From 19178b6b329166e497abfdba92d70eeee6c3c61a Mon Sep 17 00:00:00 2001 From: Lingao Meng Date: Wed, 4 Dec 2024 09:09:51 +0100 Subject: [PATCH 1/8] [nrf fromtree] Bluetooth: Mesh: Fix proxy advertising set sending Mesh messages MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When start to sending proxy advertising, will also process in send_pending_adv, but the bt_mesh_adv_get_by_tag will directly return buffer from bt_mesh_adv_queue or bt_mesh_relay_queue, which case mesh messages sent on different sets, can cause peer replay attack. Signed-off-by: Lingao Meng (cherry picked from commit b54f49cb8c1c6155859100d9af2106be0bea7fc4) Signed-off-by: Håvard Reierstad --- subsys/bluetooth/mesh/adv.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/subsys/bluetooth/mesh/adv.c b/subsys/bluetooth/mesh/adv.c index 7cc163ba8f8..2f406e52f9a 100644 --- a/subsys/bluetooth/mesh/adv.c +++ b/subsys/bluetooth/mesh/adv.c @@ -233,6 +233,11 @@ struct bt_mesh_adv *bt_mesh_adv_get_by_tag(enum bt_mesh_adv_tag_bit tags, k_time return k_fifo_get(&bt_mesh_relay_queue, timeout); } + if (IS_ENABLED(CONFIG_BT_MESH_ADV_EXT_GATT_SEPARATE) && + tags & BT_MESH_ADV_TAG_BIT_PROXY) { + return NULL; + } + return bt_mesh_adv_get(timeout); } From f4ada6ddd9d21698fc10e29030f9dc9a8cc9dec6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?H=C3=A5vard=20Reierstad?= Date: Wed, 4 Dec 2024 09:09:51 +0100 Subject: [PATCH 2/8] [nrf fromtree] Bluetooth: Mesh: Use net xmit params for bridge MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Makes sure that the Network Transmit state is used when using a Subnet Bridge. Signed-off-by: Håvard Reierstad (cherry picked from commit b38773f14b90c63c2da0d980ef4c725aefb4a140) Signed-off-by: Håvard Reierstad --- subsys/bluetooth/mesh/net.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/subsys/bluetooth/mesh/net.c b/subsys/bluetooth/mesh/net.c index 25d0551a2ee..cf95884fd5a 100644 --- a/subsys/bluetooth/mesh/net.c +++ b/subsys/bluetooth/mesh/net.c @@ -705,7 +705,7 @@ static void bt_mesh_net_relay(struct net_buf_simple *sbuf, struct bt_mesh_net_rx * Anything else (like GATT to adv, or locally originated packets) * use the Network Transmit state. */ - if (rx->net_if == BT_MESH_NET_IF_ADV && !rx->friend_cred) { + if (rx->net_if == BT_MESH_NET_IF_ADV && !rx->friend_cred && !bridge) { transmit = bt_mesh_relay_retransmit_get(); } else { transmit = bt_mesh_net_transmit_get(); From 36193a7202a91eaeecfdcbff7a892d8038980038 Mon Sep 17 00:00:00 2001 From: Pavel Vasilyev Date: Wed, 4 Dec 2024 09:09:51 +0100 Subject: [PATCH 3/8] [nrf fromtree] bluetooth: mesh: Use bt_get_name to get device name MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit By default if CONFIG_BT_MESH_PROXY_USE_DEVICE_NAME or CONFIG_BT_MESH_PB_GATT_USE_DEVICE_NAME is enabled, the mesh stack will add BT_DATA_NAME_COMPLETE AD Type along with the Mesh Proxy Service or Mesh Provisioning Service advertisements accordingly. When BT_LE_ADV_OPT_USE_NAME was present and CONFIG_BT_DEVICE_NAME_DYNAMIC is