Commit Graph

42921 Commits

Author SHA1 Message Date
zhangyanjiao
829d43c9ef fix(wifi): fixed espnow data rate overridden by stale rate control 2026-07-29 17:52:35 +08:00
Rahul Tank
76fa1483ab Merge branch 'feat/sbom_changes_v5.3' into 'release/v5.3'
fix(nimble): update sbom file with cve details (v5.3)

See merge request espressif/esp-idf!51184
2026-07-29 15:03:51 +05:30
Jin Cheng
28b00497ee fix(bt/bluedroid): fixed incorrect eSCO packet type validation under secure connection mode in BlueDroid 2026-07-29 17:30:36 +08:00
hejiaxin
95b9d9c961 fix(bt): Fix some bug in stm_sco.c
- Memory safety
- State machine & logic integrity
- Resource leaks
- Edge cases check
2026-07-29 17:30:36 +08:00
Alexey Gerenkov
dd77984ee6 Merge branch 'fix/cxx-tls-destructors_v5.3' into 'release/v5.3'
fix(cxx): fix TLS classes destructor call (v5.3)

See merge request espressif/esp-idf!34209
2026-07-29 16:17:58 +08:00
Rahul Tank
2ccfcc7066 fix(nimble): update sbom file with cve details 2026-07-29 12:53:31 +05:30
Jiang Jiang Jian
be0801377d Merge branch 'bugfix/clear_ifx_tx_queue_v5.3' into 'release/v5.3'
bugfix(wifi): Clear Sta TX queue to prevent key 2 send failure (Backport v5.3)

See merge request espressif/esp-idf!50901
2026-07-29 15:16:35 +08:00
Island
6e1600f2f9 Merge branch 'feat/add_bt_common_npl_v5.3' into 'release/v5.3'
feat(bt): Add host-agnostic BT OSAL and shared BLE profile task (5.3)

See merge request espressif/esp-idf!51217
2026-07-29 15:00:21 +08:00
akshat
a791b31867 bugfix(wifi): Clear Sta TX queue to prevent key 2 send failure
Also, Ensure correct return values for key 2 and key 4.
2026-07-29 10:45:06 +05:30
morris
681fd6177f fix(sdspi): reject oversized pre-read data before block receive
Guard start_command_read_blocks against cards that place TOKEN_BLOCK_START so early that extra_data_size exceeds the bytes expected on the current iteration. Without this check, the unsigned subtraction for will_receive underflows and propagates into memset, SPI transaction length, and memcpy counts against the fixed 516-byte block buffer.
2026-07-29 11:45:31 +08:00
morris
d2984d636d fix(spi_slave): free DMA-private buffers when transaction queue is full
spi_slave_queue_trans calls spi_slave_setup_priv_trans to allocate
DMA buffers, then tries xQueueSend. If the queue is full the function
returns ESP_ERR_TIMEOUT without freeing those buffers, leaking up to
2 * max_transfer_sz per failed call. Call spi_slave_uninstall_priv_trans
before returning the timeout.
2026-07-29 11:45:31 +08:00
morris
421b3f8954 fix(jpeg): release platform mutex on semaphore/pm-lock allocation failure
jpeg_acquire_codec_handle acquires s_jpeg_platform.mutex at entry
but two ESP_RETURN_ON_* macros (semaphore-create and PM-lock-create
failure) return without releasing it. Replace with ESP_GOTO_ON_*
that jumps to a cleanup label which frees partial resources, NULLs
the codec pointer, and releases the mutex.
2026-07-29 11:45:31 +08:00
morris
63fa4546a0 fix(i2c): release platform mutex on intr/pm_lock delete failure
ESP_RETURN_ON_ERROR inside the s_i2c_platform.mutex critical section
returns without releasing the mutex, permanently blocking all I2C
bus operations. Replace with ESP_GOTO_ON_ERROR that jumps to a
cleanup label releasing the mutex before return.
2026-07-29 11:45:31 +08:00
morris
4f054f74bb fix(csi): move csi_fsm init before resource allocation to fix err-path leak
CSI_FSM_INIT is 1, but the controller struct is zero-allocated.
Any failure before the former csi_fsm assignment (near the end of
esp_cam_new_csi_ctlr) jumped to err: which called s_del_csi_ctlr.
That function bailed out immediately because csi_fsm == 0, leaking
the claimed slot, queue, bridge, DMA channel, PM lock, and backup
buffer. Move csi_fsm = CSI_FSM_INIT right after a successful claim
so the err: path properly tears down all allocated resources.
2026-07-29 11:42:56 +08:00
morris
05ebe7ad4b fix(adc): add missing input validation for channel and ret_handle
- adc_cali_curve_fitting: validate config->chan in check_valid() to
  prevent OOB access into s_adc_cali_chan_compens compensation table
- adc_filter: make s_adc_filter_free idempotent on !UNIT_BINDED SoCs
  to prevent double-free on repeated adc_del_continuous_iir_filter
- adc_cali_line_fitting(esp32): fix config && config typo to
  config && ret_handle, preventing NULL-pointer dereference
2026-07-29 11:42:56 +08:00
Jiang Jiang Jian
ffd6fbd9fc Merge branch 'bugfix/fix_some_coex_bugs_260727_v5.3' into 'release/v5.3'
fix(coex): move 15.4 register configuration to 15.4 init(Backport v5.3)

