Mesh 2.9 cherry picks

subsys/bluetooth/mesh/adv.c

@@ -233,6 +233,11 @@
 		return k_fifo_get(&bt_mesh_relay_queue, timeout);
 	}
 
+	if (IS_ENABLED(CONFIG_BT_MESH_ADV_EXT_GATT_SEPARATE) &&
+	    tags & BT_MESH_ADV_TAG_BIT_PROXY) {
+		return NULL;
+	}
+
 	return bt_mesh_adv_get(timeout);
 }
 

subsys/bluetooth/mesh/cfg_cli.c

@@ -1187,6 +1187,7 @@ int bt_mesh_cfg_cli_krp_get(uint16_t net_idx, uint16_t addr, uint16_t key_net_id
 	struct krp_param param = {
 		.status = status,
 		.phase = phase,
+		.net_idx = key_net_idx,
 	};
 	const struct bt_mesh_msg_rsp_ctx rsp = {
 		.ack = &cli->ack_ctx,
@@ -1209,6 +1210,7 @@ int bt_mesh_cfg_cli_krp_set(uint16_t net_idx, uint16_t addr, uint16_t key_net_id
 	struct krp_param param = {
 		.status = status,
 		.phase = phase,
+		.net_idx = key_net_idx,
 	};
 	const struct bt_mesh_msg_rsp_ctx rsp = {
 		.ack = &cli->ack_ctx,
@@ -2275,6 +2277,7 @@ struct bt_mesh_comp_p0_elem *bt_mesh_comp_p0_elem_pull(const struct bt_mesh_comp
 	size_t modlist_size;
 
 	if (page->_buf->len < 4) {
+		LOG_DBG("Buffer is too short");
 		return NULL;
 	}
 
@@ -2285,6 +2288,7 @@ struct bt_mesh_comp_p0_elem *bt_mesh_comp_p0_elem_pull(const struct bt_mesh_comp
 	modlist_size = elem->nsig * 2 + elem->nvnd * 4;
 
 	if (page->_buf->len < modlist_size) {
+		LOG_DBG("Buffer is shorter than number of claimed models");
 		return NULL;
 	}
 
@@ -2321,7 +2325,7 @@ struct bt_mesh_comp_p1_elem *bt_mesh_comp_p1_elem_pull(struct net_buf_simple *bu
 						       struct bt_mesh_comp_p1_elem *elem)
 {
 	if (buf->len < 4) {
-		LOG_DBG("No more elements to pull or missing data");
+		LOG_DBG("Buffer is too short");
 		return NULL;
 	}
 	size_t elem_size = 0;
@@ -2332,6 +2336,11 @@ struct bt_mesh_comp_p1_elem *bt_mesh_comp_p1_elem_pull(struct net_buf_simple *bu
 	elem->nsig = net_buf_simple_pull_u8(buf);
 	elem->nvnd = net_buf_simple_pull_u8(buf);
 	for (i = 0; i < elem->nsig + elem->nvnd; i++) {
+		if (buf->len < elem_size + 1) {
+			LOG_DBG("Buffer is shorter than number of claimed models");
+			return NULL;
+		}
+
 		header = buf->data[elem_size];
 		cor_present = COR_PRESENT(header);
 		fmt = FMT(header);
@@ -2346,6 +2355,11 @@ struct bt_mesh_comp_p1_elem *bt_mesh_comp_p1_elem_pull(struct net_buf_simple *bu
 		elem_size += (1 + cor_present) + (fmt + 1) * ext_item_cnt;
 	}
 
+	if (buf->len < elem_size) {
+		LOG_DBG("No more elements to pull or missing data");
+		return NULL;
+	}
+
 	net_buf_simple_init_with_data(elem->_buf,
 				      net_buf_simple_pull_mem(buf, elem_size),
 				      elem_size);
@@ -2372,9 +2386,19 @@ struct bt_mesh_comp_p1_model_item *bt_mesh_comp_p1_item_pull(
 	item->ext_item_cnt = EXT_ITEM_CNT(header);
 	item_size = item->ext_item_cnt * (item->format + 1);
 	if (item->cor_present) {
+		if (elem->_buf->len < 1) {
+			LOG_DBG("Coresponding_Present field is claimed but not present");
+			return NULL;
+		}
+
 		item->cor_id = net_buf_simple_pull_u8(elem->_buf);
 	}
 
