Zephyr v4.4.2-rc1

Issues fixed

These GitHub issues were addressed since the previous 4.4.1 tagged release:

• #103831 - Add mcxc242 lpuart dma support (async api)
• #104900 - Bluetooth LE host qualification for 4.4 release
• #104922 - drivers: nuvoton: hs usbd: control cmds stuck naking
• #106334 - Thread-safety race condition in net_buf_unref
• #107374 - ESP32 S3 doesn't boot if CONFIG_ESP32_WIFI_NET_ALLOC_SPIRAM is combined with CONFIG_SPI
• #107633 - USB-Next: CDC-ACM: Incomplete transmission on MCUmgr
• #108120 - STM32WBAx : Flash process request is not handled
• #108637 - tests/drivers/bbram/generic/ fails at random due to drivers/bbram/bbram_microchip_mcp7940n_emul.c
• #108793 - kernel: init: main thread not tagged K_FP_REGS when CONFIG_FPU && CONFIG_FPU_SHARING
• #109128 - fs: backend file resource leak when fs_open with FS_O_TRUNC fails during truncate
• #109383 - stm32wbax: bluetooth: issue when extended Advertising Data Packet length exceeds 250 bytes
• #109403 - net: icmpv6: missing source address guard in net_icmpv6_send_error (RFC 4443 2.4(e.6))
• #109460 - entropy: psa: ENTROPY_PSA_CRYPTO_RNG deprecated without migration path
• #109602 - espressif: esp32c5/esp32s3: fix PSRAM + Wi-Fi heap mapping and linker segment sizing bugs
• #109641 - west spdx fails on Windows if project is on a different drive
• #109907 - tests: dma: chan_blen_transfer: test case is not synchronized with transfer callback
• #110018 - drivers: gpio: esp32: GPIO deep sleep wakeup requires CONFIG_PM
• #110077 - k_pipe_read in ISR causing fault
• #110303 - Bluetooth: Mesh: PrivateBeaconKey PSA key leak after subnet deletion
• #110643 - drivers: stepper: adi_tmc: tmc51xx configure_ramp appears to use child device for clock lookup
• #110645 - net: sockets: recvmsg() ancillary-data capacity check undercounts cmsg size
• #110651 - usb: device_next: cdc_ncm: TX thread deadlocks when usbd_ep_enqueue() fails
• #110654 - drivers: can: nxp: flexcan: bus errors when transmitting leads to log flooding
• #110749 - drivers: uart: sercom g1: async RX of a 1-byte buffer writes one byte past the buffer
• #110757 - xtensa: ptables: deinitialized memory domain is left on the global domain list
• #110762 - bluetooth: classic: hfp_hf: cind_handle_values() writes past ind_table on a long +CIND list
• #110766 - drivers: serial: pl011: TX enable spins forever when CTS flow control blocks transmission
• #110771 - net: sockets: getaddrinfo() retry after a DNS timeout leaves the previous query in flight and touches stale stack state
• #110775 - Bluetooth: BAP: unicast client dereferences NULL stream->qos when a QoS Configured notification arrives before the stream is added to a group
• #110849 - bluetooth: classic: sdp: bt_sdp_parse_attribute() reads one byte past the buffer end
• #110854 - bluetooth: classic: rfcomm: session stuck and L2CAP channel leaked when both sides disconnect simultaneously
• #110857 - net: sntp: close-while-polling use-after-free in sntp_close_async
• #110866 - net: dns: .local suffix check reads past the end of the hostname string
• #110915 - pb-adv bearer resets the protocol timer unconditionally
• #110954 - drivers: disk: ftl: dhara callbacks write through NULL error pointer on flash error
• #110956 - Bluetooth: ISO: bt_iso_recv() pulls the SDU header without checking buf->len
• #110967 - Bluetooth: BAP: Broadcast Assistant shares one att_buf across all connections
• #111016 - kernel: userspace: dynamic kernel-object list freed under a different lock than it is traversed
• #111020 - usb: host: ctx->root left dangling after root device disconnect
• #111031 - tests/drivers/can/api/drivers.can.api fails on mutex
• #111032 - tests/net/lib/tls_credentials/net.tls_credentials.trusted_tfm fails on mutex
• #111056 - Wireguard replay issue
• #111082 - net: wireguard: incoming data packet can overflow the linearization buffer
• #111087 - kernel: k_thread_name_copy() syscall dereferences NULL for an unregistered thread pointer
• #111100 - kernel: pipe: a user thread can re-initialize a pipe that is already in use
• #111110 - kernel: poll: z_vrfy_k_poll() leaks events_copy when a k_poll_event carries an invalid object handle
• #111116 - pmci: mctp: I2C+GPIO target writes received bytes through an unchecked/unallocated packet buffer
• #111119 - drivers: spi: dw: spi_dw_configure() uses config->frequency as a divisor without validating it
• #111238 - net: http: server: spurious zsock_poll() return of 0 leaks sockets and corrupts the kernel timeout list
• #111277 - Neighbor solicitation header hop limit issue when CONFIG_NET_IPV6_ROUTE_MCAST is enabled
• #111345 - net: http_server: static filesystem handler serves files outside the web root for paths containing ".."