See merge request espressif/esp-idf!51178
2026-07-29 10:23:34 +08:00
Jiang Jiang Jian
06ec4430d0 Merge branch 'bugfix/roaming_app_issues_v5.3' into 'release/v5.3'
Fixed some issues in roaming app found using static analysis(v5.3)

See merge request espressif/esp-idf!49937
2026-07-29 10:17:57 +08:00
Jiang Jiang Jian
74622529fd Merge branch 'fix/fix_iram_sleep_process_access_cache_v5.3' into 'release/v5.3'
fix(esp_hw_support): fix get_act_hp/lp_dbias accessed ext mem (v5.3)

See merge request espressif/esp-idf!51212
2026-07-29 10:15:42 +08:00
Jin Chen
eeecd45929 change(ble): [AUTO_MR] Update lib_esp32c6 to 18aafc6f
(cherry picked from commit 624845829a)

Co-authored-by: cjin <jinchen@espressif.com>
2026-07-29 08:42:09 +08:00
Jin Chen
8cdb74f49d change(ble): [AUTO_MR] Update lib_esp32h2 to 18aafc6f
(cherry picked from commit d7b7876c3c)

Co-authored-by: cjin <jinchen@espressif.com>
2026-07-29 08:42:09 +08:00
wuzhenghui
8f397e0407 fix(bootloader_support): fix RTC retain mem offset for secure boot fast wakeup
Pointer arithmetic on rtc_retain_mem_t* subtracted ESP_SECURE_BOOT_DIGEST_LEN
in struct units instead of bytes. Cast through uintptr_t so retain mem stays
below the ROM verified-image digest region on deep-sleep wake.

Partial backport of !51265 (bootloader_common_loader.c only).
2026-07-28 21:50:51 +08:00
Wang Meng Yang
9079e1473a Merge branch 'bugfix/ai_review_avrcp_v5.3' into 'release/v5.3'
fix(bt): Fix the critical and high issues related to AVRCP from AI review report (v5.3)

See merge request espressif/esp-idf!50023
2026-07-28 19:59:39 +08:00
Wang Meng Yang
d9f2d61539 Merge branch 'bugfix/hid_host_oob_read_v5.3' into 'release/v5.3'
fix(bt/bluedroid): fixed possible 1-byte OOB read in bta_hh_ctrl_dat_act (v5.3)

See merge request espressif/esp-idf!50975
2026-07-28 19:52:02 +08:00
Wang Meng Yang
e13cc8ef6f Merge branch 'bugfix/bredr_critical_bugs_v5.3' into 'release/v5.3'
fix(bt/bluedroid): fixed issues from AI review in GAP, SPP, HID, L2CAP and HCI (v5.3)

