Bluetooth: ATT: Fix using k_fifo API with net_buf

net_buf shall not be used with k_fifo since net_buf_unref will assume
unused bytes in the beginning are actually fragments causing it to
unref them as well.

Jira: ZEP-1489

Change-Id: I5ce420de73b245dc20eb15ea4d8d0b6ba346e513
Signed-off-by: Luiz Augusto von Dentz <[email protected]>

Author: Vudentz

subsys/bluetooth/host/att.c

@@ -1279,8 +1279,10 @@ static uint8_t att_prep_write_rsp(struct bt_att *att, uint16_t handle,
 		return 0;
 	}
 
+	BT_DBG("buf %p handle 0x%04x offset %u", data.buf, handle, offset);
+
 	/* Store buffer in the outstanding queue */
-	k_fifo_put(&att->prep_queue, data.buf);
+	net_buf_put(&att->prep_queue, data.buf);
 
 	/* Generate response */
 	data.buf = bt_att_create_pdu(conn, BT_ATT_OP_PREPARE_WRITE_RSP, 0);
@@ -1327,9 +1329,12 @@ static uint8_t att_exec_write_rsp(struct bt_att *att, uint8_t flags)
 	struct net_buf *buf;
 	uint8_t err = 0;
 
-	while ((buf = k_fifo_get(&att->prep_queue, K_NO_WAIT))) {
+	while ((buf = net_buf_get_timeout(&att->prep_queue, 0, K_NO_WAIT))) {
 		struct bt_attr_data *data = net_buf_user_data(buf);
 
+		BT_DBG("buf %p handle 0x%04x offset %u", buf, data->handle,
+		       data->offset);
+
 		/* Just discard the data if an error was set */
 		if (!err && flags == BT_ATT_FLAG_EXEC) {
 			err = att_write_rsp(conn, BT_ATT_OP_EXEC_WRITE_REQ, 0,