[PATCH BlueZ v1 0/7] Add HID over GATT functional tests

All of lore.kernel.org
 help / color / mirror / Atom feed

* [PATCH BlueZ v1 0/7] Add HID over GATT functional tests
@ 2026-09-23 19:31 Luiz Augusto von Dentz
  2026-09-23 19:31 ` [PATCH BlueZ v1 1/7] client/gatt: Fix setting descriptor value from scripts Luiz Augusto von Dentz
                   ` (6 more replies)
  0 siblings, 7 replies; 9+ messages in thread
From: Luiz Augusto von Dentz @ 2026-09-23 19:31 UTC (permalink / raw)
  To: linux-bluetooth

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

This adds functional tests for HID over GATT (HoG), with bluetoothctl
registering a HID Service acting as a keyboard, with and without
Shorter Connection Interval (SCI) support, using the new
client/scripts/hog-device*.bt scripts, and the HID host:

 - checking HID Information, HID SCI Mode and HID SCI Information over
   GATT with gatt.select-attribute/gatt.read
 - receiving a few Input Reports notified by the HID device
 - with SCI support, changing the SCI mode, followed by the connection
   rate with mgmt.conn-subrate, and receiving the notification from
   the HID device confirming the mode has been changed

The tests are documented in doc/functional-hog.rst.

To support them:

 - bluetoothctl can now set descriptor values from scripts, and prints
   the MGMT Connection Subrate event
 - btvirt defaults to the latest BR/EDR+LE version (6.2), so Shorter
   Connection Intervals are supported by the emulated controllers,
   with the new -C/--core option to emulate older versions

Also, with -n auto, the number of functional test workers is now
limited by the memory available instead of one per CPU, since running
out of memory with so many VM instances made tests fail at random, and
check-functional uses -n auto by default (override with
CHECK_FUNCTIONAL_JOBS).

Luiz Augusto von Dentz (7):
  client/gatt: Fix setting descriptor value from scripts
  client/mgmt: Print Connection Subrate event
  emulator: Default to the latest BR/EDR+LE version
  client/scripts: Add HoG device scripts
  doc: Add functional-hog documentation
  test: functional: add HoG tests
  test: functional: limit the workers by the memory available

 Makefile.am                      |   8 +-
 client/gatt.c                    |  25 ++-
 client/mgmt.c                    |  31 ++++
 client/scripts/hog-device-sci.bt |  49 ++++++
 client/scripts/hog-device.bt     |  38 +++++
 doc/functional-hog.rst           | 188 +++++++++++++++++++++++
 doc/functional-testing.rst       |   1 +
 doc/test-functional.rst          |  25 +++
 emulator/main.c                  |  54 ++++++-
 emulator/server.c                |  15 +-
 emulator/server.h                |   2 +
 test/functional/conftest.py      |  46 ++++++
 test/functional/test_hog.py      | 252 +++++++++++++++++++++++++++++++
 13 files changed, 722 insertions(+), 12 deletions(-)
 create mode 100644 client/scripts/hog-device-sci.bt
 create mode 100644 client/scripts/hog-device.bt
 create mode 100644 doc/functional-hog.rst
 create mode 100644 test/functional/test_hog.py

-- 
2.55.0


^ permalink raw reply	[flat|nested] 9+ messages in thread

* [PATCH BlueZ v1 1/7] client/gatt: Fix setting descriptor value from scripts
  2026-09-23 19:31 [PATCH BlueZ v1 0/7] Add HID over GATT functional tests Luiz Augusto von Dentz
@ 2026-09-23 19:31 ` Luiz Augusto von Dentz
  2026-09-23 22:30   ` Add HID over GATT functional tests bluez.test.bot
  2026-09-23 19:31 ` [PATCH BlueZ v1 2/7] client/mgmt: Print Connection Subrate event Luiz Augusto von Dentz
                   ` (5 subsequent siblings)
  6 siblings, 1 reply; 9+ messages in thread
From: Luiz Augusto von Dentz @ 2026-09-23 19:31 UTC (permalink / raw)
  To: linux-bluetooth

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

gatt.register-descriptor completed the command right after prompting
for the value, so when run from a script the line with the value was
executed as a command instead of being passed to the prompt, causing
the descriptor to be unregistered.

Complete the command once the value is set, as done for
characteristics, and parse a copy of the value so the input line is
not truncated by strsep while still in use by the shell.
---
 client/gatt.c | 25 ++++++++++++++++++-------
 1 file changed, 18 insertions(+), 7 deletions(-)

diff --git a/client/gatt.c b/client/gatt.c
index 6dc80e2a31cd..ebbe4e3c7a32 100644
--- a/client/gatt.c
+++ b/client/gatt.c
@@ -700,13 +700,20 @@ void gatt_read_local_attribute(char *data, int argc, char *argv[])
 	return bt_shell_noninteractive_quit(EXIT_FAILURE);
 }
 
-static uint8_t *str2bytearray(char *arg, size_t *val_len)
+static uint8_t *str2bytearray(const char *arg, size_t *val_len)
 {
 	uint8_t value[MAX_ATTR_VAL_LEN];
-	char *entry;
+	char *str, *next, *entry;
 	unsigned int i;
 
-	for (i = 0; (entry = strsep(&arg, " \t")) != NULL; i++) {
+	/* Parse a copy as strsep modifies the string, which may still be
+	 * in use by the caller, e.g. the shell printing the input line.
+	 */
+	str = next = strdup(arg);
+	if (!str)
+		return NULL;
+
+	for (i = 0; (entry = strsep(&next, " \t")) != NULL; i++) {
 		long val;
 		char *endptr = NULL;
 
@@ -715,18 +722,22 @@ static uint8_t *str2bytearray(char *arg, size_t *val_len)
 
 		if (i >= G_N_ELEMENTS(value)) {
 			bt_shell_printf("Too much data\n");
+			free(str);
 			return NULL;
 		}
 
 		val = strtol(entry, &endptr, 0);
 		if (!endptr || *endptr != '\0' || val > UINT8_MAX) {
 			bt_shell_printf("Invalid value at index %d\n", i);
+			free(str);
 			return NULL;
 		}
 
 		value[i] = val;
 	}
 
+	free(str);
+
 	*val_len = i;
 
 	return util_memdup(value, i);
@@ -2788,7 +2799,7 @@ static void chrc_set_value(const char *input, void *user_data)
 
 	g_free(chrc->value);
 
-	chrc->value = str2bytearray((char *) input, &chrc->value_len);
+	chrc->value = str2bytearray(input, &chrc->value_len);
 
 	if (!chrc->value) {
 		print_chrc(chrc, COLORED_DEL);
@@ -3078,7 +3089,7 @@ static void desc_set_value(const char *input, void *user_data)
 
 	g_free(desc->value);
 
-	desc->value = str2bytearray((char *) input, &desc->value_len);
+	desc->value = str2bytearray(input, &desc->value_len);
 
 	if (!desc->value) {
 		print_desc(desc, COLORED_DEL);
@@ -3086,6 +3097,8 @@ static void desc_set_value(const char *input, void *user_data)
 	}
 
 	desc->max_val_len = desc->value_len;
+
+	return bt_shell_noninteractive_quit(EXIT_SUCCESS);
 }
 
 void gatt_register_desc(DBusConnection *conn, GDBusProxy *proxy,
@@ -3134,8 +3147,6 @@ void gatt_register_desc(DBusConnection *conn, GDBusProxy *proxy,
 	print_desc(desc, COLORED_NEW);
 
 	bt_shell_prompt_input(desc->path, "Enter value:", desc_set_value, desc);
-
-	return bt_shell_noninteractive_quit(EXIT_SUCCESS);
 }
 
 static struct desc *desc_find(const char *pattern)
-- 
2.55.0


^ permalink raw reply related	[flat|nested] 9+ messages in thread

* RE: Add HID over GATT functional tests
  2026-09-23 19:31 ` [PATCH BlueZ v1 1/7] client/gatt: Fix setting descriptor value from scripts Luiz Augusto von Dentz
@ 2026-09-23 22:30   ` bluez.test.bot
  0 siblings, 0 replies; 9+ messages in thread
From: bluez.test.bot @ 2026-09-23 22:30 UTC (permalink / raw)
  To: linux-bluetooth, luiz.dentz

[-- Attachment #1: Type: text/plain, Size: 101260 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1172525/

---Test result---

Test Summary:
CheckPatch                    PASS      1.65 seconds
GitLint                       PASS      1.25 seconds
BuildEll                      PASS      13.11 seconds
BluezMake                     PASS      203.42 seconds
MakeCheck                     PASS      12.97 seconds
MakeDistcheck                 PASS      93.61 seconds
CheckValgrind                 PASS      145.14 seconds
CheckSmatch                   PASS      164.87 seconds
bluezmakeextell               PASS      58.89 seconds
TestFunctional                FAIL      779.20 seconds
IncrementalBuild              PASS      224.46 seconds
ScanBuild                     PASS      575.20 seconds

Details
##############################
Test: TestFunctional - FAIL
Desc: Run test-functional
Output:
FAIL functional.test_hog::test_hog[no-sci-hosts15-vm2]: failed on teardown with "pytest_bluezenv.plugin.CoredumpWarning: Core dump: test-bluezenv-hosts15.0-bluetoothd-1790201609-113.core
        /usr/bin/gdb: warning: Couldn't determine a path for the index cache directory.
        [New LWP 113]
        [Thread debugging using libthread_db enabled]
        Using host libthread_db library "/usr/lib/x86_64-linux-gnu/libthread_db.so.1".
        Core was generated by `/home/runner/work/bluez/bluez/src/src/src/bluetoothd --nodetach -f /run/bluetoo'.
        Program terminated with signal SIGABRT, Aborted.
        #0  __pthread_kill_implementation (threadid=<optimized out>, signo=6, no_tid=0) at ./nptl/pthread_kill.c:44