• #111407 - kernel: userspace: thread_idx_alloc() races on SMP and can hand out duplicate thread indices
• #111411 - ESP32-S3 + Octal PSRAM: runtime flash erase/write fails with ESP_ERR_NOT_FOUND (261) — esp_flash driver chip initialized before PSRAM re-tunes MSPI
• #111412 - drivers: i2c: i2c_dw: target stays stuck in CMD_SEND, write_requested() stops firing
• #111416 - logging: z_vrfy_log_filter_set() accepts a negative src_id and indexes outside log_dynamic
• #111420 - debug: coredump/shell: out-of-bounds read printing a stored coredump's target
• #111427 - bluetooth: host: gatt_write_ccc_rsp() uses subscription params after releasing them
• #111431 - net: ip: forwarded packets keep their original TTL / hop-limit (no decrement on the routing path)
• #111447 - tests: arch: arm: Exclude custom IRQ controllers from IRQ test
• #111481 - drivers: display: display_ili9xxx.c: x/y resolution changes breaks sample
• #111534 - Bluetooth: GATT: notify/indicate checks the declaration's permissions, not the value's, when passed a characteristic declaration
• #111545 - hal_espressif Kconfig can cause build to crashes if ZEPHYR_HAL_ESPRESSIF_MODULE_DIR is undefined
• #111564 - bluetooth: host: classic: l2cap_br: Fix conf req/rsp length validation
• #111888 - drivers: pwm: mcux_sctimer: counter stranded when device resumes before first channel config
• #111929 - net: bridge: Memory leak on broadcast, multicast or matching MAC in eth_bridge_input_process.
• #111935 - flash: z_vrfy_flash_copy is missing proper set of K_SYSCALL_DRIVER_FLASH invocations
• #111936 - fs: ext2: Avoid using 0 value inode and block per group in calculations
• #112027 - Bluetooth: esp32c3: bonding with pairing keys on Zephyr 4.4.1 hangs
• #112204 - net: sockets: recvmsg() ancillary write checks total buffer, not room at the chosen slot
• #112211 - Bluetooth: BAP: UC: NULL stream->group dereference on QoS Configured notification
• #112235 - az3166_iotdevkit: Button B never gets released
• #112315 - fs: ext2: Lack of validation of s_block_count, read from superblock, permitted block bitmap to be larger than ext2 block size
• #112325 - Out-of-bounds read in PTP receive path: unchecked 4-bit message type indexes
• #112421 - net: dhcp: name-lookup bounds checks use sizeof() instead of ARRAY_SIZE()
• #112424 - net: ocpp: RPC-frame field parsing reads past fixed buffers on long/unterminated input
• #112427 - mgmt: hawkbit: 1-byte heap overrun when NUL-terminating the response buffer
• #112430 - Bluetooth: Host: bt_att_sent dereferences a freed channel after disconnect mid-transfer
• #112432 - drivers: flash: sf32lb_mpi_qspi_nor: read/write offset check wraps on a negative offset
• #112435 - kernel: k_queue_peek_head()/k_queue_peek_tail() dereference a node without holding the queue lock
• #112441 - mgmt: updatehub: socket leak, NULL deref, and concurrency bugs in the OTA client
• #112555 - drivers: bluetooth: hci_bflb / hci_bee: send() consumes the buffer on error paths
• #112559 - usb: device_next: dfu: handle_download() dereferences buf without a NULL check
• #112609 - drivers: usb: udc: MAX32 USB driver problem about nodata setup messages
• #112613 - usb: device_next: CDC NCM to-host control handler ignores wLength when building responses
• #112616 - net: sockets: userspace sendmsg/recvmsg verifiers re-read live user msghdr after copying it
• #112621 - llext: ELF loader indexes arrays and sizes a stack VLA from unvalidated module header fields
• #112782 - mgmt/settings: heap buffers leaked on access-hook and OOM paths in settings read/write/delete
• #112838 - Bluetooth: Host: GATT: parse_read_std_char_desc() loops forever when a Read By Type Response has len 0
• #112852 - logging: z_vrfy_z_log_msg_static_create() does not validate its arguments