enabled, the advertised name was automatically updated by the host. This turned out to be a side-effect rather than expected behavior and after #71700 this behavior waa changed. But customers use dynamic name feature. This commit makes the mesh stack use bt_get_name to get the device name, which returns runtime name if CONFIG_BT_DEVICE_NAME_DYNAMIC is enabled. Signed-off-by: Pavel Vasilyev (cherry picked from commit ab346a1dd0298776af43a6d8b9f84ce7e28cb10f) Signed-off-by: Håvard Reierstad --- subsys/bluetooth/mesh/pb_gatt_srv.c | 13 ++++++------- subsys/bluetooth/mesh/proxy.h | 6 ++++++ subsys/bluetooth/mesh/proxy_srv.c | 29 +++++++++++++++++++++-------- 3 files changed, 33 insertions(+), 15 deletions(-) diff --git a/subsys/bluetooth/mesh/pb_gatt_srv.c b/subsys/bluetooth/mesh/pb_gatt_srv.c index 85b60cbe0fd..6f257a16e82 100644 --- a/subsys/bluetooth/mesh/pb_gatt_srv.c +++ b/subsys/bluetooth/mesh/pb_gatt_srv.c @@ -243,13 +243,12 @@ static size_t gatt_prov_adv_create(struct bt_data prov_sd[2]) prov_sd_len += 1; dev_name: -#if defined(CONFIG_BT_MESH_PB_GATT_USE_DEVICE_NAME) - prov_sd[prov_sd_len].type = BT_DATA_NAME_COMPLETE; - prov_sd[prov_sd_len].data_len = sizeof(CONFIG_BT_DEVICE_NAME) - 1; - prov_sd[prov_sd_len].data = CONFIG_BT_DEVICE_NAME; - - prov_sd_len += 1; -#endif + if (IS_ENABLED(CONFIG_BT_MESH_PB_GATT_USE_DEVICE_NAME)) { + prov_sd[prov_sd_len].type = BT_DATA_NAME_COMPLETE; + prov_sd[prov_sd_len].data_len = BT_DEVICE_NAME_LEN; + prov_sd[prov_sd_len].data = BT_DEVICE_NAME; + prov_sd_len += 1; + } return prov_sd_len; } diff --git a/subsys/bluetooth/mesh/proxy.h b/subsys/bluetooth/mesh/proxy.h index 34a119c3df6..c56e9dab0d1 100644 --- a/subsys/bluetooth/mesh/proxy.h +++ b/subsys/bluetooth/mesh/proxy.h @@ -18,6 +18,12 @@ .interval_min = BT_GAP_ADV_FAST_INT_MIN_2, \ .interval_max = BT_GAP_ADV_FAST_INT_MAX_2 +#define BT_DEVICE_NAME (IS_ENABLED(CONFIG_BT_DEVICE_NAME_DYNAMIC) ? \ + (const uint8_t *)bt_get_name() : \ + (const uint8_t *)CONFIG_BT_DEVICE_NAME) +#define BT_DEVICE_NAME_LEN (IS_ENABLED(CONFIG_BT_DEVICE_NAME_DYNAMIC) ? strlen(bt_get_name()) : \ + (sizeof(CONFIG_BT_DEVICE_NAME) - 1)) + #define BT_MESH_ID_TYPE_NET 0x00 #define BT_MESH_ID_TYPE_NODE 0x01 #define BT_MESH_ID_TYPE_PRIV_NET 0x02 diff --git a/subsys/bluetooth/mesh/proxy_srv.c b/subsys/bluetooth/mesh/proxy_srv.c index 32e865773b3..39bfac07792 100644 --- a/subsys/bluetooth/mesh/proxy_srv.c +++ b/subsys/bluetooth/mesh/proxy_srv.c @@ -483,12 +483,6 @@ static const struct bt_data net_id_ad[] = { BT_DATA(BT_DATA_SVC_DATA16, proxy_svc_data, NET_ID_LEN), }; -static const struct bt_data sd[] = { -#if defined(CONFIG_BT_MESH_PROXY_USE_DEVICE_NAME) - BT_DATA(BT_DATA_NAME_COMPLETE, CONFIG_BT_DEVICE_NAME, sizeof(CONFIG_BT_DEVICE_NAME) - 1), -#endif -}; - static int randomize_bt_addr(void) { /* TODO: There appears to be no way to force an RPA/NRPA refresh. */ @@ -510,6 +504,7 @@ static int enc_id_adv(struct bt_mesh_subnet *sub, uint8_t type, type == BT_MESH_ID_TYPE_PRIV_NODE), ADV_FAST_INT, }; + struct bt_data sd[1]; int