        warning: 44	./nptl/pthread_kill.c: No such file or directory

        Thread 1 (Thread 0x7fdb1a71d900 (LWP 113)):
        #0  __pthread_kill_implementation (threadid=<optimized out>, signo=6, no_tid=0) at ./nptl/pthread_kill.c:44
                tid = <optimized out>
                ret = 0
                pd = <optimized out>
                old_mask = {__val = {0}}
                ret = <optimized out>
        #1  __pthread_kill_internal (threadid=<optimized out>, signo=6) at ./nptl/pthread_kill.c:89
        No locals.
        #2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ./nptl/pthread_kill.c:100
        No locals.
        #3  0x00007fdb1ae78b7e in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
                ret = <optimized out>
        #4  0x00007fdb1ae5b8ec in __GI_abort () at ./stdlib/abort.c:77
                act = {__sigaction_handler = {sa_handler = 0x0, sa_sigaction = 0x0}, sa_mask = {__val = {0 <repeats 16 times>}}, sa_flags = 0, sa_restorer = 0x0}
        #5  0x00007fdb1ba83a0f in __sanitizer::Abort () at ../../../../src/libsanitizer/sanitizer_common/sanitizer_posix_libcdep.cpp:165
        No locals.
        #6  0x00007fdb1bba9c2d in __sanitizer::Die () at ../../../../src/libsanitizer/sanitizer_common/sanitizer_termination.cpp:58
        No locals.
        #7  0x00007fdb1bb7e93c in __asan::ScopedInErrorReport::~ScopedInErrorReport (this=0x7ffec9e5cd36) at ../../../../src/libsanitizer/asan/asan_report.cpp:221
                buffer_copy = {buffer_ = {<__sanitizer::InternalMmapVectorNoCtor<char, false>> = {data_ = 0x7fdb1a301000 '=' <repeats 65 times>, "\n==113==ERROR: AddressSanitizer: heap-use-after-free on address 0x7c1b19c009e4 at pc 0x5642107432e3 bp 0x7ffec9e5d9b0 sp 0x7ffec9e5d9a0"..., capacity_bytes_ = 4096, size_ = 3936}, <No data fields>}}
                buffer_copy = <optimized out>
                l = <optimized out>
        #8  0x00007fdb1bb7de02 in __asan::ReportGenericError (pc=94841743880931, bp=140732285704624, sp=sp@entry=140732285704608, addr=136455837977060, is_write=is_write@entry=true, access_size=4, fatal=true, exp=<optimized out>) at ../../../../src/libsanitizer/asan/asan_report.cpp:536
                in_report = {error_report_lock_ = {<No data fields>}, static current_error_ = {kind = __asan::kErrorKindGeneric, {Base = {scariness = {score = 46, descr = "4-byte-write-heap-use-after-free\000\000\000\0002\000\000\000\000\000\000\000\000\360e\311\376\177\000\0002\000\000\000\000\000\000\000 %\242\030\333{\000\0001\000\000\000\000\000\000\000X\326\345\311\376\177\000\000 %\242\030\333{\000\000\300\315\345\311\376\177\000\000\037{\250\033\333\177\000\000\001\000\000\000\000\000\000\000 %\242\030\333{\000\000\020\326\345\311\376\177\000\000\322\025\267\033\333\177\000\000\000\000\000\000\000\000\000\000\305\234\270\033\036\000\000\000\360\315\345\311\376\177\000\000\003\000\000\000\000\000\000\000\020\026\267\033\333\177\000\000\217\233\354\032\333\177\000\000\v\n\241\020BV\000\000\320\330\345\311"...}, tid = 0}, DeadlySignal = {<__asan::ErrorBase> = {scariness = {score = 46, descr = "4-byte-write-heap-use-after-free\000\000\000\0002\000\000\000\000\000\000\000\000\360e\311\376\177\000\0002\000\000\000\000\000\000\000 %\242\030\333{\000\0001\000\000\000\000\000\000\000X\326\345\311\376\177\000\000 %\242\030\333{\000\000\300\315\345\311\376\177\000\000\037{\250\033\333\177\000\000\001\000\000\000\000\000\000\000 %\242\030\333{\000\000\020\326\345\311\376\177\000\000\322\025\267\033\333\177\000\000\000\000\000\000\000\000\000\000\305\234\270\033\036\000\000\000\360\315\345\311\376\177\000\000\003\000\000\000\000\000\000\000\020\026\267\033\333\177\000\000\217\233\354\032\333\177\000\000\v\n\241\020BV\000\000\320\330\345\311"...}, tid = 0}, signal = {siginfo = 0x7fdb00000002, context = 0x7c1b19c009e4, addr = 0, pc = 0, sp = 10260676871990, bp = 136455837977060, is_memory_access = 20, write_flag = __sanitizer::SignalContext::Unknown, is_true_faulting_addr = 208}}, DoubleFree = {<__asan::ErrorBase> = {scariness = {score = 46, descr = "4-byte-write-heap-use-after-free\000\000\000\0002\000\000\000\000\000\000\000\000\360e\311\376\177\000\0002\000\000\000\000\000\000\000 %\242\030\333{\000\0001\000\000\000\000\000\000\000X\326\345\311\376\177\000\000 %\242\030\333{\000\000\300\315\345\311\376\177\000\000\037{\250\033\333\177\000\000\001\000\000\000\000\000\000\000 %\242\030\333{\000\000\020\326\345\311\376\177\000\000\322\025\267\033\333\177\000\000\000\000\000\000\000\000\000\000\305\234\270\033\036\000\000\000\360\315\345\311\376\177\000\000\003\000\000\000\000\000\000\000\020\026\267\033\333\177\000\000\217\233\354\032\333\177\000\000\v\n\241\020BV\000\000\320\330\345\311"...}, tid = 0}, second_free_stack = 0x7fdb00000002, addr_description = {addr = 136455837977060, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1846, free_stack_id = 2389, chunk_access = {bad_addr = 136455837977060, offset = 20, chunk_begin = 136455837977040, chunk_size = 40, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}}, NewDeleteTypeMismatch = {<__asan::ErrorBase> = {scariness = {score = 46, descr = "4-byte-write-heap-use-after-free\000\000\000\0002\000\000\000\000\000\000\000\000\360e\311\376\177\000\0002\000\000\000\000\000\000\000 %\242\030\333{\000\0001\000\000\000\000\000\000\000X\326\345\311\376\177\000\000 %\242\030\333{\000\000\300\315\345\311\376\177\000\000\037{\250\033\333\177\000\000\001\000\000\000\000\000\000\000 %\242\030\333{\000\000\020\326\345\311\376\177\000\000\322\025\267\033\333\177\000\000\000\000\000\000\000\000\000\000\305\234\270\033\036\000\000\000\360\315\345\311\376\177\000\000\003\000\000\000\000\000\000\000\020\026\267\033\333\177\000\000\217\233\354\032\333\177\000\000\v\n\241\020BV\000\000\320\330\345\311"...}, tid = 0}, free_stack = 0x7fdb00000002, addr_description = {addr = 136455837977060, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1846, free_stack_id = 2389, chunk_access = {bad_addr = 136455837977060, offset = 20, chunk_begin = 136455837977040, chunk_size = 40, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, delete_size = 14546846794988041728, delete_alignment = 136318399050544}, FreeNotMalloced = {<__asan::ErrorBase> = {scariness = {score = 46, descr = "4-byte-write-heap-use-after-free\000\000\000\0002\000\000\000\000\000\000\000\000\360e\311\376\177\000\0002\000\000\000\000\000\000\000 %\242\030\333{\000\0001\000\000\000\000\000\000\000X\326\345\311\376\177\000\000 %\242\030\333{\000\000\300\315\345\311\376\177\000\000\037{\250\033\333\177\000\000\001\000\000\000\000\000\000\000 %\242\030\333{\000\000\020\326\345\311\376\177\000\000\322\025\267\033\333\177\000\000\000\000\000\000\000\000\000\000\305\234\270\033\036\000\000\000\360\315\345\311\376\177\000\000\003\000\000\000\000\000\000\000\020\026\267\033\333\177\000\000\217\233\354\032\333\177\000\000\v\n\241\020BV\000\000\320\330\345\311"...}, tid = 0}, free_stack = 0x7fdb00000002, addr_description = {data = {kind = 432015844, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 10260676871990, alloc_stack_id = 432015844, free_stack_id = 31771, chunk_access = {bad_addr = 20, offset = 136455837977040, chunk_begin = 40, chunk_size = 62887350919176, user_requested_alignment = 1536, access_type = 3, alloc_type = 2}}, stack = {addr = 0, tid = 0, offset = 10260676871990, frame_pc = 136455837977060, access_size = 20, frame_descr = 0x7c1b19c009d0 "U\t"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 10260676871990, size_with_redzone = 136455837977060, name = 0x14 <error: Cannot access memory at address 0x14>, module_name = 0x7c1b19c009d0 "U\t", has_dynamic_init = 40, gcc_location = 0x39321a366008, odr_indicator = 14546846794988041728}, {beg = 136318399050544, size = 140579027621506, size_with_redzone = 140732285703143, name = 0xf <error: Cannot access memory at address 0xf>, module_name = 0x7ffec9e5d3e7 "", has_dynamic_init = 206158430224, gcc_location = 0x7ffec9e5d9c0, odr_indicator = 140732285704400}, {beg = 140579027828192, size = 140579026652003, size_with_redzone = 140579014324432, name = 0xc9e0c816694ab600 <error: Cannot access memory at address 0xc9e0c816694ab600>, module_name = 0x7c0b00000000 "", has_dynamic_init = 140732285703168, gcc_location = 0x71, odr_indicator = 136180941333664}, {beg = 140732285703168, size = 49, size_with_redzone = 140732285702928, name = 0x7fdb1ae9643c <__GI___dprintf+156> "H\213\225H\377\377\377dH+\024%(", module_name = 0x3000000020 <error: Cannot access memory at address 0x3000000020>, has_dynamic_init = 140732285702944, gcc_location = 0x7ffec9e5d260, odr_indicator = 14546846794988041728}}, reg_sites = {3387283456, 32766, 0, 0}, access_size = 140732285703188, size = 227 '\343'}, wild = {addr = 0, access_size = 0}}}}}, AllocTypeMismatch = {<__asan::ErrorBase> = {scariness = {score = 46, descr = "4-byte-write-heap-use-after-free\000\000\000\0002\000\000\000\000\000\000\000\000\360e\311\376\177\000\0002\000\000\000\000\000\000\000 %\242\030\333{\000\0001\000\000\000\000\000\000\000X\326\345\311\376\177\000\000 %\242\030\333{\000\000\300\315\345\311\376\177\000\000\037{\250\033\333\177\000\000\001\000\000\000\000\000\000\000 %\242\030\333{\000\000\020\326\345\311\376\177\000\000\322\025\267\033\333\177\000\000\000\000\000\000\000\000\000\000\305\234\270\033\036\000\000\000\360\315\345\311\376\177\000\000\003\000\000\000\000\000\000\000\020\026\267\033\333\177\000\000\217\233\354\032\333\177\000\000\v\n\241\020BV\000\000\320\330\345\311"...}, tid = 0}, dealloc_stack = 0x7fdb00000002, alloc_type = 432015844, dealloc_type = 31771, addr_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 0, kind = (__asan::kShadowKindHigh | unknown: 0x34), shadow_byte = 7 '\a'}, heap = {addr = 0, alloc_tid = 10260676871990, free_tid = 136455837977060, alloc_stack_id = 20, free_stack_id = 0, chunk_access = {bad_addr = 136455837977040, offset = 40, chunk_begin = 62887350919176, chunk_size = 14546846794988041728, user_requested_alignment = 816, access_type = 3, alloc_type = 1}}, stack = {addr = 0, tid = 10260676871990, offset = 136455837977060, frame_pc = 20, access_size = 136455837977040, frame_descr = 0x28 <error: Cannot access memory at address 0x28>}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 10260676871990, size = 136455837977060, size_with_redzone = 20, name = 0x7c1b19c009d0 "U\t", module_name = 0x28 <error: Cannot access memory at address 0x28>, has_dynamic_init = 62887350919176, gcc_location = 0xc9e0c816694ab600, odr_indicator = 136318399050544}, {beg = 140579027621506, size = 140732285703143, size_with_redzone = 15, name = 0x7ffec9e5d3e7 "", module_name = 0x3000000010 <error: Cannot access memory at address 0x3000000010>, has_dynamic_init = 140732285704640, gcc_location = 0x7ffec9e5d8d0, odr_indicator = 140579027828192}, {beg = 140579026652003, size = 140579014324432, size_with_redzone = 14546846794988041728, name = 0x7c0b00000000 "", module_name = 0x7ffec9e5d400 "f\235\270\033\333\177", has_dynamic_init = 113, gcc_location = 0x7bdb18a224a0, odr_indicator = 140732285703168}, {beg = 49, size = 140732285702928, size_with_redzone = 140579026068540, name = 0x3000000020 <error: Cannot access memory at address 0x3000000020>, module_name = 0x7ffec9e5d320 "\037{\250\033\333\177", has_dynamic_init = 140732285702752, gcc_location = 0xc9e0c816694ab600, odr_indicator = 140732285704192}}, reg_sites = {0, 0, 3387282452, 32766}, access_size = 94841743880931, size = 176 '\260'}, wild = {addr = 0, access_size = 10260676871990}}}}}, MallocUsableSizeNotOwned = {<__asan::ErrorBase> = {scariness = {score = 46, descr = "4-byte-write-heap-use-after-free\000\000\000\0002\000\000\000\000\000\000\000\000\360e\311\376\177\000\0002\000\000\000\000\000\000\000 %\242\030\333{\000\0001\000\000\000\000\000\000\000X\326\345\311\376\177\000\000 %\242\030\333{\000\000\300\315\345\311\376\177\000\000\037{\250\033\333\177\000\000\001\000\000\000\000\000\000\000 %\242\030\333{\000\000\020\326\345\311\376\177\000\000\322\025\267\033\333\177\000\000\000\000\000\000\000\000\000\000\305\234\270\033\036\000\000\000\360\315\345\311\376\177\000\000\003\000\000\000\000\000\000\000\020\026\267\033\333\177\000\000\217\233\354\032\333\177\000\000\v\n\241\020BV\000\000\320\330\345\311"...