From 5f6043bc35b35f72e24ff37669d8115f306a12f7 Mon Sep 17 00:00:00 2001
From: Johan Hedberg <johan.hedberg@intel.com>
Date: Tue, 13 Aug 2019 16:28:51 +0300
Subject: [PATCH] Bluetooth: Mesh: Fix canceled buffer memory leak

In case a queued buffer is canceled before sending we have to unref
it, since that's what adv_send() would do as well.

Fixes #17936
Fixes #18013

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
---
 subsys/bluetooth/mesh/adv.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/subsys/bluetooth/mesh/adv.c b/subsys/bluetooth/mesh/adv.c
index 2b25a1d87b9..ae9beee0cd3 100644
--- a/subsys/bluetooth/mesh/adv.c
+++ b/subsys/bluetooth/mesh/adv.c
@@ -186,6 +186,8 @@ static void adv_thread(void *p1, void *p2, void *p3)
 		if (BT_MESH_ADV(buf)->busy) {
 			BT_MESH_ADV(buf)->busy = 0U;
 			adv_send(buf);
+		} else {
+			net_buf_unref(buf);
 		}
 
 		STACK_ANALYZE("adv stack", adv_thread_stack);