See merge request espressif/esp-idf!51081
2026-07-28 19:43:58 +08:00
morris
ee2818b7ff Merge branch 'fix/uhci_rx_size_check_v5.3' into 'release/v5.3'
fix(uhci): rx fsm race condition and buffer size check (v5.3)

See merge request espressif/esp-idf!51234
2026-07-28 18:22:54 +08:00
Hu Rui
194de3ab4b fix(uhci): rx fsm race condition and buffer size check
Closes https://github.com/espressif/esp-idf/issues/18819
Closes https://github.com/espressif/esp-idf/issues/18820
2026-07-28 14:56:43 +08:00
Luo Xu
e2fbba666a fix(bt): fix BLE log compression build on Windows
The BLE log compression feature (CONFIG_BT_LOG_CRITICAL_ONLY ->
BLE_COMPRESSED_LOG_ENABLE) failed to build on Windows while working
correctly on Linux, due to two shell/platform-specific issues in the
compression script.

1. Module/source argument quoting. CMakeLists.txt passes the
   semicolon-separated module and source lists wrapped in single quotes
   ("'${MODULES}'") to protect ';' from POSIX shells, which strip them.
   cmd.exe does not treat single quotes as quoting characters, so on
   Windows the quotes reached the script literally and
   args.module.split(';') produced "'BLE_MESH" / "BLE_HOST'" instead of
   the clean names. These never matched the YAML module keys, every
   module was skipped ("Skipping module ... - config not found"), the
   compressed sources were never generated, and the build failed. Strip
   surrounding quote characters before splitting; this is a no-op on
   Linux/macOS where the shell already removed them.

2. CRLF line endings. With core.autocrlf=true the IDF sources are
   checked out as CRLF on Windows. The generated *_log_index.h macros
   use backslash-newline line-continuation; a backslash followed by
   '\r\n' is not a valid continuation in C, producing floods of syntax
   errors when the header is compiled. Write generated headers with
   newline='' to force LF, and normalize source content to LF right
   after reading so '\r' embedded inside multi-line argument expressions
   is also handled. Byte offsets stay consistent because both tree-sitter
   parsing and tag replacement operate on the normalized content.

Verified by full clean builds of examples/bluetooth/esp_ble_mesh/
vendor_models/vendor_client (esp32c6, bluedroid + mesh) from both
cmd.exe and PowerShell; both produce an identical vendor_client.bin.


(cherry picked from commit aa9b565a6d)

Co-authored-by: luoxu <luoxu@espressif.com>
2026-07-28 13:43:33 +08:00
luoxu
eada85080b feat(ble_mesh): update lib to 79e3fee04e 2026-07-28 12:12:30 +08:00
chenjianhua
67960f06d7 feat(bt): Add host-agnostic BT OSAL and shared BLE profile task
- Add bt_osal: event queues, mutexes, semaphores, callouts, etc.
- Add the shared BLE profile task and event queue
- Bring both up and tear them down in the host init/deinit paths
- Add unit tests for the OSAL and the profile task
2026-07-27 19:52:30 +08:00
Li Shuai
38c2c69378 change(esp_hw_support): optimize get hp/lp dbias implementation iram or flash usage 2026-07-27 19:14:08 +08:00
Alexey Lapshin
390a496942 fix(cxx): fix TLS classes destructor call
Closes https://github.com/espressif/esp-idf/issues/14360
2026-07-27 15:16:36 +07:00
Xu Si Yu
b762a6f5d0 fix(coex): move 15.4 register configuration to 15.4 init
1. move 15.4 register configuration to 15.4 init
2. fix coex status get issue
2026-07-27 11:41:56 +08:00
morris
25039385e2 Merge branch 'backport/spi_flash_fixes_v5.3' into 'release/v5.3'
fix(spi_flash): backport aes-xts error-path & mxic fixes (v5.3)

See merge request espressif/esp-idf!51138
2026-07-27 10:36:36 +08:00
Luo Xu
ad9f88b13f feat(ble_mesh): supported get lib version
(cherry picked from commit 56f78da32c)

Co-authored-by: luoxu <luoxu@espressif.com>
2026-07-27 10:03:12 +08:00
Rahul Tank
6590778c43 Merge branch 'bugfix/nimble_security_fixes_v5.3' into 'release/v5.3'
fix(nimble): Ai reported security fixes (v5.3)