}, tid = 0}, stack = 0x7fdb00000002, addr_description = {data = {kind = 432015844, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 10260676871990, alloc_stack_id = 432015844, free_stack_id = 31771, chunk_access = {bad_addr = 20, offset = 136455837977040, chunk_begin = 40, chunk_size = 62887350919176, user_requested_alignment = 1536, access_type = 3, alloc_type = 2}}, stack = {addr = 0, tid = 0, offset = 10260676871990, frame_pc = 136455837977060, access_size = 20, frame_descr = 0x7c1b19c009d0 "U\t"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 10260676871990, size_with_redzone = 136455837977060, name = 0x14 <error: Cannot access memory at address 0x14>, module_name = 0x7c1b19c009d0 "U\t", has_dynamic_init = 40, gcc_location = 0x39321a366008, odr_indicator = 14546846794988041728}, {beg = 136318399050544, size = 140579027621506, size_with_redzone = 140732285703143, name = 0xf <error: Cannot access memory at address 0xf>, module_name = 0x7ffec9e5d3e7 "", has_dynamic_init = 206158430224, gcc_location = 0x7ffec9e5d9c0, odr_indicator = 140732285704400}, {beg = 140579027828192, size = 140579026652003, size_with_redzone = 140579014324432, name = 0xc9e0c816694ab600 <error: Cannot access memory at address 0xc9e0c816694ab600>, module_name = 0x7c0b00000000 "", has_dynamic_init = 140732285703168, gcc_location = 0x71, odr_indicator = 136180941333664}, {beg = 140732285703168, size = 49, size_with_redzone = 140732285702928, name = 0x7fdb1ae9643c <__GI___dprintf+156> "H\213\225H\377\377\377dH+\024%(", module_name = 0x3000000020 <error: Cannot access memory at address 0x3000000020>, has_dynamic_init = 140732285702944, gcc_location = 0x7ffec9e5d260, odr_indicator = 14546846794988041728}}, reg_sites = {3387283456, 32766, 0, 0}, access_size = 140732285703188, size = 227 '\343'}, wild = {addr = 0, access_size = 0}}}}}, SanitizerGetAllocatedSizeNotOwned = {<__asan::ErrorBase> = {scariness = {score = 46, descr = "4-byte-write-heap-use-after-free\000\000\000\0002\000\000\000\000\000\000\000\000\360e\311\376\177\000\0002\000\000\000\000\000\000\000 %\242\030\333{\000\0001\000\000\000\000\000\000\000X\326\345\311\376\177\000\000 %\242\030\333{\000\000\300\315\345\311\376\177\000\000\037{\250\033\333\177\000\000\001\000\000\000\000\000\000\000 %\242\030\333{\000\000\020\326\345\311\376\177\000\000\322\025\267\033\333\177\000\000\000\000\000\000\000\000\000\000\305\234\270\033\036\000\000\000\360\315\345\311\376\177\000\000\003\000\000\000\000\000\000\000\020\026\267\033\333\177\000\000\217\233\354\032\333\177\000\000\v\n\241\020BV\000\000\320\330\345\311"...}, tid = 0}, stack = 0x7fdb00000002, addr_description = {data = {kind = 432015844, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 10260676871990, alloc_stack_id = 432015844, free_stack_id = 31771, chunk_access = {bad_addr = 20, offset = 136455837977040, chunk_begin = 40, chunk_size = 62887350919176, user_requested_alignment = 1536, access_type = 3, alloc_type = 2}}, stack = {addr = 0, tid = 0, offset = 10260676871990, frame_pc = 136455837977060, access_size = 20, frame_descr = 0x7c1b19c009d0 "U\t"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 10260676871990, size_with_redzone = 136455837977060, name = 0x14 <error: Cannot access memory at address 0x14>, module_name = 0x7c1b19c009d0 "U\t", has_dynamic_init = 40, gcc_location = 0x39321a366008, odr_indicator = 14546846794988041728}, {beg = 136318399050544, size = 140579027621506, size_with_redzone = 140732285703143, name = 0xf <error: Cannot access memory at address 0xf>, module_name = 0x7ffec9e5d3e7 "", has_dynamic_init = 206158430224, gcc_location = 0x7ffec9e5d9c0, odr_indicator = 140732285704400}, {beg = 140579027828192, size = 140579026652003, size_with_redzone = 140579014324432, name = 0xc9e0c816694ab600 <error: Cannot access memory at address 0xc9e0c816694ab600>, module_name = 0x7c0b00000000 "", has_dynamic_init = 140732285703168, gcc_location = 0x71, odr_indicator = 136180941333664}, {beg = 140732285703168, size = 49, size_with_redzone = 140732285702928, name = 0x7fdb1ae9643c <__GI___dprintf+156> "H\213\225H\377\377\377dH+\024%(", module_name = 0x3000000020 <error: Cannot access memory at address 0x3000000020>, has_dynamic_init = 140732285702944, gcc_location = 0x7ffec9e5d260, odr_indicator = 14546846794988041728}}, reg_sites = {3387283456, 32766, 0, 0}, access_size = 140732285703188, size = 227 '\343'}, wild = {addr = 0, access_size = 0}}}}}, CallocOverflow = {<__asan::ErrorBase> = {scariness = {score = 46, descr = "4-byte-write-heap-use-after-free\000\000\000\0002\000\000\000\000\000\000\000\000\360e\311\376\177\000\0002\000\000\000\000\000\000\000 %\242\030\333{\000\0001\000\000\000\000\000\000\000X\326\345\311\376\177\000\000 %\242\030\333{\000\000\300\315\345\311\376\177\000\000\037{\250\033\333\177\000\000\001\000\000\000\000\000\000\000 %\242\030\333{\000\000\020\326\345\311\376\177\000\000\322\025\267\033\333\177\000\000\000\000\000\000\000\000\000\000\305\234\270\033\036\000\000\000\360\315\345\311\376\177\000\000\003\000\000\000\000\000\000\000\020\026\267\033\333\177\000\000\217\233\354\032\333\177\000\000\v\n\241\020BV\000\000\320\330\345\311"...}, tid = 0}, stack = 0x7fdb00000002, count = 136455837977060, size = 0}, ReallocArrayOverflow = {<__asan::ErrorBase> = {scariness = {score = 46, descr = "4-byte-write-heap-use-after-free\000\000\000\0002\000\000\000\000\000\000\000\000\360e\311\376\177\000\0002\000\000\000\000\000\000\000 %\242\030\333{\000\0001\000\000\000\000\000\000\000X\326\345\311\376\177\000\000 %\242\030\333{\000\000\300\315\345\311\376\177\000\000\037{\250\033\333\177\000\000\001\000\000\000\000\000\000\000 %\242\030\333{\000\000\020\326\345\311\376\177\000\000\322\025\267\033\333\177\000\000\000\000\000\000\000\000\000\000\305\234\270\033\036\000\000\000\360\315\345\311\376\177\000\000\003\000\000\000\000\000\000\000\020\026\267\033\333\177\000\000\217\233\354\032\333\177\000\000\v\n\241\020BV\000\000\320\330\345\311"...}, tid = 0}, stack = 0x7fdb00000002, count = 136455837977060, size = 0}, PvallocOverflow = {<__asan::ErrorBase> = {scariness = {score = 46, descr = "4-byte-write-heap-use-after-free\000\000\000\0002\000\000\000\000\000\000\000\000\360e\311\376\177\000\0002\000\000\000\000\000\000\000 %\242\030\333{\000\0001\000\000\000\000\000\000\000X\326\345\311\376\177\000\000 %\242\030\333{\000\000\300\315\345\311\376\177\000\000\037{\250\033\333\177\000\000\001\000\000\000\000\000\000\000 %\242\030\333{\000\000\020\326\345\311\376\177\000\000\322\025\267\033\333\177\000\000\000\000\000\000\000\000\000\000\305\234\270\033\036\000\000\000\360\315\345\311\376\177\000\000\003\000\000\000\000\000\000\000\020\026\267\033\333\177\000\000\217\233\354\032\333\177\000\000\v\n\241\020BV\000\000\320\330\345\311"...}, tid = 0}, stack = 0x7fdb00000002, size = 136455837977060}, InvalidAllocationAlignment = {<__asan::ErrorBase> = {scariness = {score = 46, descr = "4-byte-write-heap-use-after-free\000\000\000\0002\000\000\000\000\000\000\000\000\360e\311\376\177\000\0002\000\000\000\000\000\000\000 %\242\030\333{\000\0001\000\000\000\000\000\000\000X\326\345\311\376\177\000\000 %\242\030\333{\000\000\300\315\345\311\376\177\000\000\037{\250\033\333\177\000\000\001\000\000\000\000\000\000\000 %\242\030\333{\000\000\020\326\345\311\376\177\000\000\322\025\267\033\333\177\000\000\000\000\000\000\000\000\000\000\305\234\270\033\036\000\000\000\360\315\345\311\376\177\000\000\003\000\000\000\000\000\000\000\020\026\267\033\333\177\000\000\217\233\354\032\333\177\000\000\v\n\241\020BV\000\000\320\330\345\311"...}, tid = 0}, stack = 0x7fdb00000002, alignment = 136455837977060}, InvalidAlignedAllocAlignment = {<__asan::ErrorBase> = {scariness = {score = 46, descr = "4-byte-write-heap-use-after-free\000\000\000\0002\000\000\000\000\000\000\000\000\360e\311\376\177\000\0002\000\000\000\000\000\000\000 %\242\030\333{\000\0001\000\000\000\000\000\000\000X\326\345\311\376\177\000\000 %\242\030\333{\000\000\300\315\345\311\376\177\000\000\037{\250\033\333\177\000\000\001\000\000\000\000\000\000\000 %\242\030\333{\000\000\020\326\345\311\376\177\000\000\322\025\267\033\333\177\000\000\000\000\000\000\000\000\000\000\305\234\270\033\036\000\000\000\360\315\345\311\376\177\000\000\003\000\000\000\000\000\000\000\020\026\267\033\333\177\000\000\217\233\354\032\333\177\000\000\v\n\241\020BV\000\000\320\330\345\311"...}, tid = 0}, stack = 0x7fdb00000002, size = 136455837977060, alignment = 0}, InvalidPosixMemalignAlignment = {<__asan::ErrorBase> = {scariness = {score = 46, descr = "4-byte-write-heap-use-after-free\000\000\000\0002\000\000\000\000\000\000\000\000\360e\311\376\177\000\0002\000\000\000\000\000\000\000 %\242\030\333{\000\0001\000\000\000\000\000\000\000X\326\345\311\376\177\000\000 %\242\030\333{\000\000\300\315\345\311\376\177\000\000\037{\250\033\333\177\000\000\001\000\000\000\000\000\000\000 %\242\030\333{\000\000\020\326\345\311\376\177\000\000\322\025\267\033\333\177\000\000\000\000\000\000\000\000\000\000\305\234\270\033\036\000\000\000\360\315\345\311\376\177\000\000\003\000\000\000\000\000\000\000\020\026\267\033\333\177\000\000\217\233\354\032\333\177\000\000\v\n\241\020BV\000\000\320\330\345\311"...}, tid = 0}, stack = 0x7fdb00000002, alignment = 136455837977060}, AllocationSizeTooBig = {<__asan::ErrorBase> = {scariness = {score = 46, descr = "4-byte-write-heap-use-after-free\000\000\000\0002\000\000\000\000\000\000\000\000\360e\311\376\177\000\0002\000\000\000\000\000\000\000 %\242\030\333{\000\0001\000\000\000\000\000\000\000X\326\345\311\376\177\000\000 %\242\030\333{\000\000\300\315\345\311\376\177\000\000\037{\250\033\333\177\000\000\001\000\000\000\000\000\000\000 %\242\030\333{\000\000\020\326\345\311\376\177\000\000\322\025\267\033\333\177\000\000\000\000\000\000\000\000\000\000\305\234\270\033\036\000\000\000\360\315\345\311\376\177\000\000\003\000\000\000\000\000\000\000\020\026\267\033\333\177\000\000\217\233\354\032\333\177\000\000\v\n\241\020BV\000\000\320\330\345\311"...}, tid = 0}, stack = 0x7fdb00000002, user_size = 136455837977060, total_size = 0, max_size = 0}, RssLimitExceeded = {<__asan::ErrorBase> = {scariness = {score = 46, descr = "4-byte-write-heap-use-after-free\000\000\000\0002\000\000\000\000\000\000\000\000\360e\311\376\177\000\0002\000\000\000\000\000\000\000 %\242\030\333{\000\0001\000\000\000\000\000\000\000X\326\345\311\376\177\000\000 %\242\030\333{\000\000\300\315\345\311\376\177\000\000\037{\250\033\333\177\000\000\001\000\000\000\000\000\000\000 %\242\030\333{\000\000\020\326\345\311\376\177\000\000\322\025\267\033\333\177\000\000\000\000\000\000\000\000\000\000\305\234\270\033\036\000\000\000\360\315\345\311\376\177\000\000\003\000\000\000\000\000\000\000\020\026\267\033\333\177\000\000\217\233\354\032\333\177\000\000\v\n\241\020BV\000\000\320\330\345\311"...}, tid = 0}, stack = 0x7fdb00000002}, OutOfMemory = {<__asan::ErrorBase> = {scariness = {score = 46, descr = "4-byte-write-heap-use-after-free\000\000\000\0002\000\000\000\000\000\000\000\000\360e\311\376\177\000\0002\000\000\000\000\000\000\000 %\242\030\333{\000\0001\000\000\000\000\000\000\000X\326\345\311\376\177\000\000 %\242\030\333{\000\000\300\315\345\311\376\177\000\000\037{\250\033\333\177\000\000\001\000\000\000\000\000\000\000 %\242\030\333{\000\000\020\326\345\311\376\177\000\000\322\025\267\033\333\177\000\000\000\000\000\000\000\000\000\000\305\234\270\033\036\000\000\000\360\315\345\311\376\177\000\000\003\000\000\000\000\000\000\000\020\026\267\033\333\177\000\000\217\233\354\032\333\177\000\000\v\n\241\020BV\000\000\320\330\345\311"...}, tid = 0}, stack = 0x7fdb00000002, requested_size = 136455837977060}, StringFunctionMemoryRangesOverlap = {<__asan::ErrorBase> = {scariness = {score = 46, descr = "4-byte-write-heap-use-after-free\000\000\000\0002\000\000\000\000\000\000\000\000\360e\311\376\177\000\0002\000\000\000\000\000\000\000 %\242\030\333{\000\0001\000\000\000\000\000\000\000X\326\345\311\376\177\000\000 %\242\030\333{\000\000\300\315\345\311\376\177\000\000\037{\250\033\333\177\000\000\001\000\000\000\000\000\000\000 %\242\030\333{\000\000\020\326\345\311\376\177\000\000\322\025\267\033\333\177\000\000\000\000\000\000\000\000\000\000\305\234\270\033\036\000\000\000\360\315\345\311\376\177\000\000\003\000\000\000\000\000\000\000\020\026\267\033\333\177\000\000\217\233\354\032\333\177\000\000\v\n\241\020BV\000\000\320\330\345\311"...