linruihao
647f0972ac
fix(coex): fix some esp32 coexistence bugs
...
- fix ble scan may restart twice in coex scenarios
- fix bredr page/pscan coex request/release not match
- fix bredr incorrect inquiry length calculation
- update bredr page/inquiry pti
- add coex pti protection for entire page/inquiry event
2026-03-24 19:16:33 +08:00
Rahul Tank
b7bff02998
Merge branch 'bugfix/send_conn_cancel_simul' into 'master'
...
fix(nimble): Issue connect cancel in case of outstanding master connection
See merge request espressif/esp-idf!46565
2026-03-24 12:34:03 +05:30
Jiang Jiang Jian
c999dc6a85
Merge branch 'bugfix/idfci-8990' into 'master'
...
fix(bt): Fix crash due to function not placed in IRAM
Closes IDFCI-8990 and BT-4292
See merge request espressif/esp-idf!46876
2026-03-24 10:47:10 +08:00
Island
1c99ea52c1
Merge branch 'bugfix/optimize_bluedroid_host_code_new' into 'master'
...
fix(ble/bluedroid): Use the same legacy gap callback instead of each independent legacy gap event callback
Closes BLERP-2639
See merge request espressif/esp-idf!46344
2026-03-23 15:28:46 +08:00
Island
c0dfdf9c3b
Merge branch 'fix/disable_some_params_check_in_cte_apis' into 'master'
...
disable some parameters check in CTE APIs
Closes BLERP-2644
See merge request espressif/esp-idf!46835
2026-03-23 15:28:15 +08:00
xiongweichao
0bc4f8ab8e
fix(bt): Fix crash due to functions not placed in IRAM
2026-03-23 14:28:58 +08:00
zhiweijian
7d68662c18
disable some parameters check in CTE APIs
2026-03-23 11:09:14 +08:00
Rahul Tank
caf917e6c2
fix(nimble): Issue connect cancel in case of outstanding master connection
2026-03-23 07:15:28 +05:30
zhanghaipeng
e3aac6f703
fix(ble): Fixed BLE assert in "emi.c" when low memory
2026-03-20 20:01:55 +08:00
Wang Meng Yang
a2ad4b4a8a
Merge branch 'bugfix/uninited_stack_var' into 'master'
...
fix: fixed possible use of uninitialized stack variables in bta_hf_client_parse_binp
Closes BT-4270
See merge request espressif/esp-idf!46515
2026-03-20 19:30:50 +08:00
Jiang Jiang Jian
9bde023b12
Merge branch 'bugfix/oob_in_avrc' into 'master'
...
FIx: Heap OOB read in Bluedroid AVRCP Target parser
Closes BT-4269
See merge request espressif/esp-idf!46425
2026-03-20 17:41:11 +08:00
Island
1005d55ddb
Merge branch 'feat/support_run_time_alloc_for_esp_ip_test' into 'master'
...
Support Mempool Run Time Allocation for ESP IP Chips
Closes BLERP-2622
See merge request espressif/esp-idf!45778
2026-03-20 16:17:27 +08:00
luoxu
17868a5f5c
fix(ble/bluedroid): Change BLE mesh adapter to use BTA APIs
2026-03-19 20:59:28 +08:00
zhiweijian
d07ce78dcf
fix(ble/bluedroid): optimize bluedroid host and fix GAP, memory, status and BTM API issues
...
- return HCI_ERR_MEMORY_FULL on cmd buffer alloc failure
- remove legacy adv/scan semaphores and mutex
- Use the same legacy gap callback instead of each independent legacy gap event callback
2026-03-19 20:59:28 +08:00
cjin
84d75cf772
feat(ble): supported ble mempool run time allocation for esp ip chips
2026-03-19 16:46:02 +08:00
zhaoweiliang
a8d705ff7a
change(ble): [AUTO_MR] Update lib_esp32h2 to 913c704d
2026-03-18 17:21:42 +08:00
zhaoweiliang
a2ef5c0ff9
change(ble): [AUTO_MR] Update lib_esp32c2 to b8594335
2026-03-18 17:21:42 +08:00
zhaoweiliang
06010a8b79
change(ble): [AUTO_MR] Update lib_esp32c6 to 913c704d
2026-03-18 17:21:42 +08:00
zhaoweiliang
739cb8e00d
change(ble): [AUTO_MR] Update lib_esp32c5 to 913c704d
2026-03-18 17:21:42 +08:00
cjin
5ec82368ba
feat(ble): make env init function cuttable on ESP32-C2
2026-03-18 17:21:42 +08:00
zhiweijian
50747e4f63
fix(ble/bluedroid): Null/range checks, crypto cleanup and API consistency
...
