bluetooth: mesh: brg_cfg_cli: copy buf in synchronous api

When a synchronous API is used, the content of `buf` will not be
valid by the time the thread that called the synchronous API is woken up
again.

Therefore, the simplest way to solve this is when a user allocates the
buffer which will be filled up with the content of the buffer passed to
the model callback.

Signed-off-by: Pavel Vasilyev <pavel.vasilyev@nordicsemi.no>

subsys/bluetooth/mesh/brg_cfg_cli.c

@@ -89,7 +89,16 @@ static int bridged_subnets_list(const struct bt_mesh_model *model, struct bt_mes
 
 	if (bt_mesh_msg_ack_ctx_match(&cli->ack_ctx, OP_BRIDGED_SUBNETS_LIST, ctx->addr,
 				      (void **)&rsp)) {
-		*rsp = subnets_list;
+		rsp->net_idx_filter = subnets_list.net_idx_filter;
+		rsp->start_idx = subnets_list.start_idx;
+
+		if (rsp->list) {
+			size_t to_copy;
+
+			to_copy = MIN(net_buf_simple_tailroom(rsp->list), buf->len);
+			net_buf_simple_add_mem(rsp->list, buf->data, to_copy);
+		}
+
 		bt_mesh_msg_ack_ctx_rx(&cli->ack_ctx);
 	}
 
@@ -117,7 +126,18 @@ static int bridging_table_list(const struct bt_mesh_model *model, struct bt_mesh
 
 	if (bt_mesh_msg_ack_ctx_match(&cli->ack_ctx, OP_BRIDGING_TABLE_LIST, ctx->addr,
 				      (void **)&rsp)) {
-		*rsp = table_list;
+		rsp->status = table_list.status;
+		rsp->net_idx1 = table_list.net_idx1;
+		rsp->net_idx2 = table_list.net_idx2;
+		rsp->start_idx = table_list.start_idx;
+
+		if (rsp->list) {
+			size_t to_copy;
+
+			to_copy = MIN(net_buf_simple_tailroom(rsp->list), (buf->len / 5) * 5);
+			net_buf_simple_add_mem(rsp->list, buf->data, to_copy);
+		}
+
 		bt_mesh_msg_ack_ctx_rx(&cli->ack_ctx);
 	}
 

subsys/bluetooth/mesh/shell/brg_cfg.c

@@ -136,9 +136,13 @@ static int cmd_bridged_subnets_get(const struct shell *sh, size_t argc, char *ar
 {
 	struct bt_mesh_filter_netkey filter_net_idx;
 	uint8_t start_idx;
-	struct bt_mesh_bridged_subnets_list rsp;
+	struct bt_mesh_bridged_subnets_list rsp = {
+		.list = NET_BUF_SIMPLE(CONFIG_BT_MESH_BRG_TABLE_ITEMS_MAX * 3),
+	};
 	int err = 0;
 
+	net_buf_simple_init(rsp.list, 0);
+
 	filter_net_idx.filter = shell_strtoul(argv[1], 0, &err);
 	filter_net_idx.net_idx = shell_strtoul(argv[2], 0, &err);
 	start_idx = shell_strtoul(argv[3], 0, &err);
@@ -176,9 +180,13 @@ static int cmd_bridged_subnets_get(const struct shell *sh, size_t argc, char *ar
 static int cmd_bridging_table_get(const struct shell *sh, size_t argc, char *argv[])
 {
 	uint16_t net_idx1, net_idx2, start_idx;
-	struct bt_mesh_bridging_table_list rsp;
+	struct bt_mesh_bridging_table_list rsp = {
+		.list = NET_BUF_SIMPLE(CONFIG_BT_MESH_BRG_TABLE_ITEMS_MAX * 5),
+	};
 	int err = 0;
 
+	net_buf_simple_init(rsp.list, 0);
+
 	net_idx1 = shell_strtoul(argv[1], 0, &err);
 	net_idx2 = shell_strtoul(argv[2], 0, &err);
 	start_idx = shell_strtoul(argv[3], 0, &err);

tests/bluetooth/tester/src/btp_mesh.c

@@ -2182,6 +2182,11 @@ static uint8_t bridged_subnets_get(const void *cmd, uint16_t cmd_len,
 
 	LOG_DBG("");
 
+	/* Initialize list ptr to NULL to prevent the client copying response to whatever was
+	 * on the stack where `rp` was allocated.
+	 */
+	rp.list = NULL;
+
 	filter_net_idx.filter = cp->filter;
 	filter_net_idx.net_idx = sys_le16_to_cpu(cp->net_idx);
 
@@ -2204,6 +2209,11 @@ static uint8_t bridging_table_get(const void *cmd, uint16_t cmd_len,
 
 	LOG_DBG("");
 
+	/* Initialize list ptr to NULL to prevent the client copying response to whatever was
+	 * on the stack where `rp` was allocated.
+	 */
+	rp.list = NULL;
+
 	err = bt_mesh_brg_cfg_cli_bridging_table_get(net_key_idx, sys_le16_to_cpu(cp->addr),
 						     sys_le16_to_cpu(cp->net_idx1),
 						     sys_le16_to_cpu(cp->net_idx2),