}, tid = 0}, stack = 0x7fdb00000002, length1 = 136455837977060, length2 = 0, addr1_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 10260676871990, kind = (unknown: 0xe4), shadow_byte = 9 '\t'}, heap = {addr = 10260676871990, alloc_tid = 136455837977060, free_tid = 20, alloc_stack_id = 432015824, free_stack_id = 31771, chunk_access = {bad_addr = 40, offset = 62887350919176, chunk_begin = 14546846794988041728, chunk_size = 136318399050544, user_requested_alignment = 1666, access_type = 1, alloc_type = 0}}, stack = {addr = 10260676871990, tid = 136455837977060, offset = 20, frame_pc = 136455837977040, access_size = 40, frame_descr = 0x39321a366008 <error: Cannot access memory at address 0x39321a366008>}, global = {addr = 10260676871990, static kMaxGlobals = 4, globals = {{beg = 136455837977060, size = 20, size_with_redzone = 136455837977040, name = 0x28 <error: Cannot access memory at address 0x28>, module_name = 0x39321a366008 <error: Cannot access memory at address 0x39321a366008>, has_dynamic_init = 14546846794988041728, gcc_location = 0x7bfb19c07330, odr_indicator = 140579027621506}, {beg = 140732285703143, size = 15, size_with_redzone = 140732285703143, name = 0x3000000010 <error: Cannot access memory at address 0x3000000010>, module_name = 0x7ffec9e5d9c0 "\320\t\300\031\033|", has_dynamic_init = 140732285704400, gcc_location = 0x7fdb1b043de0 <_nl_C_locobj>, odr_indicator = 140579026652003}, {beg = 140579014324432, size = 14546846794988041728, size_with_redzone = 136386686484480, name = 0x7ffec9e5d400 "f\235\270\033\333\177", module_name = 0x71 <error: Cannot access memory at address 0x71>, has_dynamic_init = 136180941333664, gcc_location = 0x7ffec9e5d400, odr_indicator = 49}, {beg = 140732285702928, size = 140579026068540, size_with_redzone = 206158430240, name = 0x7ffec9e5d320 "\037{\250\033\333\177", module_name = 0x7ffec9e5d260 "", has_dynamic_init = 14546846794988041728, gcc_location = 0x7ffec9e5d800, odr_indicator = 0}}, reg_sites = {3387282452, 32766, 276050659, 22082}, access_size = 140732285704624, size = 160 '\240'}, wild = {addr = 10260676871990, access_size = 136455837977060}}}}, addr2_description = {data = {kind = __asan::kAddressKindGlobal, {shadow = {addr = 140579039975319, kind = __asan::kShadowKindGap, shadow_byte = 253 '\375'}, heap = {addr = 140579039975319, alloc_tid = 56293228674305, free_tid = 17022617666704, alloc_stack_id = 65535, free_stack_id = 0, chunk_access = {bad_addr = 94841748015232, offset = 140732285704272, chunk_begin = 136387118408592, chunk_size = 94841744650166, user_requested_alignment = 1792, access_type = 1, alloc_type = 3}}, stack = {addr = 140579039975319, tid = 56293228674305, offset = 17022617666704, frame_pc = 65535, access_size = 94841748015232, frame_descr = 0x7ffec9e5d850 ""}, global = {addr = 140579039975319, static kMaxGlobals = 4, globals = {{beg = 56293228674305, size = 17022617666704, size_with_redzone = 65535, name = 0x564210b34880 "%s:%s() ", module_name = 0x7ffec9e5d850 "", has_dynamic_init = 136387118408592, gcc_location = 0x5642107fefb6 <btd_debug+358>, odr_indicator = 136180940068608}, {beg = 94841748133408, size = 30064836607, size_with_redzone = 94841748128032, name = 0x7bdb18a223a0 "0", module_name = 0x7bdb188eb4a0 "PO\276\031K|", has_dynamic_init = 140732285704352, gcc_location = 0x7fdb1bbaff7d <__sanitizer::DTLS_on_tls_get_addr(void*, void*, unsigned long, unsigned long)+125>, odr_indicator = 96}, {beg = 14546846794988041728, size = 140732285704400, size_with_redzone = 14546846794988041728, name = 0xf7b63144450 <error: Cannot access memory at address 0xf7b63144450>, module_name = 0x7fdb1bc19f78 "\001", has_dynamic_init = 65535, gcc_location = 0xc9e0c816694ab600, odr_indicator = 140579018234040}, {beg = 136180940059808, size = 94841748015168, size_with_redzone = 94841748024160, name = 0x7c1b19c009d0 "U\t", module_name = 0x9ed48 <error: Cannot access memory at address 0x9ed48>, has_dynamic_init = 140732285704496, gcc_location = 0x7bdb18a22380, odr_indicator = 17022617666672}}, reg_sites = {65535, 0, 280297760, 22082}, access_size = 140732285704512, size = 160 '\240'}, wild = {addr = 140579039975319, access_size = 56293228674305}}}}, function = 0x5642107fefb6 <btd_debug+358> "I9\336uMH\307\205"}, StringFunctionSizeOverflow = {<__asan::ErrorBase> = {scariness = {score = 46, descr = "4-byte-write-heap-use-after-free\000\000\000\0002\000\000\000\000\000\000\000\000\360e\311\376\177\000\0002\000\000\000\000\000\000\000 %\242\030\333{\000\0001\000\000\000\000\000\000\000X\326\345\311\376\177\000\000 %\242\030\333{\000\000\300\315\345\311\376\177\000\000\037{\250\033\333\177\000\000\001\000\000\000\000\000\000\000 %\242\030\333{\000\000\020\326\345\311\376\177\000\000\322\025\267\033\333\177\000\000\000\000\000\000\000\000\000\000\305\234\270\033\036\000\000\000\360\315\345\311\376\177\000\000\003\000\000\000\000\000\000\000\020\026\267\033\333\177\000\000\217\233\354\032\333\177\000\000\v\n\241\020BV\000\000\320\330\345\311"...}, tid = 0}, stack = 0x7fdb00000002, addr_description = {data = {kind = 432015844, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 10260676871990, alloc_stack_id = 432015844, free_stack_id = 31771, chunk_access = {bad_addr = 20, offset = 136455837977040, chunk_begin = 40, chunk_size = 62887350919176, user_requested_alignment = 1536, access_type = 3, alloc_type = 2}}, stack = {addr = 0, tid = 0, offset = 10260676871990, frame_pc = 136455837977060, access_size = 20, frame_descr = 0x7c1b19c009d0 "U\t"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 10260676871990, size_with_redzone = 136455837977060, name = 0x14 <error: Cannot access memory at address 0x14>, module_name = 0x7c1b19c009d0 "U\t", has_dynamic_init = 40, gcc_location = 0x39321a366008, odr_indicator = 14546846794988041728}, {beg = 136318399050544, size = 140579027621506, size_with_redzone = 140732285703143, name = 0xf <error: Cannot access memory at address 0xf>, module_name = 0x7ffec9e5d3e7 "", has_dynamic_init = 206158430224, gcc_location = 0x7ffec9e5d9c0, odr_indicator = 140732285704400}, {beg = 140579027828192, size = 140579026652003, size_with_redzone = 140579014324432, name = 0xc9e0c816694ab600 <error: Cannot access memory at address 0xc9e0c816694ab600>, module_name = 0x7c0b00000000 "", has_dynamic_init = 140732285703168, gcc_location = 0x71, odr_indicator = 136180941333664}, {beg = 140732285703168, size = 49, size_with_redzone = 140732285702928, name = 0x7fdb1ae9643c <__GI___dprintf+156> "H\213\225H\377\377\377dH+\024%(", module_name = 0x3000000020 <error: Cannot access memory at address 0x3000000020>, has_dynamic_init = 140732285702944, gcc_location = 0x7ffec9e5d260, odr_indicator = 14546846794988041728}}, reg_sites = {3387283456, 32766, 0, 0}, access_size = 140732285703188, size = 227 '\343'}, wild = {addr = 0, access_size = 0}}}}, size = 140732285704624}, BadParamsToAnnotateContiguousContainer = {<__asan::ErrorBase> = {scariness = {score = 46, descr = "4-byte-write-heap-use-after-free\000\000\000\0002\000\000\000\000\000\000\000\000\360e\311\376\177\000\0002\000\000\000\000\000\000\000 %\242\030\333{\000\0001\000\000\000\000\000\000\000X\326\345\311\376\177\000\000 %\242\030\333{\000\000\300\315\345\311\376\177\000\000\037{\250\033\333\177\000\000\001\000\000\000\000\000\000\000 %\242\030\333{\000\000\020\326\345\311\376\177\000\000\322\025\267\033\333\177\000\000\000\000\000\000\000\000\000\000\305\234\270\033\036\000\000\000\360\315\345\311\376\177\000\000\003\000\000\000\000\000\000\000\020\026\267\033\333\177\000\000\217\233\354\032\333\177\000\000\v\n\241\020BV\000\000\320\330\345\311"...}, tid = 0}, stack = 0x7fdb00000002, beg = 136455837977060, end = 0, old_mid = 0, new_mid = 10260676871990}, BadParamsToAnnotateDoubleEndedContiguousContainer = {<__asan::ErrorBase> = {scariness = {score = 46, descr = "4-byte-write-heap-use-after-free\000\000\000\0002\000\000\000\000\000\000\000\000\360e\311\376\177\000\0002\000\000\000\000\000\000\000 %\242\030\333{\000\0001\000\000\000\000\000\000\000X\326\345\311\376\177\000\000 %\242\030\333{\000\000\300\315\345\311\376\177\000\000\037{\250\033\333\177\000\000\001\000\000\000\000\000\000\000 %\242\030\333{\000\000\020\326\345\311\376\177\000\000\322\025\267\033\333\177\000\000\000\000\000\000\000\000\000\000\305\234\270\033\036\000\000\000\360\315\345\311\376\177\000\000\003\000\000\000\000\000\000\000\020\026\267\033\333\177\000\000\217\233\354\032\333\177\000\000\v\n\241\020BV\000\000\320\330\345\311"...}, tid = 0}, stack = 0x7fdb00000002, storage_beg = 136455837977060, storage_end = 0, old_container_beg = 0, old_container_end = 10260676871990, new_container_beg = 136455837977060, new_container_end = 20}, BadParamsToCopyContiguousContainerAnnotations = {<__asan::ErrorBase> = {scariness = {score = 46, descr = "4-byte-write-heap-use-after-free\000\000\000\0002\000\000\000\000\000\000\000\000\360e\311\376\177\000\0002\000\000\000\000\000\000\000 %\242\030\333{\000\0001\000\000\000\000\000\000\000X\326\345\311\376\177\000\000 %\242\030\333{\000\000\300\315\345\311\376\177\000\000\037{\250\033\333\177\000\000\001\000\000\000\000\000\000\000 %\242\030\333{\000\000\020\326\345\311\376\177\000\000\322\025\267\033\333\177\000\000\000\000\000\000\000\000\000\000\305\234\270\033\036\000\000\000\360\315\345\311\376\177\000\000\003\000\000\000\000\000\000\000\020\026\267\033\333\177\000\000\217\233\354\032\333\177\000\000\v\n\241\020BV\000\000\320\330\345\311"...}, tid = 0}, stack = 0x7fdb00000002, old_storage_beg = 136455837977060, old_storage_end = 0, new_storage_beg = 0, new_storage_end = 10260676871990}, ODRViolation = {<__asan::ErrorBase> = {scariness = {score = 46, descr = "4-byte-write-heap-use-after-free\000\000\000\0002\000\000\000\000\000\000\000\000\360e\311\376\177\000\0002\000\000\000\000\000\000\000 %\242\030\333{\000\0001\000\000\000\000\000\000\000X\326\345\311\376\177\000\000 %\242\030\333{\000\000\300\315\345\311\376\177\000\000\037{\250\033\333\177\000\000\001\000\000\000\000\000\000\000 %\242\030\333{\000\000\020\326\345\311\376\177\000\000\322\025\267\033\333\177\000\000\000\000\000\000\000\000\000\000\305\234\270\033\036\000\000\000\360\315\345\311\376\177\000\000\003\000\000\000\000\000\000\000\020\026\267\033\333\177\000\000\217\233\354\032\333\177\000\000\v\n\241\020BV\000\000\320\330\345\311"...}, tid = 0}, global1 = {beg = 140578574565378, size = 136455837977060, size_with_redzone = 0, name = 0x0, module_name = 0x95500000736 <error: Cannot access memory at address 0x95500000736>, has_dynamic_init = 136455837977060, gcc_location = 0x14, odr_indicator = 136455837977040}, global2 = {beg = 40, size = 62887350919176, size_with_redzone = 14546846794988041728, name = 0x7bfb19c07330 "R\004", module_name = 0x7fdb1b011682 "T ", has_dynamic_init = 140732285703143, gcc_location = 0xf, odr_indicator = 140732285703143}, stack_id1 = 16, stack_id2 = 48}, InvalidPointerPair = {<__asan::ErrorBase> = {scariness = {score = 46, descr = "4-byte-write-heap-use-after-free\000\000\000\0002\000\000\000\000\000\000\000\000\360e\311\376\177\000\0002\000\000\000\000\000\000\000 %\242\030\333{\000\0001\000\000\000\000\000\000\000X\326\345\311\376\177\000\000 %\242\030\333{\000\000\300\315\345\311\376\177\000\000\037{\250\033\333\177\000\000\001\000\000\000\000\000\000\000 %\242\030\333{\000\000\020\326\345\311\376\177\000\000\322\025\267\033\333\177\000\000\000\000\000\000\000\000\000\000\305\234\270\033\036\000\000\000\360\315\345\311\376\177\000\000\003\000\000\000\000\000\000\000\020\026\267\033\333\177\000\000\217\233\354\032\333\177\000\000\v\n\241\020BV\000\000\320\330\345\311"...