- smp_api.h/smp_int.h: SMP_OPCODE_ARRAY_SIZE and SecureConnectionOobDataReply
declaration alignment
- p_256_ecc_pp/p_256_multprecision: bounds and overflow fixes in ECC/multiprecision
- smp_act: init le_key; p_dev_rec null check in smp_key_distribution;
smp_compute_dhkey failure notify in smp_both_have_public_keys
- smp_api: early state/cb_evt check in SMP_SecureConnectionOobDataReply
- smp_cmac: input/length validation in cmac_aes_k_calculate and
aes_cipher_msg_auth_code
- smp_keys: smp_gen_p2_4_confirm return and smp_calculate_comfirm_cont;
smp_process_private_key/smp_compute_dhkey cleanup and peer_pub_be clear
- smp_l2c: fix callback param types with L2CAP
- smp_main: event/state bounds in smp_sm_event; smp_get_event_name default string
- smp_utils: cmd_code<SMP_OPCODE_ARRAY_SIZE and smp_cmd_build_act check;
smp_mask_enc_key/smp_command_has_invalid_parameters bounds
2026-03-18 16:49:09 +08:00
zhiweijian
16d523e9bf
fix(ble/bluedroid): BLE credit, reject when p_rcb NULL, timeout and leak fixes
...
- l2c_int: align struct/constant types with l2c_ble/l2c_main
- l2c_api: null/state checks in L2CA_SendFixedChnlData
- l2c_ble: reject when p_rcb==NULL, add L2CAP_CMD_BLE_FLOW_CTRL_CREDIT;
l2cble_init_direct_conn int64_t timeout and link_timeout==0 fix
- l2c_link: null/state checks and cleanup in hci_disc_comp/timeout/send_to_lower
- l2c_main: free p_msg on FCR non-Basic and COC branches; fix LE credit handling;
process_l2cap_cmd bounds
- l2c_utils: credit/queue cleanup and null checks in l2cu_disconnect_chnl
2026-03-18 16:49:09 +08:00
zhiweijian
1d31286f1a
fix(ble/bluedroid): Fix double-free, exec write, bounds and HCI param checks
...
- gap_ble: add length/attribute checks in gap_proc_write_req
- gatt_cl: set p_cmd->p_cmd=NULL before memset to avoid double-free;
pending_cl_req %= GATT_CL_MAX_LCB
- gatt_sr: fix exec write zeroed_attrs and offset/len bounds, OOM cleanup
- gatt_sr_hash: null checks for p_attr->p_next, p_data+=2, len==0 in
gatts_calculate_datebase_hash, gatts_show_local_database
- gatt_utils: explicit return NULL, indent, idx<GATT_MAX_APPS checks,
len>GATT_MAX_ATTR_LEN, gatt_cleanup_upon_disc dealloc branch
- hciblecmds: length/handle validation in BLE ext adv/BIG sync HCI commands
2026-03-18 16:38:25 +08:00
zhiweijian
537661fb2e
fix(ble/bluedroid): Event length checks and timer/alarm error handling
...
- btu_hcif: validate p_msg->len and hci_evt_len in process_event; pass evt_len to
sub-handlers; fix cs_subevt num_steps_reported==0 malloc; bounds in
command_complete and role_change_evt
- btu_task: handle osi_alarm_new/hash_map_set failure in btu_start_timer,
btu_start_quick_timer, btu_start_timer_oneshot
2026-03-18 16:38:25 +08:00
zhiweijian
65b2cb2728
fix(ble/bluedroid): BLE GAP/ACL/ISO/SCO null checks, evt_len and resource handling
...