• #112931 - serial: pl011: error interrupts are never acknowledged and stay latched
• #113039 - drivers: modem: hl7800 and wncm14a2a AT-response handlers write past fixed stack buffers
• #113043 - net: 6lo: get_ihpc_inlined_size() reads past da_inline_size_table for reserved destination modes
• #113048 - net: ipv6: handle_ra_6co() underflows memset length for context_len > 128
• #113159 - LVGL Dynamic allocation doesn't work
• #113265 - Bluetooth: Host: AoD 2US CTE type not validated in valid_conn_cte_tx_params()
• #113266 - kernel: thread: thread_obj_validate() fails to oops a denied k_thread_join/k_thread_abort
• #113299 - net: route: net_route_packet_if() forwards packets without decrementing the hop limit
• #113303 - wifi: airoc: TX net_buf is leaked when whd_network_send_ethernet_data() fails
• #113307 - mbox: userspace: z_vrfy_mbox_send validates msg->data then forwards the mutable userspace pointer
• #113324 - fs: ext2: mount does not validate superblock s_log_block_size
• #113328 - net: ocpp: server-message parsers mishandle malformed and oversized fields
• #113339 - midi2: UMP Stream notification replies transmit uninitialised stack bytes
• #113343 - drivers: virtio: device-supplied ring id and PCI cap_len used without bounds checking
• #113346 - bluetooth: audio: has: notification work runs with NULL attributes when a bonded peer reconnects before bt_has_register()
• #113352 - net: ptp: MGMT_TIME management TLV is parsed without a length check
• #113354 - lorawan: services parse downlink commands without checking remaining payload length
• #113435 - i3c: ibi: data race on the IBI work node free-list between ISR and workqueue thread
• #113443 - net: lwm2m: JSON get_string() writes the NUL terminator one byte past the buffer
• #113464 - Secure Storage nonce generation is not thread-safe
• #113521 - drivers: wifi: siwx91x: TX path unrefs a caller-owned net_pkt
• #113568 - driver: esp32_spi: esp p4 derrives wrong SPI clock
• #113653 - net: ipv6: NS packet is leaked when the neighbor already has a pending packet
• #113684 - net: ipv6: Zero reachable time from Router Advertisement assertion
• #113695 - drivers: i2c: it51xxx: target FIFO ISR writes past target_in_buffer on an oversized write transaction
• #113698 - bluetooth: classic: l2cap: BR/EDR receive path processes data on channels that are not yet established
• #113702 - drivers: modem: hl78xx: GNSS NMEA match data is not the first member of hl78xx_gnss_data
• #113712 - net: mqtt_sn: NULL dereference in process_ping() when a gateway stops responding
• #113729 - sd: sdio: byte-I/O loop spins forever when a card reports max_blk_size == 0
• #113735 - net: sockets: tls: concurrent client sockets race on the shared session cache
• #113755 - net: ocpp: atoi() is called on an unchecked strtok_r() result when a CALLRESULT uid has no second token
• #113845 - drivers: udc: it82xx2: OUT-transfer buffer reuse and suspend-work re-init corrupt kernel state
• #114085 - drivers: display: ls0xx: releases SPI bus too soon
• #114233 - net: bridge: RX net_pkt is leaked when a bridged frame is kept for local processing
• #114320 - rtio: syscall verifiers dereference unvalidated user pointers in sqe_cancel() and sqe_copy_in_get_handles()
• #114337 - net: gptp: receive path dereferences and iterates past the received packet data
• #114495 - drivers: can: stm32: bxcan: maximum filter ID should not take split-filter banks into consideration
• #114502 - usb: host: configuration descriptor is freed twice when enumeration fails
• #114506 - drivers: tgpio: tgpio_pin_read_ts_ec handler does not validate its output pointers
• #114522 - smbus: remove_cb syscalls forward an unvalidated user pointer into the driver
• #114526 - drivers: wifi: esp_hosted: RX path parses an unvalidated TLV length and can permanently stop the event thread