}, tid = 0}, pc = 140578574565378, bp = 136455837977060, sp = 0, addr1_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 10260676871990, kind = (unknown: 0xe4), shadow_byte = 9 '\t'}, heap = {addr = 10260676871990, alloc_tid = 136455837977060, free_tid = 20, alloc_stack_id = 432015824, free_stack_id = 31771, chunk_access = {bad_addr = 40, offset = 62887350919176, chunk_begin = 14546846794988041728, chunk_size = 136318399050544, user_requested_alignment = 1666, access_type = 1, alloc_type = 0}}, stack = {addr = 10260676871990, tid = 136455837977060, offset = 20, frame_pc = 136455837977040, access_size = 40, frame_descr = 0x39321a366008 <error: Cannot access memory at address 0x39321a366008>}, global = {addr = 10260676871990, static kMaxGlobals = 4, globals = {{beg = 136455837977060, size = 20, size_with_redzone = 136455837977040, name = 0x28 <error: Cannot access memory at address 0x28>, module_name = 0x39321a366008 <error: Cannot access memory at address 0x39321a366008>, has_dynamic_init = 14546846794988041728, gcc_location = 0x7bfb19c07330, odr_indicator = 140579027621506}, {beg = 140732285703143, size = 15, size_with_redzone = 140732285703143, name = 0x3000000010 <error: Cannot access memory at address 0x3000000010>, module_name = 0x7ffec9e5d9c0 "\320\t\300\031\033|", has_dynamic_init = 140732285704400, gcc_location = 0x7fdb1b043de0 <_nl_C_locobj>, odr_indicator = 140579026652003}, {beg = 140579014324432, size = 14546846794988041728, size_with_redzone = 136386686484480, name = 0x7ffec9e5d400 "f\235\270\033\333\177", module_name = 0x71 <error: Cannot access memory at address 0x71>, has_dynamic_init = 136180941333664, gcc_location = 0x7ffec9e5d400, odr_indicator = 49}, {beg = 140732285702928, size = 140579026068540, size_with_redzone = 206158430240, name = 0x7ffec9e5d320 "\037{\250\033\333\177", module_name = 0x7ffec9e5d260 "", has_dynamic_init = 14546846794988041728, gcc_location = 0x7ffec9e5d800, odr_indicator = 0}}, reg_sites = {3387282452, 32766, 276050659, 22082}, access_size = 140732285704624, size = 160 '\240'}, wild = {addr = 10260676871990, access_size = 136455837977060}}}}, addr2_description = {data = {kind = __asan::kAddressKindGlobal, {shadow = {addr = 140579039975319, kind = __asan::kShadowKindGap, shadow_byte = 253 '\375'}, heap = {addr = 140579039975319, alloc_tid = 56293228674305, free_tid = 17022617666704, alloc_stack_id = 65535, free_stack_id = 0, chunk_access = {bad_addr = 94841748015232, offset = 140732285704272, chunk_begin = 136387118408592, chunk_size = 94841744650166, user_requested_alignment = 1792, access_type = 1, alloc_type = 3}}, stack = {addr = 140579039975319, tid = 56293228674305, offset = 17022617666704, frame_pc = 65535, access_size = 94841748015232, frame_descr = 0x7ffec9e5d850 ""}, global = {addr = 140579039975319, static kMaxGlobals = 4, globals = {{beg = 56293228674305, size = 17022617666704, size_with_redzone = 65535, name = 0x564210b34880 "%s:%s() ", module_name = 0x7ffec9e5d850 "", has_dynamic_init = 136387118408592, gcc_location = 0x5642107fefb6 <btd_debug+358>, odr_indicator = 136180940068608}, {beg = 94841748133408, size = 30064836607, size_with_redzone = 94841748128032, name = 0x7bdb18a223a0 "0", module_name = 0x7bdb188eb4a0 "PO\276\031K|", has_dynamic_init = 140732285704352, gcc_location = 0x7fdb1bbaff7d <__sanitizer::DTLS_on_tls_get_addr(void*, void*, unsigned long, unsigned long)+125>, odr_indicator = 96}, {beg = 14546846794988041728, size = 140732285704400, size_with_redzone = 14546846794988041728, name = 0xf7b63144450 <error: Cannot access memory at address 0xf7b63144450>, module_name = 0x7fdb1bc19f78 "\001", has_dynamic_init = 65535, gcc_location = 0xc9e0c816694ab600, odr_indicator = 140579018234040}, {beg = 136180940059808, size = 94841748015168, size_with_redzone = 94841748024160, name = 0x7c1b19c009d0 "U\t", module_name = 0x9ed48 <error: Cannot access memory at address 0x9ed48>, has_dynamic_init = 140732285704496, gcc_location = 0x7bdb18a22380, odr_indicator = 17022617666672}}, reg_sites = {65535, 0, 280297760, 22082}, access_size = 140732285704512, size = 160 '\240'}, wild = {addr = 140579039975319, access_size = 56293228674305}}}}}, Generic = {<__asan::ErrorBase> = {scariness = {score = 46, descr = "4-byte-write-heap-use-after-free\000\000\000\0002\000\000\000\000\000\000\000\000\360e\311\376\177\000\0002\000\000\000\000\000\000\000 %\242\030\333{\000\0001\000\000\000\000\000\000\000X\326\345\311\376\177\000\000 %\242\030\333{\000\000\300\315\345\311\376\177\000\000\037{\250\033\333\177\000\000\001\000\000\000\000\000\000\000 %\242\030\333{\000\000\020\326\345\311\376\177\000\000\322\025\267\033\333\177\000\000\000\000\000\000\000\000\000\000\305\234\270\033\036\000\000\000\360\315\345\311\376\177\000\000\003\000\000\000\000\000\000\000\020\026\267\033\333\177\000\000\217\233\354\032\333\177\000\000\v\n\241\020BV\000\000\320\330\345\311"...}, tid = 0}, addr_description = {data = {kind = __asan::kAddressKindHeap, {shadow = {addr = 136455837977060, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 136455837977060, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1846, free_stack_id = 2389, chunk_access = {bad_addr = 136455837977060, offset = 20, chunk_begin = 136455837977040, chunk_size = 40, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, stack = {addr = 136455837977060, tid = 0, offset = 0, frame_pc = 10260676871990, access_size = 136455837977060, frame_descr = 0x14 <error: Cannot access memory at address 0x14>}, global = {addr = 136455837977060, static kMaxGlobals = 4, globals = {{beg = 0, size = 0, size_with_redzone = 10260676871990, name = 0x7c1b19c009e4 "", module_name = 0x14 <error: Cannot access memory at address 0x14>, has_dynamic_init = 136455837977040, gcc_location = 0x28, odr_indicator = 62887350919176}, {beg = 14546846794988041728, size = 136318399050544, size_with_redzone = 140579027621506, name = 0x7ffec9e5d3e7 "", module_name = 0xf <error: Cannot access memory at address 0xf>, has_dynamic_init = 140732285703143, gcc_location = 0x3000000010, odr_indicator = 140732285704640}, {beg = 140732285704400, size = 140579027828192, size_with_redzone = 140579026652003, name = 0x7fdb1a3630d0 "", module_name = 0xc9e0c816694ab600 <error: Cannot access memory at address 0xc9e0c816694ab600>, has_dynamic_init = 136386686484480, gcc_location = 0x7ffec9e5d400, odr_indicator = 113}, {beg = 136180941333664, size = 140732285703168, size_with_redzone = 49, name = 0x7ffec9e5d310 " %\242\030\333{", module_name = 0x7fdb1ae9643c <__GI___dprintf+156> "H\213\225H\377\377\377dH+\024%(", has_dynamic_init = 206158430240, gcc_location = 0x7ffec9e5d320, odr_indicator = 140732285702752}}, reg_sites = {1766503936, 3386951702, 3387283456, 32766}, access_size = 0, size = 20 '\024'}, wild = {addr = 136455837977060, access_size = 0}}}}, pc = 94841743880931, bp = 140732285704624, sp = 140732285704608, access_size = 4, bug_descr = 0x7fdb1bbd9797 "heap-use-after-free", is_write = true, shadow_val = 253 '\375'}}}, halt_on_error_ = true}
                error = {<__asan::ErrorBase> = {scariness = {score = 46, descr = "4-byte-write-heap-use-after-free\000\000\000\0002\000\000\000\000\000\000\000\000\360e\311\376\177\000\0002\000\000\000\000\000\000\000 %\242\030\333{\000\0001\000\000\000\000\000\000\000X\326\345\311\376\177\000\000 %\242\030\333{\000\000\300\315\345\311\376\177\000\000\037{\250\033\333\177\000\000\001\000\000\000\000\000\000\000 %\242\030\333{\000\000\020\326\345\311\376\177\000\000\322\025\267\033\333\177\000\000\000\000\000\000\000\000\000\000\305\234\270\033\036\000\000\000\360\315\345\311\376\177\000\000\003\000\000\000\000\000\000\000\020\026\267\033\333\177\000\000\217\233\354\032\333\177\000\000\v\n\241\020BV\000\000\320\330\345\311"...}, tid = 0}, addr_description = {data = {kind = __asan::kAddressKindHeap, {shadow = {addr = 136455837977060, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 136455837977060, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1846, free_stack_id = 2389, chunk_access = {bad_addr = 136455837977060, offset = 20, chunk_begin = 136455837977040, chunk_size = 40, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, stack = {addr = 136455837977060, tid = 0, offset = 0, frame_pc = 10260676871990, access_size = 136455837977060, frame_descr = 0x14 <error: Cannot access memory at address 0x14>}, global = {addr = 136455837977060, static kMaxGlobals = 4, globals = {{beg = 0, size = 0, size_with_redzone = 10260676871990, name = 0x7c1b19c009e4 "", module_name = 0x14 <error: Cannot access memory at address 0x14>, has_dynamic_init = 136455837977040, gcc_location = 0x28, odr_indicator = 62887350919176}, {beg = 14546846794988041728, size = 136318399050544, size_with_redzone = 140579027621506, name = 0x7ffec9e5d3e7 "", module_name = 0xf <error: Cannot access memory at address 0xf>, has_dynamic_init = 140732285703143, gcc_location = 0x3000000010, odr_indicator = 140732285704640}, {beg = 140732285704400, size = 140579027828192, size_with_redzone = 140579026652003, name = 0x7fdb1a3630d0 "", module_name = 0xc9e0c816694ab600 <error: Cannot access memory at address 0xc9e0c816694ab600>, has_dynamic_init = 136386686484480, gcc_location = 0x7ffec9e5d400, odr_indicator = 113}, {beg = 136180941333664, size = 140732285703168, size_with_redzone = 49, name = 0x7ffec9e5d310 " %\242\030\333{", module_name = 0x7fdb1ae9643c <__GI___dprintf+156> "H\213\225H\377\377\377dH+\024%(", has_dynamic_init = 206158430240, gcc_location = 0x7ffec9e5d320, odr_indicator = 140732285702752}}, reg_sites = {1766503936, 3386951702, 3387283456, 32766}, access_size = 0, size = 20 '\024'}, wild = {addr = 136455837977060, access_size = 0}}}}, pc = 94841743880931, bp = 140732285704624, sp = 140732285704608, access_size = 4, bug_descr = 0x7fdb1bbd9797 "heap-use-after-free", is_write = true, shadow_val = 253 '\375'}
        #9  0x00007fdb1bb7df8d in __asan::ReportGenericError (pc=<optimized out>, bp=bp@entry=140732285704624, sp=sp@entry=140732285704608, addr=<optimized out>, is_write=is_write@entry=true, access_size=access_size@entry=4, exp=<optimized out>, fatal=true) at ../../../../src/libsanitizer/asan/asan_report.cpp:536
                in_report = <optimized out>
                error = <optimized out>
                enable_fp = <optimized out>
        #10 0x00007fdb1bb7f85c in __asan::__asan_report_store4 (addr=<optimized out>) at ../../../../src/libsanitizer/asan/asan_rtl.cpp:135
                bp = 140732285704624
                pc = <optimized out>
                local_stack = 136318399050576
                sp = 140732285704608
        #11 0x00005642107432e3 in report_notify_destroy (user_data=<optimized out>) at profiles/input/hog-lib.c:359
                report = <optimized out>
                __func__ = "report_notify_destroy"
        #12 0x00005642107e5f52 in attrib_callbacks_destroy (data=0x7c3b19bf1540) at attrib/gattrib.c:126
                cb = 0x7c3b19bf1540
        #13 0x00005642109d4d6b in notify_data_unref (data=<optimized out>) at src/shared/gatt-client.c:256
                notify_data = <optimized out>
        #14 notify_data_unref (data=<optimized out>) at src/shared/gatt-client.c:248
                notify_data = <optimized out>
        #15 0x000056421097f382 in queue_remove_all (queue=queue@entry=0x7c0b19bea390, function=function@entry=0x0, user_data=user_data@entry=0x0, destroy=0x5642109d4e70 <notify_data_cleanup>) at src/shared/queue.c:341
                tmp = 0x7bfb19c07350
                entry = 0x0
                count = <optimized out>
        #16 0x000056421097f679 in queue_destroy (queue=0x7c0b19bea390, destroy=<optimized out>) at src/shared/queue.c:60
        No locals.
        #17 0x00005642109db8ba in bt_gatt_client_free (client=0x7ceb19be1440) at src/shared/gatt-client.c:2293
        No locals.
        #18 0x00005642109dd56c in bt_gatt_client_unref (client=<optimized out>) at src/shared/gatt-client.c:2605
        No locals.
        #19 0x00005642107e74ed in g_attrib_unref (attrib=0x7c4b19be5500) at attrib/gattrib.c:154
                __func__ = "g_attrib_unref"
        #20 0x00005642108ead7e in attio_cleanup (device=<optimized out>) at src/device.c:874
                attrib = <optimized out>
        #21 0x00005642108eb2c7 in device_free (user_data=0x7d4b19be0080) at src/device.c:918
                device = 0x7d4b19be0080
                __func__ = "device_free"
        #22 0x0000564210968eda in remove_interface (data=0x7c4b19be4f50, name=name@entry=0x564210b75ae0 "org.bluez.Device1") at gdbus/object.c:742
                iface = 0x7c3b19be5ae0
        #23 0x000056421096ba9c in g_dbus_unregister_interface (connection=<optimized out>, path=<optimized out>, name=<optimized out>) at gdbus/object.c:1499
                data = <optimized out>
        #24 0x00005642108a6598 in adapter_remove (adapter=adapter@entry=0x7d0b19be0200) at src/adapter.c:7321
                device = 0x7d4b19be0080
                db = <optimized out>
                ranging_manager = <optimized out>
                __func__ = "adapter_remove"
        #25 0x00005642108a70d8 in adapter_cleanup () at src/adapter.c:11274
                adapter = 0x7d0b19be0200
        #26 0x0000564210658330 in main (argc=<optimized out>, argv=<optimized out>) at src/main.c:1723
                context = <optimized out>
                err = <optimized out>
                sdp_mtu = 0
                sdp_flags = <optimized out>
                gdbus_flags = <optimized out>
                __func__ = "main""
FAIL functional.test_hog::test_hog[sci-hosts15-vm2]: failed on teardown with "pytest_bluezenv.plugin.CoredumpWarning: Core dump: test-bluezenv-hosts15.0-bluetoothd-1790201622-129.core
        /usr/bin/gdb: warning: Couldn't determine a path for the index cache directory.
        [New LWP 129]
        [Thread debugging using libthread_db enabled]
        Using host libthread_db library "/usr/lib/x86_64-linux-gnu/libthread_db.so.1".
        Core was generated by `/home/runner/work/bluez/bluez/src/src/src/bluetoothd --nodetach -f /run/bluetoo'.
        Program terminated with signal SIGABRT, Aborted.
        #0  __pthread_kill_implementation (threadid=<optimized out>, signo=6, no_tid=0) at ./nptl/pthread_kill.c:44