- btm_acl: malloc/list_append failure handling, remove/memset order in btm_acl_removed
- btm_ble: remove incorrect sec_flags in SMP_OOB/NC/SC_OOB fall-through
- btm_ble_5_gap: btm_ble_hci_status_to_str unreachable return,
BTM_BleSetExtendedAdvParams/BleStartExtAdv leak and bounds
- btm_ble_addr: fix indent in btm_find_dev_by_identity_addr
- btm_ble_gap: null check p_service_data, pass evt_len to btm_ble_process_adv_pkt,
bounds in process_adv_pkt
- btm_ble_iso: align param types with declaration
- btm_ble_privacy: handle BTM_BLE_IRK_LIST_INVALID_INDEX in update_resolving_list,
comment fixes
- btm_devctl: fix btm_vsc_complete param order/type
- btm_sco: add evt_len to btm_sco_process_num_completed_pkts for bounds check
- btm_ble_int.h/btm_int.h: add evt_len to process_adv_pkt and
process_num_completed_pkts declarations
2026-03-18 16:38:24 +08:00
zhiweijian
778dd2ab5e
fix(ble/bluedroid): Add length/pointer checks and fix error paths
...
- hci_hal_h4: validate packet length and pointers in hci_packet_complete,
hdl_rx_adv_rpt, callbacks
- hci_layer: align hci_start_up error path and return; validate packet len in
filter_incoming_event
- hci_packet_factory: ensure BT_HDR length/offset initialized in make_command_no_params
- packet_fragmenter: validate length before fragment_and_dispatch
2026-03-18 16:38:24 +08:00
zhiweijian
b83647f5ea
fix(ble/bluedroid): Align config, controller indent and init error paths
...
- bt_target: remove/align obsolete macros with Kconfig
- device/controller: fix start_up() Secure Connections indent,
get_ble_resolving_list_max_size return type
- controller.h: align type/interface declarations with implementation
- bte_init: remove unused/redundant code
- bte_main: return -1 on osi_init failure, null check in bte_main_hci_send
2026-03-18 16:38:24 +08:00
zhiweijian
6f5d9e3440
fix(ble/bluedroid): Fix init failure handling, storage/config and GATT leaks
...
- btc_main: handle bte_main_boot_entry failure with cleanup and future_ready(FUTURE_FAIL)
- btc_ble_storage: fix key/length validation in _btc_storage_get_ble_bonding_key
- btc_config: align return/error contract with callers
- btc_dm: use safe BTA_SERVICE_ID_TO_SERVICE_MASK, fix sec_cb_handler type
- btc_gatt_util: fix btc_to_bta_response/set_read_value length and bounds
- btc_gatts: future_free on early return, max_nb_attr uint16_t, fail cleanup,
handle bounds
- btc_ble_cte/btc_iso_ble: fix callback type/param consistency with BTA
2026-03-18 16:38:24 +08:00
zhiweijian
f4cec2ac4e
fix(ble/bluedroid): Add null/range checks and fix resource handling in BTA layer
...
- bta_dm_int: fix BTA_SERVICE_ID_TO_SERVICE_MASK undefined behavior (1<<id when id>=32)
- bta_gattc_main: add event bounds check before state table lookup
- bta_gattc_utils: null checks for remote_bda/p_rcb, fix list_free in clcb_dealloc,
bta_to_btif_uuid fixes
- bta_gatts_act: fix formatting/indent in send_service_change_indication
- bta_gatts_api: validate attr_val/len, add error logs on alloc failure
- bta_sys_main: null/range checks in sm_execute, alarm/hash_map error handling in
bta_alarm_cb
2026-03-18 16:38:24 +08:00
Wang Meng Yang
594679aa73
Merge branch 'bugfix/fix_call_spp_start_discovert_twice_crash' into 'master'
...
fix(bt): fix crash when calling esp_spp_start_discovery twice in succession
Closes IDFCI-6478 and IDFCI-8863
See merge request espressif/esp-idf!46343
2026-03-16 19:04:10 +08:00
Wang Meng Yang
c941926ee7
Merge branch 'feat/bt_distance_test' into 'master'
...