err; err = bt_mesh_encrypt(&sub->keys[SUBNET_KEY_TX_IDX(sub)].identity, hash, hash); @@ -529,9 +524,17 @@ static int enc_id_adv(struct bt_mesh_subnet *sub, uint8_t type, proxy_svc_data[2] = type; memcpy(&proxy_svc_data[3], &hash[8], 8); + if (IS_ENABLED(CONFIG_BT_MESH_PROXY_USE_DEVICE_NAME)) { + sd[0].type = BT_DATA_NAME_COMPLETE; + sd[0].data_len = BT_DEVICE_NAME_LEN; + sd[0].data = BT_DEVICE_NAME; + } + err = bt_mesh_adv_gatt_start( type == BT_MESH_ID_TYPE_PRIV_NET ? &slow_adv_param : &fast_adv_param, - duration, enc_id_ad, ARRAY_SIZE(enc_id_ad), sd, ARRAY_SIZE(sd)); + duration, enc_id_ad, ARRAY_SIZE(enc_id_ad), + IS_ENABLED(CONFIG_BT_MESH_PROXY_USE_DEVICE_NAME) ? sd : NULL, + IS_ENABLED(CONFIG_BT_MESH_PROXY_USE_DEVICE_NAME) ? ARRAY_SIZE(sd) : 0); if (err) { LOG_WRN("Failed to advertise using type 0x%02x (err %d)", type, err); return err; @@ -607,6 +610,7 @@ static int net_id_adv(struct bt_mesh_subnet *sub, int32_t duration) .options = ADV_OPT_PROXY(false), ADV_SLOW_INT, }; + struct bt_data sd[1]; int err; proxy_svc_data[2] = BT_MESH_ID_TYPE_NET; @@ -615,8 +619,17 @@ static int net_id_adv(struct bt_mesh_subnet *sub, int32_t duration) memcpy(proxy_svc_data + 3, sub->keys[SUBNET_KEY_TX_IDX(sub)].net_id, 8); + if (IS_ENABLED(CONFIG_BT_MESH_PROXY_USE_DEVICE_NAME)) { + sd[0].type = BT_DATA_NAME_COMPLETE; + sd[0].data_len = BT_DEVICE_NAME_LEN; + sd[0].data = BT_DEVICE_NAME; + } + err = bt_mesh_adv_gatt_start(&slow_adv_param, duration, net_id_ad, - ARRAY_SIZE(net_id_ad), sd, ARRAY_SIZE(sd)); + ARRAY_SIZE(net_id_ad), + IS_ENABLED(CONFIG_BT_MESH_PROXY_USE_DEVICE_NAME) ? sd : NULL, + IS_ENABLED(CONFIG_BT_MESH_PROXY_USE_DEVICE_NAME) ? + ARRAY_SIZE(sd) : 0); if (err) { LOG_WRN("Failed to advertise using Network ID (err %d)", err); return err; From f7015b1904d0eb01c40105330cd83036b4be1535 Mon Sep 17 00:00:00 2001 From: Pavel Vasilyev Date: Wed, 4 Dec 2024 09:09:51 +0100 Subject: [PATCH 4/8] [nrf fromtree] bluetooth: mesh: gatt: Move generic GATT related defines to gatt.h MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This moves GATT releated defines that are used by both Mesh Proxy Service and Mesh Provisioning Service implementations to a common header file. Signed-off-by: Pavel Vasilyev (cherry picked from commit 684c94e4690c15e590707e9aeb9974d67b8fdd53) Signed-off-by: Håvard Reierstad --- subsys/bluetooth/mesh/gatt.h | 19 +++++++++++++++++++ subsys/bluetooth/mesh/pb_gatt_srv.c | 1 + subsys/bluetooth/mesh/proxy.h | 14 -------------- subsys/bluetooth/mesh/proxy_srv.c | 1 + 4 files changed, 21 insertions(+), 14 deletions(-) create mode 100644 subsys/bluetooth/mesh/gatt.h diff --git a/subsys/bluetooth/mesh/gatt.h b/subsys/bluetooth/mesh/gatt.h new file mode 100644 index 00000000000..ee5edf9cadc --- /dev/null +++ b/subsys/bluetooth/mesh/gatt.h @@ -0,0 +1,19 @@ +/* + * Copyright (c) 2024 Nordic Semiconductor ASA + * + * SPDX-License-Identifier: Apache-2.0 + */ + +#define ADV_SLOW_INT \ + .interval_min = BT_GAP_ADV_SLOW_INT_MIN, \ + .interval_max = BT_GAP_ADV_SLOW_INT_MAX + +#define