+	if (elem->_buf->len < item_size) {
+		LOG_DBG("No more elements to pull or missing data");
+		return NULL;
+	}
+
 	net_buf_simple_init_with_data(item->_buf,
 				      net_buf_simple_pull_mem(elem->_buf, item_size),
 				      item_size);

subsys/bluetooth/mesh/gatt.h

@@ -0,0 +1,19 @@
+/*
+ * Copyright (c) 2024 Nordic Semiconductor ASA
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#define ADV_SLOW_INT                                                           \
+	.interval_min = BT_GAP_ADV_SLOW_INT_MIN,                               \
+	.interval_max = BT_GAP_ADV_SLOW_INT_MAX
+
+#define ADV_FAST_INT                                                           \
+	.interval_min = BT_GAP_ADV_FAST_INT_MIN_2,                             \
+	.interval_max = BT_GAP_ADV_FAST_INT_MAX_2
+
+#define BT_DEVICE_NAME (IS_ENABLED(CONFIG_BT_DEVICE_NAME_DYNAMIC) ? \
+			(const uint8_t *)bt_get_name() : \
+			(const uint8_t *)CONFIG_BT_DEVICE_NAME)
+#define BT_DEVICE_NAME_LEN (IS_ENABLED(CONFIG_BT_DEVICE_NAME_DYNAMIC) ? strlen(bt_get_name()) : \
+			    (sizeof(CONFIG_BT_DEVICE_NAME) - 1))

subsys/bluetooth/mesh/net.c

@@ -705,7 +705,7 @@ static void bt_mesh_net_relay(struct net_buf_simple *sbuf, struct bt_mesh_net_rx
 	 * Anything else (like GATT to adv, or locally originated packets)
 	 * use the Network Transmit state.
 	 */
-	if (rx->net_if == BT_MESH_NET_IF_ADV && !rx->friend_cred) {
+	if (rx->net_if == BT_MESH_NET_IF_ADV && !rx->friend_cred && !bridge) {
 		transmit = bt_mesh_relay_retransmit_get();
 	} else {
 		transmit = bt_mesh_net_transmit_get();

subsys/bluetooth/mesh/pb_gatt_srv.c

@@ -26,6 +26,7 @@
 #include "foundation.h"
 #include "access.h"
 #include "proxy.h"
+#include "gatt.h"
 #include "proxy_msg.h"
 #include "pb_gatt_srv.h"
 
@@ -243,13 +244,12 @@ static size_t gatt_prov_adv_create(struct bt_data prov_sd[2])
 	prov_sd_len += 1;
 
 dev_name:
-#if defined(CONFIG_BT_MESH_PB_GATT_USE_DEVICE_NAME)
-	prov_sd[prov_sd_len].type = BT_DATA_NAME_COMPLETE;
-	prov_sd[prov_sd_len].data_len = sizeof(CONFIG_BT_DEVICE_NAME) - 1;
-	prov_sd[prov_sd_len].data = CONFIG_BT_DEVICE_NAME;
-
-	prov_sd_len += 1;
-#endif
+	if (IS_ENABLED(CONFIG_BT_MESH_PB_GATT_USE_DEVICE_NAME)) {
+		prov_sd[prov_sd_len].type = BT_DATA_NAME_COMPLETE;
+		prov_sd[prov_sd_len].data_len = BT_DEVICE_NAME_LEN;
+		prov_sd[prov_sd_len].data = BT_DEVICE_NAME;
+		prov_sd_len += 1;
+	}
 
 	return prov_sd_len;
 }

subsys/bluetooth/mesh/proxy.h

@@ -10,14 +10,6 @@
 #define ADV_OPT_USE_IDENTITY 0
 #endif
 
-#define ADV_SLOW_INT                                                           \
-	.interval_min = BT_GAP_ADV_SLOW_INT_MIN,                               \
-	.interval_max = BT_GAP_ADV_SLOW_INT_MAX
-
-#define ADV_FAST_INT                                                           \
-	.interval_min = BT_GAP_ADV_FAST_INT_MIN_2,                             \
-	.interval_max = BT_GAP_ADV_FAST_INT_MAX_2
-
 #define BT_MESH_ID_TYPE_NET	  0x00
 #define BT_MESH_ID_TYPE_NODE	  0x01
 #define BT_MESH_ID_TYPE_PRIV_NET  0x02

subsys/bluetooth/mesh/proxy_msg.c

@@ -252,11 +252,9 @@ int bt_mesh_proxy_relay_send(struct bt_conn *conn, struct bt_mesh_adv *adv)
 
 static void proxy_msg_send_pending(struct k_work *work)
 {
-	struct bt_mesh_proxy_role *role;
-	struct k_work_delayable *dwork = k_work_delayable_from_work(work);
+	struct bt_mesh_proxy_role *role = CONTAINER_OF(work, struct bt_mesh_proxy_role, work);
 	struct bt_mesh_adv *adv;
 