feat(bt): Add APIs to read ACL real RSSI and read/write tx power of inq/iscan/page/pscan/ACL
Closes BT-4155
See merge request espressif/esp-idf!45601
2026-03-16 15:09:19 +08:00
Island
bdf808b34f
Merge branch 'feat/add_bluedroid_cancel_open_api' into 'master'
...
feat(ble/bluedroid): Added cancel open function for bluedroid
See merge request espressif/esp-idf!46305
2026-03-16 14:36:19 +08:00
Jin Cheng
34143d48ee
fix(bt/bluedroid): fixed possible use of uninitialized stack variables in bt_hf_client_at.c
2026-03-16 12:09:06 +08:00
Fu Hanxi
7d8b6549d0
Merge branch 'ci/missing_config_pre_commit_hook' into 'master'
...
ci: add pre-commit hook to detect missing configs
Closes IDFCI-2653
See merge request espressif/esp-idf!45826
2026-03-13 08:48:25 +01:00
Wang Meng Yang
13d8a6e405
Merge branch 'bugfix/report_hid_close_evt' into 'master'
...
fix(hid): Fixed HID repeatedly reporting the close event
Closes BT-4238
See merge request espressif/esp-idf!45593
2026-03-13 15:37:18 +08:00
yangfeng
7a0771d2c8
feat(bt): Add APIs to control transmit power level
...
- API to read ACL real RSSI
- APIs to read/write tx power of inq/iscan/page/pscan/ACL
2026-03-13 10:12:40 +08:00
yangfeng
cf554d6d61
fix(hid): Fixed HID repeatedly reporting the close event
2026-03-13 09:45:14 +08:00
Evgeny Torbin
d0f062c018
ci: remove unused test cases
2026-03-12 12:02:10 +01:00
xiongweichao
1d77103291
fix(bt): fix crash when calling esp_spp_start_discovery twice in succession
2026-03-12 02:06:05 +00:00
Sumeet Singh
54e4531d40
fix(nimble): modify logic to print mbuf in ble_hs_log_mbuf
2026-03-11 17:08:31 +05:30
zhiweijian
a3c09afd85
feat(ble/bluedroid): Added cancel open function for bluedroid
2026-03-10 10:25:10 +08:00
Jin Cheng
60f9362f83
fix(bt/bluedroid): fixed possible OOB read in avrc_pars_vendor_cmd
2026-03-10 08:43:56 +08:00
Island
596827eafd
Merge branch 'feat/use_common_config_to_sel_crypt_lib' into 'master'
...
Feat/use common config to sel crypt lib
See merge request espressif/esp-idf!45556
2026-03-09 14:16:31 +08:00
Island
249c55a741
Merge branch 'fix/use_apb_max_state_for_ble_events' into 'master'
...
fix(ble): use apb max state for bt and enable should skip
Closes BLERP-2616 and BLERP-2617
See merge request espressif/esp-idf!46296
2026-03-09 10:50:18 +08:00
Island
60be40b5f6
Merge branch 'bugfix/fix_kconfig_for_ble_cte_depends' into 'master'
...
bugfix(ble): remove BT_LE_SECURITY_ENABLE dependency for CTE on ESP32-C5
See merge request espressif/esp-idf!46325
2026-03-09 10:34:37 +08:00
Rahul Tank
e9d33797d7
Merge branch 'bugfix/fix_blufi_nimble_gatt_pkt' into 'master'
...
fix(blufi): Handle flattened ATT write payloads correctly in NimBLE BLUFI host
Closes BT-4264
See merge request espressif/esp-idf!46250
2026-03-06 20:59:59 +05:30
Geng Yuchao
403be0a770
fix(ble): remove error cte depends for esp32c5
2026-03-06 12:03:05 +08:00
cjin
ac8fe378a0
fix(ble): use apb max state for bt and enable should skip on ESP32-H2
2026-03-05 11:29:35 +08:00
cjin
73191cb5f9
fix(ble): use apb max state for bt and enable should skip on ESP32-C6
2026-03-05 11:29:23 +08:00
cjin
8365eb324f
fix(ble): use apb max state for bt and enable should skip on ESP32-C5
2026-03-05 11:29:19 +08:00