See merge request espressif/esp-idf!50694
2026-07-25 18:49:34 +05:30
Shreeyash Bhakare
f2b7aa1db8 fix(nimble): Added security related fixes 2026-07-25 13:48:33 +05:30
Rahul Tank
b6aaa5f765 Merge branch 'bugfix/l2cap_throughput_degrading_v5.3' into 'release/v5.3'
Preserve throughput when switching from LE Coded to 1M/2M PHY (v5.3)

See merge request espressif/esp-idf!50833
2026-07-25 08:35:44 +05:30
Astha Verma
8025ab856c fix(nimble): Restore throughput after switching from LE Coded PHY 2026-07-24 18:08:38 +05:30
Shu Chen
dae526045b Merge branch 'feat/update_phylib_on_s31_c6_for_track_v5.3' into 'release/v5.3'
feat(phy): update phy lib for esp32s31 & esp32c6 for track (v5.3)

See merge request espressif/esp-idf!50794
2026-07-24 11:05:06 +00:00
Rahul Tank
cc3a5ec838 Merge branch 'bugfix/fix_ai_example_review_v5.3' into 'release/v5.3'
fix(nimble): Fix nimble examples review issues (v5.3)

See merge request espressif/esp-idf!50844
2026-07-24 16:23:33 +05:30
Rahul Tank
8aa7006649 fix(nimble): Fix issues found in review for nimble examples 2026-07-24 15:53:38 +05:30
Rahul Tank
7ec47c264d Merge branch 'bugfix/red_rem_feat_evt_v5.3' into 'release/v5.3'
Handle Read Remote Supported Feature failure (v5.3)

See merge request espressif/esp-idf!50812
2026-07-24 14:28:47 +05:30
Jiang Jiang Jian
8363d0e4d1 Merge branch 'bugfix/a2dp_sbc_v5.3' into 'release/v5.3'
fix(bt): Fix the pointer sbc_start_frame is not initialized (v5.3)

See merge request espressif/esp-idf!51020
2026-07-24 16:02:04 +08:00
Shu Chen
a6e1a47dd7 Merge branch 'support/ot_register_154_event_cb_v5.3' into 'release/v5.3'
feat(openthread): use ieee802154 event callback list instead of weak overrides (v5.3)

See merge request espressif/esp-idf!51130
2026-07-24 08:00:58 +00:00
Song Ruo Jing
134328affb fix(ppa): add checks for input to avoid any OOB access 2026-07-24 15:39:29 +08:00
C.S.M
c7dd46e84b fix(spi_flash): Fix spi_flash leaks release aes-xts in error path
(cherry picked from commit 305c5869ee)
2026-07-24 15:00:50 +08:00
Shengyu Qu
352d18b48e fix(spi_flash): add #if check for s_mxic_set_required_regs()
Currently, s_mxic_set_required_regs() lacks checking for
CONFIG_SPI_FLASH_SUPPORT_MXIC_OPI_CHIP. And this causes a defined but not
used warning when MXIC flash driver is disabled in project config. So add
a #if check for this to supress warning.

Signed-off-by: Shengyu Qu <wiagn@4d2.org>
(cherry picked from commit 062c948c18)
2026-07-24 15:00:50 +08:00
zwx
5b13be2889 feat(openthread): use ieee802154 event callback list instead of weak overrides 2026-07-24 14:23:55 +08:00
Island
7efbfbb0a1 Merge branch 'fix/ble_hidd_remove_ccc_gating_v5.3' into 'release/v5.3'
fix(esp_hid/bluedroid): remove app-layer CCC gating in HID device (5.3)

See merge request espressif/esp-idf!51004
2026-07-23 19:26:18 +08:00
Wang Meng Yang
9c15348402 Merge branch 'bugfix/low_spp_throughput_v5.3' into 'release/v5.3'
change(bt/bluedroid): increased port low watermark of RFCOMM (v5.3)

See merge request espressif/esp-idf!51087
2026-07-23 16:41:33 +08:00