        warning: 44	./nptl/pthread_kill.c: No such file or directory

        Thread 1 (Thread 0x7f2242104900 (LWP 129)):
        #0  __pthread_kill_implementation (threadid=<optimized out>, signo=6, no_tid=0) at ./nptl/pthread_kill.c:44
                tid = <optimized out>
                ret = 0
                pd = <optimized out>
                old_mask = {__val = {0}}
                ret = <optimized out>
        #1  __pthread_kill_internal (threadid=<optimized out>, signo=6) at ./nptl/pthread_kill.c:89
        No locals.
        #2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ./nptl/pthread_kill.c:100
        No locals.
        #3  0x00007f224285fb7e in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
                ret = <optimized out>
        #4  0x00007f22428428ec in __GI_abort () at ./stdlib/abort.c:77
                act = {__sigaction_handler = {sa_handler = 0x0, sa_sigaction = 0x0}, sa_mask = {__val = {0 <repeats 16 times>}}, sa_flags = 0, sa_restorer = 0x0}
        #5  0x00007f224346aa0f in __sanitizer::Abort () at ../../../../src/libsanitizer/sanitizer_common/sanitizer_posix_libcdep.cpp:165
        No locals.
        #6  0x00007f2243590c2d in __sanitizer::Die () at ../../../../src/libsanitizer/sanitizer_common/sanitizer_termination.cpp:58
        No locals.
        #7  0x00007f224356593c in __asan::ScopedInErrorReport::~ScopedInErrorReport (this=0x7fffc7608166) at ../../../../src/libsanitizer/asan/asan_report.cpp:221
                buffer_copy = {buffer_ = {<__sanitizer::InternalMmapVectorNoCtor<char, false>> = {data_ = 0x7f2241918000 '=' <repeats 65 times>, "\n==129==ERROR: AddressSanitizer: heap-use-after-free on address 0x7b6241600964 at pc 0x5556495e52e3 bp 0x7fffc7608de0 sp 0x7fffc7608dd0"..., capacity_bytes_ = 4096, size_ = 3936}, <No data fields>}}
                buffer_copy = <optimized out>
                l = <optimized out>
        #8  0x00007f2243564e02 in __asan::ReportGenericError (pc=93829086466787, bp=140736538381792, sp=sp@entry=140736538381776, addr=135661933824356, is_write=is_write@entry=true, access_size=4, fatal=true, exp=<optimized out>) at ../../../../src/libsanitizer/asan/asan_report.cpp:536
                in_report = {error_report_lock_ = {<No data fields>}, static current_error_ = {kind = __asan::kErrorKindGeneric, {Base = {scariness = {score = 46, descr = "4-byte-write-heap-use-after-free\000\000\000\0002\000\000\000\000\000\000\000\000\260\340\306\377\177\000\0002\000\000\000\000\000\000\000 \202B@\"{\000\0001\000\000\000\000\000\000\000\210\212`\307\377\177\000\000 \202B@\"{\000\000\360\201`\307\377\177\000\000\037\353FC\"\177\000\000\001\000\000\000\000\000\000\000 \202B@\"{\000\000@\212`\307\377\177\000\000\322\205UC\"\177\000\000\000\000\000\000\000\000\000\000\305\fWC\036\000\000\000 \202`\307\377\177\000\000\003\000\000\000\000\000\000\000\020\206UC\"\177\000\000\217\v\213B\"\177\000\000\v*\213IVU\000\000\000\215`\307"...}, tid = 0}, DeadlySignal = {<__asan::ErrorBase> = {scariness = {score = 46, descr = "4-byte-write-heap-use-after-free\000\000\000\0002\000\000\000\000\000\000\000\000\260\340\306\377\177\000\0002\000\000\000\000\000\000\000 \202B@\"{\000\0001\000\000\000\000\000\000\000\210\212`\307\377\177\000\000 \202B@\"{\000\000\360\201`\307\377\177\000\000\037\353FC\"\177\000\000\001\000\000\000\000\000\000\000 \202B@\"{\000\000@\212`\307\377\177\000\000\322\205UC\"\177\000\000\000\000\000\000\000\000\000\000\305\fWC\036\000\000\000 \202`\307\377\177\000\000\003\000\000\000\000\000\000\000\020\206UC\"\177\000\000\217\v\213B\"\177\000\000\v*\213IVU\000\000\000\215`\307"...}, tid = 0}, signal = {siginfo = 0x7f2200000002, context = 0x7b6241600964, addr = 0, pc = 0, sp = 10458245367602, bp = 135661933824356, is_memory_access = 20, write_flag = __sanitizer::SignalContext::Unknown, is_true_faulting_addr = 80}}, DoubleFree = {<__asan::ErrorBase> = {scariness = {score = 46, descr = "4-byte-write-heap-use-after-free\000\000\000\0002\000\000\000\000\000\000\000\000\260\340\306\377\177\000\0002\000\000\000\000\000\000\000 \202B@\"{\000\0001\000\000\000\000\000\000\000\210\212`\307\377\177\000\000 \202B@\"{\000\000\360\201`\307\377\177\000\000\037\353FC\"\177\000\000\001\000\000\000\000\000\000\000 \202B@\"{\000\000@\212`\307\377\177\000\000\322\205UC\"\177\000\000\000\000\000\000\000\000\000\000\305\fWC\036\000\000\000 \202`\307\377\177\000\000\003\000\000\000\000\000\000\000\020\206UC\"\177\000\000\217\v\213B\"\177\000\000\v*\213IVU\000\000\000\215`\307"...}, tid = 0}, second_free_stack = 0x7f2200000002, addr_description = {addr = 135661933824356, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1842, free_stack_id = 2435, chunk_access = {bad_addr = 135661933824356, offset = 20, chunk_begin = 135661933824336, chunk_size = 40, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}}, NewDeleteTypeMismatch = {<__asan::ErrorBase> = {scariness = {score = 46, descr = "4-byte-write-heap-use-after-free\000\000\000\0002\000\000\000\000\000\000\000\000\260\340\306\377\177\000\0002\000\000\000\000\000\000\000 \202B@\"{\000\0001\000\000\000\000\000\000\000\210\212`\307\377\177\000\000 \202B@\"{\000\000\360\201`\307\377\177\000\000\037\353FC\"\177\000\000\001\000\000\000\000\000\000\000 \202B@\"{\000\000@\212`\307\377\177\000\000\322\205UC\"\177\000\000\000\000\000\000\000\000\000\000\305\fWC\036\000\000\000 \202`\307\377\177\000\000\003\000\000\000\000\000\000\000\020\206UC\"\177\000\000\217\v\213B\"\177\000\000\v*\213IVU\000\000\000\215`\307"...}, tid = 0}, free_stack = 0x7f2200000002, addr_description = {addr = 135661933824356, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1842, free_stack_id = 2435, chunk_access = {bad_addr = 135661933824356, offset = 20, chunk_begin = 135661933824336, chunk_size = 40, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, delete_size = 4585564030955459840, delete_alignment = 135524494906928}, FreeNotMalloced = {<__asan::ErrorBase> = {scariness = {score = 46, descr = "4-byte-write-heap-use-after-free\000\000\000\0002\000\000\000\000\000\000\000\000\260\340\306\377\177\000\0002\000\000\000\000\000\000\000 \202B@\"{\000\0001\000\000\000\000\000\000\000\210\212`\307\377\177\000\000 \202B@\"{\000\000\360\201`\307\377\177\000\000\037\353FC\"\177\000\000\001\000\000\000\000\000\000\000 \202B@\"{\000\000@\212`\307\377\177\000\000\322\205UC\"\177\000\000\000\000\000\000\000\000\000\000\305\fWC\036\000\000\000 \202`\307\377\177\000\000\003\000\000\000\000\000\000\000\020\206UC\"\177\000\000\217\v\213B\"\177\000\000\v*\213IVU\000\000\000\215`\307"...}, tid = 0}, free_stack = 0x7f2200000002, addr_description = {data = {kind = 1096812900, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 10458245367602, alloc_stack_id = 1096812900, free_stack_id = 31586, chunk_access = {bad_addr = 20, offset = 135661933824336, chunk_begin = 40, chunk_size = 55200024125448, user_requested_alignment = 1280, access_type = 1, alloc_type = 2}}, stack = {addr = 0, tid = 0, offset = 10458245367602, frame_pc = 135661933824356, access_size = 20, frame_descr = 0x7b6241600950 "\203\t"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 10458245367602, size_with_redzone = 135661933824356, name = 0x14 <error: Cannot access memory at address 0x14>, module_name = 0x7b6241600950 "\203\t", has_dynamic_init = 40, gcc_location = 0x323441d46008, odr_indicator = 4585564030955459840}, {beg = 135524494906928, size = 139785123366530, size_with_redzone = 140736538380311, name = 0xf <error: Cannot access memory at address 0xf>, module_name = 0x7fffc7608817 "", has_dynamic_init = 206158430224, gcc_location = 0x7fffc7608df0, odr_indicator = 140736538381568}, {beg = 139785123573216, size = 139785122397027, size_with_redzone = 139785110069456, name = 0x3fa33230d7e89500 <error: Cannot access memory at address 0x3fa33230d7e89500>, module_name = 0x7b5200000000 "", has_dynamic_init = 140736538380336, gcc_location = 0x81, odr_indicator = 135387037204896}, {beg = 140736538380336, size = 49, size_with_redzone = 140736538380096, name = 0x7f224287d43c <__GI___dprintf+156> "H\213\225H\377\377\377dH+\024%(", module_name = 0x3000000020 <error: Cannot access memory at address 0x3000000020>, has_dynamic_init = 140736538380112, gcc_location = 0x7fffc7608690, odr_indicator = 4585564030955459840}}, reg_sites = {3344993328, 32767, 0, 0}, access_size = 140736538380356, size = 227 '\343'}, wild = {addr = 0, access_size = 0}}}}}, AllocTypeMismatch = {<__asan::ErrorBase> = {scariness = {score = 46, descr = "4-byte-write-heap-use-after-free\000\000\000\0002\000\000\000\000\000\000\000\000\260\340\306\377\177\000\0002\000\000\000\000\000\000\000 \202B@\"{\000\0001\000\000\000\000\000\000\000\210\212`\307\377\177\000\000 \202B@\"{\000\000\360\201`\307\377\177\000\000\037\353FC\"\177\000\000\001\000\000\000\000\000\000\000 \202B@\"{\000\000@\212`\307\377\177\000\000\322\205UC\"\177\000\000\000\000\000\000\000\000\000\000\305\fWC\036\000\000\000 \202`\307\377\177\000\000\003\000\000\000\000\000\000\000\020\206UC\"\177\000\000\217\v\213B\"\177\000\000\v*\213IVU\000\000\000\215`\307"...