NCS Mesh: Crash during unprovisioning using ADV Bearer

I get the following error if I try to unprovision device via ADV Bearer:

00> E: ***** MPU FAULT *****
00> E:   Stacking error (context area might be not valid)
00> E:   Data Access Violation
00> E:   MMFAR Address: 0x20007418
00> E: r0/a1:  0x00000000  r1/a2:  0xaaaaaaaa  r2/a3:  0x7826ddbc
00> E: r3/a4:  0x637b2c44 r12/ip:  0xb9e7c9aa r14/lr:  0xda33d5f6
00> E:  xpsr:  0xc138b400
00> E: Faulting instruction address (r15/pc): 0x344c9406
00> E: >>> ZEPHYR FATAL ERROR 2: Stack overflow on CPU 0
00> E: Current thread: 0x20003678 (BT Mesh adv)

Problem is reproducible on "ncs\v1.7.0\nrf\samples\bluetooth\mesh\light" project if Light CTL Server and Light CTL Temperature Server (in the next element) are added. With no changes to sample project error is not observed.

Using GATT Bearer (nRF Mesh/BubblyNet app) problem does not occur, models are also functioning as expected.

Below code changes in the sample project; this is added to model_handler.c:

static void light_set(struct bt_mesh_lightness_srv *srv,
		      struct bt_mesh_msg_ctx *ctx,
		      const struct bt_mesh_lightness_set *set,
		      struct bt_mesh_lightness_status *rsp)
{
}

static void light_get(struct bt_mesh_lightness_srv *srv,
		      struct bt_mesh_msg_ctx *ctx,
		      struct bt_mesh_lightness_status *rsp)
{
}

static void light_ctl_temp_set(struct bt_mesh_light_temp_srv *srv,
			struct bt_mesh_msg_ctx *ctx,
			const struct bt_mesh_light_temp_set *set,
			struct bt_mesh_light_temp_status *rsp)
{
}

static void light_ctl_temp_get(struct bt_mesh_light_temp_srv *srv,
			struct bt_mesh_msg_ctx *ctx,
			struct bt_mesh_light_temp_status *rsp)
{	
}

static void light_ctl_range_update(struct bt_mesh_light_temp_srv *srv,
			struct bt_mesh_msg_ctx *ctx,
			const struct bt_mesh_light_temp_range *old_range,
			const struct bt_mesh_light_temp_range *new_range)
{	
}

static const struct bt_mesh_lightness_srv_handlers ctl_lightness_srv_handlers = {
	.light_set = light_set,
	.light_get = light_get,
};

static const struct bt_mesh_light_temp_srv_handlers ctl_light_temp_handlers = {
	.set = light_ctl_temp_set,
	.get = light_ctl_temp_get,
	.range_update = light_ctl_range_update,
};

static struct bt_mesh_light_ctl_srv light_ctl_srv = 
	BT_MESH_LIGHT_CTL_SRV_INIT(&ctl_lightness_srv_handlers, &ctl_light_temp_handlers);


static struct bt_mesh_elem elements[] = {
#if DT_NODE_EXISTS(DT_ALIAS(led0))
	BT_MESH_ELEM(
		1, BT_MESH_MODEL_LIST(
			BT_MESH_MODEL_CFG_SRV,
			BT_MESH_MODEL_HEALTH_SRV(&health_srv, &health_pub),
			BT_MESH_MODEL_LIGHT_CTL_SRV(&light_ctl_srv),
			BT_MESH_MODEL_ONOFF_SRV(&led_ctx[0].srv)),
		BT_MESH_MODEL_NONE),
#endif
#if DT_NODE_EXISTS(DT_ALIAS(led1))
	BT_MESH_ELEM(
		2, BT_MESH_MODEL_LIST(BT_MESH_MODEL_ONOFF_SRV(&led_ctx[1].srv),
		BT_MESH_MODEL_LIGHT_TEMP_SRV(&light_ctl_srv.temp_srv)),
		BT_MESH_MODEL_NONE),
#endif
#if DT_NODE_EXISTS(DT_ALIAS(led2))
	BT_MESH_ELEM(
		3, BT_MESH_MODEL_LIST(BT_MESH_MODEL_ONOFF_SRV(&led_ctx[2].srv)),
		BT_MESH_MODEL_NONE),
#endif
#if DT_NODE_EXISTS(DT_ALIAS(led3))
	BT_MESH_ELEM(
		4, BT_MESH_MODEL_LIST(BT_MESH_MODEL_ONOFF_SRV(&led_ctx[3].srv)),
		BT_MESH_MODEL_NONE),
#endif
};

And in prj.conf added:

CONFIG_BT_MESH_LIGHT_CTL_SRV=y
CONFIG_BT_MESH_LIGHTNESS_SRV=y
CONFIG_BT_MESH_LIGHT_TEMP_SRV=y

CONFIG_BT_MESH_PB_ADV=y

CONFIG_USE_SEGGER_RTT=y
CONFIG_CONSOLE=y
CONFIG_RTT_CONSOLE=y
CONFIG_UART_CONSOLE=n

CONFIG_LOG=y
CONFIG_LOG_DEFAULT_LEVEL=4

CONFIG_RESET_ON_FATAL_ERROR=n
CONFIG_DEBUG=y
CONFIG_DEBUG_INFO=y
CONFIG_DEBUG_OPTIMIZATIONS=n
CONFIG_ASSERT_NO_MSG_INFO=n
CONFIG_THREAD_ANALYZER=y
CONFIG_THREAD_NAME=y

CONFIG_BT_MESH_DK_PROV_OOB_BLINK=n
CONFIG_BT_MESH_DK_PROV_OOB_BUTTON=n

Code is running on nrf52840dk_nrf52840, provisioner - proprietary hardware running BlueZ. Problem is also reproduced using "mesh-cfgclient" tool of BlueZ.

Related