripheral in esp_hmac_calculate
...
esp_hmac_calculate() enabled and reset the Digital Signature (DS)
peripheral, but HMAC has no dependency on DS (the dependency runs the
other way: a DS operation uses HMAC/SHA).
The DS peripheral drives the RSA (MPI) accelerator internally, so pulsing
the DS reset also resets the RSA datapath. This coupling exists on every
target that has the DS peripheral: the MPI reset routine itself clears the
DS reset "otherwise RSA is held in reset".
esp_hmac_calculate() holds only the HMAC and SHA/AES locks, not the MPI
lock, so it can corrupt a concurrent RSA/MPI operation. On multi-core
targets (e.g. ESP32-P4, ESP32-S31, ESP32-S3) an HMAC on one core resets an
RSA op running on another core; on single-core targets (e.g. ESP32-C5) the
same corruption happens when an HMAC preempts an in-flight RSA op. The
result is a wrong RSA result or a crash in the computation.
Remove the DS peripheral enable/reset from the HMAC path. SHA, which HMAC
depends on, is enabled independently, so the HMAC output is unchanged.
This also drops a few redundant register writes.
2026-08-31 10:56:56 +08:00
Konstantin Kondrashov
b116ab3a21
fix(bootloader): increase partition table offset for ESP32-P4 in affected test configs
2026-08-28 17:15:49 +03:00
Konstantin Kondrashov
777c72a01e
fix(esp_image_format): validate MMU page size
2026-08-28 17:15:49 +03:00
Konstantin Kondrashov
85d56ea446
fix(esp_image_format): verify length of segment #0 for app description
2026-08-28 17:15:49 +03:00
Konstantin Kondrashov
95c4491fba
fix(esp_image_format): Verify image segment count
2026-08-28 17:15:49 +03:00
Mahavir Jain
fd0b33dfda
Merge branch 'bugfix/memory-safety-and-validation_v5.5' into 'release/v5.5'
...
fix(security): findings from project Vanessa (v5.5)
See merge request espressif/esp-idf!50411
2026-08-28 17:17:10 +05:30
Jiang Jiang Jian
d90d34f89a
Merge branch 'bugfix/nan_vulnerabilities_v5.5' into 'release/v5.5'
...
fix(nan): Fix bug bounty reported and discovered vulnerabilities in NAN Rx (Backport v5.5)
See merge request espressif/esp-idf!51300
2026-08-28 18:00:40 +08:00
morris
9c01eb00e3
Merge branch 'fix/isp_error_when_rgb888_input_v5.5' into 'release/v5.5'
...
fix(isp): initialize Color defaults for RGB DMA output (v5.5)
See merge request espressif/esp-idf!51648
2026-08-28 17:38:52 +08:00
Marius Vikhammer
af64bbd9e2
Merge branch 'bugfix/heap_task_tracking_isr_safe_v5.5' into 'release/v5.5'
...
fix(heap): use critical section for task tracking locks (v5.5)
See merge request espressif/esp-idf!52010
2026-08-28 15:56:38 +08:00
Chen Jichang
1673d8b56d
ci(parlio_rx): fixed the parlio rx spi test case
2026-08-28 14:36:35 +08:00
Wang Meng Yang
b5b7c57da3
Merge branch 'fix/aireview_obex_v5.5' into 'release/v5.5'
...
fix(bt_obex): fix some bugs in bluedroid obex (v5.5)
See merge request espressif/esp-idf!52006
2026-08-28 08:42:46 +08:00
ShenWeilong
b66fa4551f
fix(bt): fixed mempool deinit crash issue
2026-08-27 16:50:22 +08:00
Shu Chen
a7c07eb28f
Merge branch 'feat/add_thread_ssed_ci_test_scenario_v5.5' into 'release/v5.5'
...
feat: add thread ssed ci testcase scenario (v5.5)
See merge request espressif/esp-idf!51498
2026-08-27 07:12:21 +00:00
Mahavir Jain
c13bec45b1
Merge branch 'fix/esp32s2_aes_dma_psram_partial_block_hang_v5.5' into 'release/v5.5'
...
Avoid ESP32-S2 Crypto DMA stall on PSRAM output with partial blocks (v5.5)
See merge request espressif/esp-idf!51876
2026-08-27 12:05:36 +05:30