ADV_FAST_INT \ + .interval_min = BT_GAP_ADV_FAST_INT_MIN_2, \ + .interval_max = BT_GAP_ADV_FAST_INT_MAX_2 + +#define BT_DEVICE_NAME (IS_ENABLED(CONFIG_BT_DEVICE_NAME_DYNAMIC) ? \ + (const uint8_t *)bt_get_name() : \ + (const uint8_t *)CONFIG_BT_DEVICE_NAME) +#define BT_DEVICE_NAME_LEN (IS_ENABLED(CONFIG_BT_DEVICE_NAME_DYNAMIC) ? strlen(bt_get_name()) : \ + (sizeof(CONFIG_BT_DEVICE_NAME) - 1)) diff --git a/subsys/bluetooth/mesh/pb_gatt_srv.c b/subsys/bluetooth/mesh/pb_gatt_srv.c index 6f257a16e82..24211edea70 100644 --- a/subsys/bluetooth/mesh/pb_gatt_srv.c +++ b/subsys/bluetooth/mesh/pb_gatt_srv.c @@ -26,6 +26,7 @@ #include "foundation.h" #include "access.h" #include "proxy.h" +#include "gatt.h" #include "proxy_msg.h" #include "pb_gatt_srv.h" diff --git a/subsys/bluetooth/mesh/proxy.h b/subsys/bluetooth/mesh/proxy.h index c56e9dab0d1..102ff1834a7 100644 --- a/subsys/bluetooth/mesh/proxy.h +++ b/subsys/bluetooth/mesh/proxy.h @@ -10,20 +10,6 @@ #define ADV_OPT_USE_IDENTITY 0 #endif -#define ADV_SLOW_INT \ - .interval_min = BT_GAP_ADV_SLOW_INT_MIN, \ - .interval_max = BT_GAP_ADV_SLOW_INT_MAX - -#define ADV_FAST_INT \ - .interval_min = BT_GAP_ADV_FAST_INT_MIN_2, \ - .interval_max = BT_GAP_ADV_FAST_INT_MAX_2 - -#define BT_DEVICE_NAME (IS_ENABLED(CONFIG_BT_DEVICE_NAME_DYNAMIC) ? \ - (const uint8_t *)bt_get_name() : \ - (const uint8_t *)CONFIG_BT_DEVICE_NAME) -#define BT_DEVICE_NAME_LEN (IS_ENABLED(CONFIG_BT_DEVICE_NAME_DYNAMIC) ? strlen(bt_get_name()) : \ - (sizeof(CONFIG_BT_DEVICE_NAME) - 1)) - #define BT_MESH_ID_TYPE_NET 0x00 #define BT_MESH_ID_TYPE_NODE 0x01 #define BT_MESH_ID_TYPE_PRIV_NET 0x02 diff --git a/subsys/bluetooth/mesh/proxy_srv.c b/subsys/bluetooth/mesh/proxy_srv.c index 39bfac07792..63d7755df1a 100644 --- a/subsys/bluetooth/mesh/proxy_srv.c +++ b/subsys/bluetooth/mesh/proxy_srv.c @@ -28,6 +28,7 @@ #include "foundation.h" #include "access.h" #include "proxy.h" +#include "gatt.h" #include "proxy_msg.h" #include "crypto.h" From 628fe592d6945ddb8de73456d6dbe31e290b7d1e Mon Sep 17 00:00:00 2001 From: Pavel Vasilyev Date: Wed, 4 Dec 2024 09:09:51 +0100 Subject: [PATCH 5/8] [nrf fromtree] bluetooth: mesh: proxy_msg: Fix extracting role from k_work MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fix extracting role from k_work. Hot fix for #78914 Signed-off-by: Pavel Vasilyev (cherry picked from commit f5409bd3deba779263fb58bb06a0573e034795cf) Signed-off-by: Håvard Reierstad --- subsys/bluetooth/mesh/proxy_msg.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/subsys/bluetooth/mesh/proxy_msg.c b/subsys/bluetooth/mesh/proxy_msg.c index 861935f58cc..edee3ad384c 100644 --- a/subsys/bluetooth/mesh/proxy_msg.c +++ b/subsys/bluetooth/mesh/proxy_msg.c @@ -252,11 +252,9 @@ int bt_mesh_proxy_relay_send(struct bt_conn *conn, struct bt_mesh_adv *adv) static void proxy_msg_send_pending(struct k_work *work) { - struct bt_mesh_proxy_role *role; - struct k_work_delayable *dwork = k_work_delayable_from_work(work); + struct bt_mesh_proxy_role *role = CONTAINER_OF(work, struct