}, tid = 0}, dealloc_stack = 0x7f2200000002, alloc_type = 1096812900, dealloc_type = 31586, addr_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 0, kind = (__asan::kShadowKindHigh | unknown: 0x30), shadow_byte = 7 '\a'}, heap = {addr = 0, alloc_tid = 10458245367602, free_tid = 135661933824356, alloc_stack_id = 20, free_stack_id = 0, chunk_access = {bad_addr = 135661933824336, offset = 40, chunk_begin = 55200024125448, chunk_size = 4585564030955459840, user_requested_alignment = 1584, access_type = 1, alloc_type = 2}}, stack = {addr = 0, tid = 10458245367602, offset = 135661933824356, frame_pc = 20, access_size = 135661933824336, frame_descr = 0x28 <error: Cannot access memory at address 0x28>}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 10458245367602, size = 135661933824356, size_with_redzone = 20, name = 0x7b6241600950 "\203\t", module_name = 0x28 <error: Cannot access memory at address 0x28>, has_dynamic_init = 55200024125448, gcc_location = 0x3fa33230d7e89500, odr_indicator = 135524494906928}, {beg = 139785123366530, size = 140736538380311, size_with_redzone = 15, name = 0x7fffc7608817 "", module_name = 0x3000000010 <error: Cannot access memory at address 0x3000000010>, has_dynamic_init = 140736538381808, gcc_location = 0x7fffc7608d00, odr_indicator = 139785123573216}, {beg = 139785122397027, size = 139785110069456, size_with_redzone = 4585564030955459840, name = 0x7b5200000000 "", module_name = 0x7fffc7608830 "f\rWC\"\177", has_dynamic_init = 129, gcc_location = 0x7b22404281a0, odr_indicator = 140736538380336}, {beg = 49, size = 140736538380096, size_with_redzone = 139785121813564, name = 0x3000000020 <error: Cannot access memory at address 0x3000000020>, module_name = 0x7fffc7608750 "\037\353FC\"\177", has_dynamic_init = 140736538379920, gcc_location = 0x3fa33230d7e89500, odr_indicator = 140736538381360}}, reg_sites = {0, 0, 3344992324, 32767}, access_size = 93829086466787, size = 224 '\340'}, wild = {addr = 0, access_size = 10458245367602}}}}}, MallocUsableSizeNotOwned = {<__asan::ErrorBase> = {scariness = {score = 46, descr = "4-byte-write-heap-use-after-free\000\000\000\0002\000\000\000\000\000\000\000\000\260\340\306\377\177\000\0002\000\000\000\000\000\000\000 \202B@\"{\000\0001\000\000\000\000\000\000\000\210\212`\307\377\177\000\000 \202B@\"{\000\000\360\201`\307\377\177\000\000\037\353FC\"\177\000\000\001\000\000\000\000\000\000\000 \202B@\"{\000\000@\212`\307\377\177\000\000\322\205UC\"\177\000\000\000\000\000\000\000\000\000\000\305\fWC\036\000\000\000 \202`\307\377\177\000\000\003\000\000\000\000\000\000\000\020\206UC\"\177\000\000\217\v\213B\"\177\000\000\v*\213IVU\000\000\000\215`\307"...}, tid = 0}, stack = 0x7f2200000002, addr_description = {data = {kind = 1096812900, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 10458245367602, alloc_stack_id = 1096812900, free_stack_id = 31586, chunk_access = {bad_addr = 20, offset = 135661933824336, chunk_begin = 40, chunk_size = 55200024125448, user_requested_alignment = 1280, access_type = 1, alloc_type = 2}}, stack = {addr = 0, tid = 0, offset = 10458245367602, frame_pc = 135661933824356, access_size = 20, frame_descr = 0x7b6241600950 "\203\t"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 10458245367602, size_with_redzone = 135661933824356, name = 0x14 <error: Cannot access memory at address 0x14>, module_name = 0x7b6241600950 "\203\t", has_dynamic_init = 40, gcc_location = 0x323441d46008, odr_indicator = 4585564030955459840}, {beg = 135524494906928, size = 139785123366530, size_with_redzone = 140736538380311, name = 0xf <error: Cannot access memory at address 0xf>, module_name = 0x7fffc7608817 "", has_dynamic_init = 206158430224, gcc_location = 0x7fffc7608df0, odr_indicator = 140736538381568}, {beg = 139785123573216, size = 139785122397027, size_with_redzone = 139785110069456, name = 0x3fa33230d7e89500 <error: Cannot access memory at address 0x3fa33230d7e89500>, module_name = 0x7b5200000000 "", has_dynamic_init = 140736538380336, gcc_location = 0x81, odr_indicator = 135387037204896}, {beg = 140736538380336, size = 49, size_with_redzone = 140736538380096, name = 0x7f224287d43c <__GI___dprintf+156> "H\213\225H\377\377\377dH+\024%(", module_name = 0x3000000020 <error: Cannot access memory at address 0x3000000020>, has_dynamic_init = 140736538380112, gcc_location = 0x7fffc7608690, odr_indicator = 4585564030955459840}}, reg_sites = {3344993328, 32767, 0, 0}, access_size = 140736538380356, size = 227 '\343'}, wild = {addr = 0, access_size = 0}}}}}, SanitizerGetAllocatedSizeNotOwned = {<__asan::ErrorBase> = {scariness = {score = 46, descr = "4-byte-write-heap-use-after-free\000\000\000\0002\000\000\000\000\000\000\000\000\260\340\306\377\177\000\0002\000\000\000\000\000\000\000 \202B@\"{\000\0001\000\000\000\000\000\000\000\210\212`\307\377\177\000\000 \202B@\"{\000\000\360\201`\307\377\177\000\000\037\353FC\"\177\000\000\001\000\000\000\000\000\000\000 \202B@\"{\000\000@\212`\307\377\177\000\000\322\205UC\"\177\000\000\000\000\000\000\000\000\000\000\305\fWC\036\000\000\000 \202`\307\377\177\000\000\003\000\000\000\000\000\000\000\020\206UC\"\177\000\000\217\v\213B\"\177\000\000\v*\213IVU\000\000\000\215`\307"...}, tid = 0}, stack = 0x7f2200000002, addr_description = {data = {kind = 1096812900, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 10458245367602, alloc_stack_id = 1096812900, free_stack_id = 31586, chunk_access = {bad_addr = 20, offset = 135661933824336, chunk_begin = 40, chunk_size = 55200024125448, user_requested_alignment = 1280, access_type = 1, alloc_type = 2}}, stack = {addr = 0, tid = 0, offset = 10458245367602, frame_pc = 135661933824356, access_size = 20, frame_descr = 0x7b6241600950 "\203\t"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 10458245367602, size_with_redzone = 135661933824356, name = 0x14 <error: Cannot access memory at address 0x14>, module_name = 0x7b6241600950 "\203\t", has_dynamic_init = 40, gcc_location = 0x323441d46008, odr_indicator = 4585564030955459840}, {beg = 135524494906928, size = 139785123366530, size_with_redzone = 140736538380311, name = 0xf <error: Cannot access memory at address 0xf>, module_name = 0x7fffc7608817 "", has_dynamic_init = 206158430224, gcc_location = 0x7fffc7608df0, odr_indicator = 140736538381568}, {beg = 139785123573216, size = 139785122397027, size_with_redzone = 139785110069456, name = 0x3fa33230d7e89500 <error: Cannot access memory at address 0x3fa33230d7e89500>, module_name = 0x7b5200000000 "", has_dynamic_init = 140736538380336, gcc_location = 0x81, odr_indicator = 135387037204896}, {beg = 140736538380336, size = 49, size_with_redzone = 140736538380096, name = 0x7f224287d43c <__GI___dprintf+156> "H\213\225H\377\377\377dH+\024%(", module_name = 0x3000000020 <error: Cannot access memory at address 0x3000000020>, has_dynamic_init = 140736538380112, gcc_location = 0x7fffc7608690, odr_indicator = 4585564030955459840}}, reg_sites = {3344993328, 32767, 0, 0}, access_size = 140736538380356, size = 227 '\343'}, wild = {addr = 0, access_size = 0}}}}}, CallocOverflow = {<__asan::ErrorBase> = {scariness = {score = 46, descr = "4-byte-write-heap-use-after-free\000\000\000\0002\000\000\000\000\000\000\000\000\260\340\306\377\177\000\0002\000\000\000\000\000\000\000 \202B@\"{\000\0001\000\000\000\000\000\000\000\210\212`\307\377\177\000\000 \202B@\"{\000\000\360\201`\307\377\177\000\000\037\353FC\"\177\000\000\001\000\000\000\000\000\000\000 \202B@\"{\000\000@\212`\307\377\177\000\000\322\205UC\"\177\000\000\000\000\000\000\000\000\000\000\305\fWC\036\000\000\000 \202`\307\377\177\000\000\003\000\000\000\000\000\000\000\020\206UC\"\177\000\000\217\v\213B\"\177\000\000\v*\213IVU\000\000\000\215`\307"...}, tid = 0}, stack = 0x7f2200000002, count = 135661933824356, size = 0}, ReallocArrayOverflow = {<__asan::ErrorBase> = {scariness = {score = 46, descr = "4-byte-write-heap-use-after-free\000\000\000\0002\000\000\000\000\000\000\000\000\260\340\306\377\177\000\0002\000\000\000\000\000\000\000 \202B@\"{\000\0001\000\000\000\000\000\000\000\210\212`\307\377\177\000\000 \202B@\"{\000\000\360\201`\307\377\177\000\000\037\353FC\"\177\000\000\001\000\000\000\000\000\000\000 \202B@\"{\000\000@\212`\307\377\177\000\000\322\205UC\"\177\000\000\000\000\000\000\000\000\000\000\305\fWC\036\000\000\000 \202`\307\377\177\000\000\003\000\000\000\000\000\000\000\020\206UC\"\177\000\000\217\v\213B\"\177\000\000\v*\213IVU\000\000\000\215`\307"...}, tid = 0}, stack = 0x7f2200000002, count = 135661933824356, size = 0}, PvallocOverflow = {<__asan::ErrorBase> = {scariness = {score = 46, descr = "4-byte-write-heap-use-after-free\000\000\000\0002\000\000\000\000\000\000\000\000\260\340\306\377\177\000\0002\000\000\000\000\000\000\000 \202B@\"{\000\0001\000\000\000\000\000\000\000\210\212`\307\377\177\000\000 \202B@\"{\000\000\360\201`\307\377\177\000\000\037\353FC\"\177\000\000\001\000\000\000\000\000\000\000 \202B@\"{\000\000@\212`\307\377\177\000\000\322\205UC\"\177\000\000\000\000\000\000\000\000\000\000\305\fWC\036\000\000\000 \202`\307\377\177\000\000\003\000\000\000\000\000\000\000\020\206UC\"\177\000\000\217\v\213B\"\177\000\000\v*\213IVU\000\000\000\215`\307"...}, tid = 0}, stack = 0x7f2200000002, size = 135661933824356}, InvalidAllocationAlignment = {<__asan::ErrorBase> = {scariness = {score = 46, descr = "4-byte-write-heap-use-after-free\000\000\000\0002\000\000\000\000\000\000\000\000\260\340\306\377\177\000\0002\000\000\000\000\000\000\000 \202B@\"{\000\0001\000\000\000\000\000\000\000\210\212`\307\377\177\000\000 \202B@\"{\000\000\360\201`\307\377\177\000\000\037\353FC\"\177\000\000\001\000\000\000\000\000\000\000 \202B@\"{\000\000@\212`\307\377\177\000\000\322\205UC\"\177\000\000\000\000\000\000\000\000\000\000\305\fWC\036\000\000\000 \202`\307\377\177\000\000\003\000\000\000\000\000\000\000\020\206UC\"\177\000\000\217\v\213B\"\177\000\000\v*\213IVU\000\000\000\215`\307"...}, tid = 0}, stack = 0x7f2200000002, alignment = 135661933824356}, InvalidAlignedAllocAlignment = {<__asan::ErrorBase> = {scariness = {score = 46, descr = "4-byte-write-heap-use-after-free\000\000\000\0002\000\000\000\000\000\000\000\000\260\340\306\377\177\000\0002\000\000\000\000\000\000\000 \202B@\"{\000\0001\000\000\000\000\000\000\000\210\212`\307\377\177\000\000 \202B@\"{\000\000\360\201`\307\377\177\000\000\037\353FC\"\177\000\000\001\000\000\000\000\000\000\000 \202B@\"{\000\000@\212`\307\377\177\000\000\322\205UC\"\177\000\000\000\000\000\000\000\000\000\000\305\fWC\036\000\000\000 \202`\307\377\177\000\000\003\000\000\000\000\000\000\000\020\206UC\"\177\000\000\217\v\213B\"\177\000\000\v*\213IVU\000\000\000\215`\307"...}, tid = 0}, stack = 0x7f2200000002, size = 135661933824356, alignment = 0}, InvalidPosixMemalignAlignment = {<__asan::ErrorBase> = {scariness = {score = 46, descr = "4-byte-write-heap-use-after-free\000\000\000\0002\000\000\000\000\000\000\000\000\260\340\306\377\177\000\0002\000\000\000\000\000\000\000 \202B@\"{\000\0001\000\000\000\000\000\000\000\210\212`\307\377\177\000\000 \202B@\"{\000\000\360\201`\307\377\177\000\000\037\353FC\"\177\000\000\001\000\000\000\000\000\000\000 \202B@\"{\000\000@\212`\307\377\177\000\000\322\205UC\"\177\000\000\000\000\000\000\000\000\000\000\305\fWC\036\000\000\000 \202`\307\377\177\000\000\003\000\000\000\000\000\000\000\020\206UC\"\177\000\000\217\v\213B\"\177\000\000\v*\213IVU\000\000\000\215`\307"...