-	role = CONTAINER_OF(dwork, struct bt_mesh_proxy_role, sar_timer);
 	if (!role->conn) {
 		return;
 	}

subsys/bluetooth/mesh/proxy_srv.c

@@ -28,6 +28,7 @@
 #include "foundation.h"
 #include "access.h"
 #include "proxy.h"
+#include "gatt.h"
 #include "proxy_msg.h"
 #include "crypto.h"
 
@@ -483,12 +484,6 @@
 	BT_DATA(BT_DATA_SVC_DATA16, proxy_svc_data, NET_ID_LEN),
 };
 
-static const struct bt_data sd[] = {
-#if defined(CONFIG_BT_MESH_PROXY_USE_DEVICE_NAME)
-	BT_DATA(BT_DATA_NAME_COMPLETE, CONFIG_BT_DEVICE_NAME, sizeof(CONFIG_BT_DEVICE_NAME) - 1),
-#endif
-};
-
 static int randomize_bt_addr(void)
 {
 	/* TODO: There appears to be no way to force an RPA/NRPA refresh. */
@@ -510,6 +505,7 @@
 					 type == BT_MESH_ID_TYPE_PRIV_NODE),
 		ADV_FAST_INT,
 	};
+	struct bt_data sd[1];
 	int err;
 
 	err = bt_mesh_encrypt(&sub->keys[SUBNET_KEY_TX_IDX(sub)].identity, hash, hash);
@@ -529,9 +525,17 @@
 	proxy_svc_data[2] = type;
 	memcpy(&proxy_svc_data[3], &hash[8], 8);
 
+	if (IS_ENABLED(CONFIG_BT_MESH_PROXY_USE_DEVICE_NAME)) {
+		sd[0].type = BT_DATA_NAME_COMPLETE;
+		sd[0].data_len = BT_DEVICE_NAME_LEN;
+		sd[0].data = BT_DEVICE_NAME;
+	}
+
 	err = bt_mesh_adv_gatt_start(
 		type == BT_MESH_ID_TYPE_PRIV_NET ? &slow_adv_param : &fast_adv_param,
-		duration, enc_id_ad, ARRAY_SIZE(enc_id_ad), sd, ARRAY_SIZE(sd));
+		duration, enc_id_ad, ARRAY_SIZE(enc_id_ad),
+		IS_ENABLED(CONFIG_BT_MESH_PROXY_USE_DEVICE_NAME) ? sd : NULL,
+		IS_ENABLED(CONFIG_BT_MESH_PROXY_USE_DEVICE_NAME) ? ARRAY_SIZE(sd) : 0);
 	if (err) {
 		LOG_WRN("Failed to advertise using type 0x%02x (err %d)", type, err);
 		return err;
@@ -607,6 +611,7 @@
 		.options = ADV_OPT_PROXY(false),
 		ADV_SLOW_INT,
 	};
+	struct bt_data sd[1];
 	int err;
 
 	proxy_svc_data[2] = BT_MESH_ID_TYPE_NET;
@@ -615,9 +620,18 @@
 
 	memcpy(proxy_svc_data + 3, sub->keys[SUBNET_KEY_TX_IDX(sub)].net_id, 8);
 
+	if (IS_ENABLED(CONFIG_BT_MESH_PROXY_USE_DEVICE_NAME)) {
+		sd[0].type = BT_DATA_NAME_COMPLETE;
+		sd[0].data_len = BT_DEVICE_NAME_LEN;
+		sd[0].data = BT_DEVICE_NAME;
+	}
+
 	err = bt_mesh_adv_gatt_start(&slow_adv_param, duration, net_id_ad,
-				     ARRAY_SIZE(net_id_ad), sd, ARRAY_SIZE(sd));
+				     ARRAY_SIZE(net_id_ad),
+				     IS_ENABLED(CONFIG_BT_MESH_PROXY_USE_DEVICE_NAME) ? sd : NULL,
+				     IS_ENABLED(CONFIG_BT_MESH_PROXY_USE_DEVICE_NAME) ?
+					ARRAY_SIZE(sd) : 0);
 	if (err) {
 		LOG_WRN("Failed to advertise using Network ID (err %d)", err);
 		return err;
 	}