bt_mesh_proxy_role, work); struct bt_mesh_adv *adv; - role = CONTAINER_OF(dwork, struct bt_mesh_proxy_role, sar_timer); if (!role->conn) { return; } From 84ab9deeb3551d6ee5be64b251ba5a9704c5663c Mon Sep 17 00:00:00 2001 From: Pavel Vasilyev Date: Wed, 4 Dec 2024 09:09:51 +0100 Subject: [PATCH 6/8] [nrf fromtree] bluetooth: mesh: cfg_cli: Check buf len when pulling out data MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This commit checks that config client doesn't pull out data outside of the buffer. Fixes #80012 Signed-off-by: Pavel Vasilyev (cherry picked from commit e2a0fafe423ae616c52223cf254132d8f3159162) Signed-off-by: Håvard Reierstad --- subsys/bluetooth/mesh/cfg_cli.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/subsys/bluetooth/mesh/cfg_cli.c b/subsys/bluetooth/mesh/cfg_cli.c index aa762e9b906..225b60e84a8 100644 --- a/subsys/bluetooth/mesh/cfg_cli.c +++ b/subsys/bluetooth/mesh/cfg_cli.c @@ -2332,6 +2332,10 @@ struct bt_mesh_comp_p1_elem *bt_mesh_comp_p1_elem_pull(struct net_buf_simple *bu elem->nsig = net_buf_simple_pull_u8(buf); elem->nvnd = net_buf_simple_pull_u8(buf); for (i = 0; i < elem->nsig + elem->nvnd; i++) { + if (buf->len < elem_size + 1) { + return NULL; + } + header = buf->data[elem_size]; cor_present = COR_PRESENT(header); fmt = FMT(header); @@ -2346,6 +2350,10 @@ struct bt_mesh_comp_p1_elem *bt_mesh_comp_p1_elem_pull(struct net_buf_simple *bu elem_size += (1 + cor_present) + (fmt + 1) * ext_item_cnt; } + if (buf->len < elem_size) { + return NULL; + } + net_buf_simple_init_with_data(elem->_buf, net_buf_simple_pull_mem(buf, elem_size), elem_size); @@ -2372,9 +2380,17 @@ struct bt_mesh_comp_p1_model_item *bt_mesh_comp_p1_item_pull( item->ext_item_cnt = EXT_ITEM_CNT(header); item_size = item->ext_item_cnt * (item->format + 1); if (item->cor_present) { + if (elem->_buf->len < 1) { + return NULL; + } + item->cor_id = net_buf_simple_pull_u8(elem->_buf); } + if (elem->_buf->len < item_size) { + return NULL; + } + net_buf_simple_init_with_data(item->_buf, net_buf_simple_pull_mem(elem->_buf, item_size), item_size); From 9fafef7c8899cae25f279321e4b9d2e624435d59 Mon Sep 17 00:00:00 2001 From: Pavel Vasilyev Date: Wed, 4 Dec 2024 09:09:51 +0100 Subject: [PATCH 7/8] [nrf fromtree] bluetooth: mesh: cfg_cli: Update logs when pulling out CDP0 and 1 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This commits puts in order log messages when unpacking CDP0 and CDP1 so that it a bit more clear where the error happens. Signed-off-by: Pavel Vasilyev (cherry picked from commit 1eeee010bd00be90acfc0693cfdf04970d45e006) Signed-off-by: Håvard Reierstad --- subsys/bluetooth/mesh/cfg_cli.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/subsys/bluetooth/mesh/cfg_cli.c b/subsys/bluetooth/mesh/cfg_cli.c index 225b60e84a8..9c4301e0b09 100644 --- a/subsys/bluetooth/mesh/cfg_cli.c +++ b/subsys/bluetooth/mesh/cfg_cli.c @@ -2275,6 +2275,7 @@ struct bt_mesh_comp_p0_elem *bt_mesh_comp_p0_elem_pull(const struct bt_mesh_comp size_t modlist_size; if (page->_buf->len < 4) { + LOG_DBG("Buffer is too short"); return NULL; } @@ -2285,6 +2286,7 @@ struct bt_mesh_comp_p0_elem *bt_mesh_comp_p0_elem_pull(const struct bt_mesh_comp modlist_size = elem->nsig * 2 + elem->nvnd * 4; if (page->_buf->len < modlist_size) { + LOG_DBG("Buffer is shorter than number of claimed models"); return NULL; } @@ -2321,7 +2323,7 @@ struct bt_mesh_comp_p1_elem *bt_mesh_comp_p1_elem_pull(struct net_buf_simple *bu struct bt_mesh_comp_p1_elem *elem) { if (buf->len < 4) { - LOG_DBG("No more elements to pull or missing data"); + LOG_DBG("Buffer is too short"); return NULL; } size_t elem_size = 0; @@ -2333,6 +2335,7 @@ struct bt_mesh_comp_p1_elem *bt_mesh_comp_p1_elem_pull(struct net_buf_simple *bu elem->nvnd = net_buf_simple_pull_u8(buf); for (i = 0; i < elem->nsig + elem->nvnd; i++) { if (buf->len < elem_size + 1) { + LOG_DBG("Buffer is shorter than number of claimed models"); return NULL; } @@ -2351,6 +2354,7 @@ struct bt_mesh_comp_p1_elem *bt_mesh_comp_p1_elem_pull(struct net_buf_simple *bu } if (buf->len < elem_size) { + LOG_DBG("No more elements to pull or missing data"); return NULL; } @@ -2381,6 +2385,7 @@ struct bt_mesh_comp_p1_model_item *bt_mesh_comp_p1_item_pull( item_size = item->ext_item_cnt * (item->format + 1); if (item->cor_present) { if (elem->_buf->len < 1) { + LOG_DBG("Coresponding_Present field is claimed but not present"); return NULL; } @@ -2388,6 +2393,7 @@ struct bt_mesh_comp_p1_model_item *bt_mesh_comp_p1_item_pull( } if (elem->_buf->len < item_size) { + LOG_DBG("No more elements to pull or missing data"); return NULL; } From 1f094df027d5a50a843dc4e2777daadfa8af13f9 Mon Sep 17 00:00:00 2001 From: Ludvig Jordet Date: Wed, 4 Dec 2024 09:09:51 +0100 Subject: [PATCH 8/8] [nrf fromtree] Bluetooth: Mesh: Fix cfg_cli KRP not working for key_net_idx != 0 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Initializes the `net_idx` field of the ack context properly for KRP functions in the Config Client. This fixes a problem where `bt_mesh_cfg_cli_krp_get` and `bt_mesh_cfg_cli_krp_set` would always fail the ack ctx comparison if `key_net_idx` was != 0. Signed-off-by: Ludvig Jordet (cherry picked from commit 88f62a1a5eb5cdf51a9d5a2d847712c9b33f3193) Signed-off-by: Håvard Reierstad --- subsys/bluetooth/mesh/cfg_cli.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/subsys/bluetooth/mesh/cfg_cli.c b/subsys/bluetooth/mesh/cfg_cli.c index 9c4301e0b09..20e7ec065b4 100644 --- a/subsys/bluetooth/mesh/cfg_cli.c +++ b/subsys/bluetooth/mesh/cfg_cli.c @@ -1187,6 +1187,7 @@ int bt_mesh_cfg_cli_krp_get(uint16_t net_idx, uint16_t addr, uint16_t key_net_id struct krp_param param = { .status = status, .phase = phase, + .net_idx = key_net_idx, }; const struct bt_mesh_msg_rsp_ctx rsp = { .ack = &cli->ack_ctx, @@ -1209,6 +1210,7 @@ int bt_mesh_cfg_cli_krp_set(uint16_t net_idx, uint16_t addr, uint16_t key_net_id struct krp_param param = { .status = status, .phase = phase, + .net_idx = key_net_idx, }; const struct bt_mesh_msg_rsp_ctx rsp = { .ack = &cli->ack_ctx,