}, tid = 0}, stack = 0x7f2200000002, alignment = 135661933824356}, AllocationSizeTooBig = {<__asan::ErrorBase> = {scariness = {score = 46, descr = "4-byte-write-heap-use-after-free\000\000\000\0002\000\000\000\000\000\000\000\000\260\340\306\377\177\000\0002\000\000\000\000\000\000\000 \202B@\"{\000\0001\000\000\000\000\000\000\000\210\212`\307\377\177\000\000 \202B@\"{\000\000\360\201`\307\377\177\000\000\037\353FC\"\177\000\000\001\000\000\000\000\000\000\000 \202B@\"{\000\000@\212`\307\377\177\000\000\322\205UC\"\177\000\000\000\000\000\000\000\000\000\000\305\fWC\036\000\000\000 \202`\307\377\177\000\000\003\000\000\000\000\000\000\000\020\206UC\"\177\000\000\217\v\213B\"\177\000\000\v*\213IVU\000\000\000\215`\307"...}, tid = 0}, stack = 0x7f2200000002, user_size = 135661933824356, total_size = 0, max_size = 0}, RssLimitExceeded = {<__asan::ErrorBase> = {scariness = {score = 46, descr = "4-byte-write-heap-use-after-free\000\000\000\0002\000\000\000\000\000\000\000\000\260\340\306\377\177\000\0002\000\000\000\000\000\000\000 \202B@\"{\000\0001\000\000\000\000\000\000\000\210\212`\307\377\177\000\000 \202B@\"{\000\000\360\201`\307\377\177\000\000\037\353FC\"\177\000\000\001\000\000\000\000\000\000\000 \202B@\"{\000\000@\212`\307\377\177\000\000\322\205UC\"\177\000\000\000\000\000\000\000\000\000\000\305\fWC\036\000\000\000 \202`\307\377\177\000\000\003\000\000\000\000\000\000\000\020\206UC\"\177\000\000\217\v\213B\"\177\000\000\v*\213IVU\000\000\000\215`\307"...}, tid = 0}, stack = 0x7f2200000002}, OutOfMemory = {<__asan::ErrorBase> = {scariness = {score = 46, descr = "4-byte-write-heap-use-after-free\000\000\000\0002\000\000\000\000\000\000\000\000\260\340\306\377\177\000\0002\000\000\000\000\000\000\000 \202B@\"{\000\0001\000\000\000\000\000\000\000\210\212`\307\377\177\000\000 \202B@\"{\000\000\360\201`\307\377\177\000\000\037\353FC\"\177\000\000\001\000\000\000\000\000\000\000 \202B@\"{\000\000@\212`\307\377\177\000\000\322\205UC\"\177\000\000\000\000\000\000\000\000\000\000\305\fWC\036\000\000\000 \202`\307\377\177\000\000\003\000\000\000\000\000\000\000\020\206UC\"\177\000\000\217\v\213B\"\177\000\000\v*\213IVU\000\000\000\215`\307"...}, tid = 0}, stack = 0x7f2200000002, requested_size = 135661933824356}, StringFunctionMemoryRangesOverlap = {<__asan::ErrorBase> = {scariness = {score = 46, descr = "4-byte-write-heap-use-after-free\000\000\000\0002\000\000\000\000\000\000\000\000\260\340\306\377\177\000\0002\000\000\000\000\000\000\000 \202B@\"{\000\0001\000\000\000\000\000\000\000\210\212`\307\377\177\000\000 \202B@\"{\000\000\360\201`\307\377\177\000\000\037\353FC\"\177\000\000\001\000\000\000\000\000\000\000 \202B@\"{\000\000@\212`\307\377\177\000\000\322\205UC\"\177\000\000\000\000\000\000\000\000\000\000\305\fWC\036\000\000\000 \202`\307\377\177\000\000\003\000\000\000\000\000\000\000\020\206UC\"\177\000\000\217\v\213B\"\177\000\000\v*\213IVU\000\000\000\215`\307"...}, tid = 0}, stack = 0x7f2200000002, length1 = 135661933824356, length2 = 0, addr1_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 10458245367602, kind = (unknown: 0x64), shadow_byte = 9 '\t'}, heap = {addr = 10458245367602, alloc_tid = 135661933824356, free_tid = 20, alloc_stack_id = 1096812880, free_stack_id = 31586, chunk_access = {bad_addr = 40, offset = 55200024125448, chunk_begin = 4585564030955459840, chunk_size = 135524494906928, user_requested_alignment = 1666, access_type = 0, alloc_type = 2}}, stack = {addr = 10458245367602, tid = 135661933824356, offset = 20, frame_pc = 135661933824336, access_size = 40, frame_descr = 0x323441d46008 <error: Cannot access memory at address 0x323441d46008>}, global = {addr = 10458245367602, static kMaxGlobals = 4, globals = {{beg = 135661933824356, size = 20, size_with_redzone = 135661933824336, name = 0x28 <error: Cannot access memory at address 0x28>, module_name = 0x323441d46008 <error: Cannot access memory at address 0x323441d46008>, has_dynamic_init = 4585564030955459840, gcc_location = 0x7b4241609630, odr_indicator = 139785123366530}, {beg = 140736538380311, size = 15, size_with_redzone = 140736538380311, name = 0x3000000010 <error: Cannot access memory at address 0x3000000010>, module_name = 0x7fffc7608df0 "P\t`Ab{", has_dynamic_init = 140736538381568, gcc_location = 0x7f2242a2ade0 <_nl_C_locobj>, odr_indicator = 139785122397027}, {beg = 139785110069456, size = 4585564030955459840, size_with_redzone = 135592117534720, name = 0x7fffc7608830 "f\rWC\"\177", module_name = 0x81 <error: Cannot access memory at address 0x81>, has_dynamic_init = 135387037204896, gcc_location = 0x7fffc7608830, odr_indicator = 49}, {beg = 140736538380096, size = 139785121813564, size_with_redzone = 206158430240, name = 0x7fffc7608750 "\037\353FC\"\177", module_name = 0x7fffc7608690 "0\214`\307\377\177", has_dynamic_init = 4585564030955459840, gcc_location = 0x7fffc7608c30, odr_indicator = 0}}, reg_sites = {3344992324, 32767, 1230918371, 21846}, access_size = 140736538381792, size = 208 '\320'}, wild = {addr = 10458245367602, access_size = 135661933824356}}}}, addr2_description = {data = {kind = __asan::kAddressKindGlobal, {shadow = {addr = 139785135720343, kind = __asan::kShadowKindGap, shadow_byte = 253 '\375'}, heap = {addr = 139785135720343, alloc_tid = 56293186403585, free_tid = 16923379650608, alloc_stack_id = 65535, free_stack_id = 0, chunk_access = {bad_addr = 93829090601088, offset = 140736538381440, chunk_begin = 135593214252992, chunk_size = 93829087236022, user_requested_alignment = 1600, access_type = 3, alloc_type = 3}}, stack = {addr = 139785135720343, tid = 56293186403585, offset = 16923379650608, frame_pc = 65535, access_size = 93829090601088, frame_descr = 0x7fffc7608c80 "@\366.@\"{"}, global = {addr = 139785135720343, static kMaxGlobals = 4, globals = {{beg = 56293186403585, size = 16923379650608, size_with_redzone = 65535, name = 0x5556499d6880 "%s:%s() ", module_name = 0x7fffc7608c80 "@\366.@\"{", has_dynamic_init = 135593214252992, gcc_location = 0x5556496a0fb6 <btd_debug+358>, odr_indicator = 135387035924032}, {beg = 93829090719264, size = 30064836607, size_with_redzone = 93829090713888, name = 0x7b22404280a0 "0", module_name = 0x7b22402ecd60 "pN^A\222{", has_dynamic_init = 140736538381520, gcc_location = 0x7f2243596f7d <__sanitizer::DTLS_on_tls_get_addr(void*, void*, unsigned long, unsigned long)+125>, odr_indicator = 96}, {beg = 4585564030955459840, size = 140736538381568, size_with_redzone = 4585564030955459840, name = 0xf6448084ff0 <error: Cannot access memory at address 0xf6448084ff0>, module_name = 0x7f2243600f78 "\001", has_dynamic_init = 65535, gcc_location = 0x3fa33230d7e89500, odr_indicator = 139785113979064}, {beg = 135387035913568, size = 93829090601024, size_with_redzone = 93829090610016, name = 0x7b6241600950 "\203\t", module_name = 0xa9964 <error: Cannot access memory at address 0xa9964>, has_dynamic_init = 140736538381664, gcc_location = 0x7b2240428080, odr_indicator = 16923379650576}}, reg_sites = {65535, 0, 1235165472, 21846}, access_size = 140736538381680, size = 96 '`'}, wild = {addr = 139785135720343, access_size = 56293186403585}}}}, function = 0x5556496a0fb6 <btd_debug+358> "I9\336uMH\307\205"}, StringFunctionSizeOverflow = {<__asan::ErrorBase> = {scariness = {score = 46, descr = "4-byte-write-heap-use-after-free\000\000\000\0002\000\000\000\000\000\000\000\000\260\340\306\377\177\000\0002\000\000\000\000\000\000\000 \202B@\"{\000\0001\000\000\000\000\000\000\000\210\212`\307\377\177\000\000 \202B@\"{\000\000\360\201`\307\377\177\000\000\037\353FC\"\177\000\000\001\000\000\000\000\000\000\000 \202B@\"{\000\000@\212`\307\377\177\000\000\322\205UC\"\177\000\000\000\000\000\000\000\000\000\000\305\fWC\036\000\000\000 \202`\307\377\177\000\000\003\000\000\000\000\000\000\000\020\206UC\"\177\000\000\217\v\213B\"\177\000\000\v*\213IVU\000\000\000\215`\307"...}, tid = 0}, stack = 0x7f2200000002, addr_description = {data = {kind = 1096812900, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 10458245367602, alloc_stack_id = 1096812900, free_stack_id = 31586, chunk_access = {bad_addr = 20, offset = 135661933824336, chunk_begin = 40, chunk_size = 55200024125448, user_requested_alignment = 1280, access_type = 1, alloc_type = 2}}, stack = {addr = 0, tid = 0, offset = 10458245367602, frame_pc = 135661933824356, access_size = 20, frame_descr = 0x7b6241600950 "\203\t"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 10458245367602, size_with_redzone = 135661933824356, name = 0x14 <error: Cannot access memory at address 0x14>, module_name = 0x7b6241600950 "\203\t", has_dynamic_init = 40, gcc_location = 0x323441d46008, odr_indicator = 4585564030955459840}, {beg = 135524494906928, size = 139785123366530, size_with_redzone = 140736538380311, name = 0xf <error: Cannot access memory at address 0xf>, module_name = 0x7fffc7608817 "", has_dynamic_init = 206158430224, gcc_location = 0x7fffc7608df0, odr_indicator = 140736538381568}, {beg = 139785123573216, size = 139785122397027, size_with_redzone = 139785110069456, name = 0x3fa33230d7e89500 <error: Cannot access memory at address 0x3fa33230d7e89500>, module_name = 0x7b5200000000 "", has_dynamic_init = 140736538380336, gcc_location = 0x81, odr_indicator = 135387037204896}, {beg = 140736538380336, size = 49, size_with_redzone = 140736538380096, name = 0x7f224287d43c <__GI___dprintf+156> "H\213\225H\377\377\377dH+\024%(", module_name = 0x3000000020 <error: Cannot access memory at address 0x3000000020>, has_dynamic_init = 140736538380112, gcc_location = 0x7fffc7608690, odr_indicator = 4585564030955459840}}, reg_sites = {3344993328, 32767, 0, 0}, access_size = 140736538380356, size = 227 '\343'}, wild = {addr = 0, access_size = 0}}}}, size = 140736538381792}, BadParamsToAnnotateContiguousContainer = {<__asan::ErrorBase> = {scariness = {score = 46, descr = "4-byte-write-heap-use-after-free\000\000\000\0002\000\000\000\000\000\000\000\000\260\340\306\377\177\000\0002\000\000\000\000\000\000\000 \202B@\"{\000\0001\000\000\000\000\000\000\000\210\212`\307\377\177\000\000 \202B@\"{\000\000\360\201`\307\377\177\000\000\037\353FC\"\177\000\000\001\000\000\000\000\000\000\000 \202B@\"{\000\000@\212`\307\377\177\000\000\322\205UC\"\177\000\000\000\000\000\000\000\000\000\000\305\fWC\036\000\000\000 \202`\307\377\177\000\000\003\000\000\000\000\000\000\000\020\206UC\"\177\000\000\217\v\213B\"\177\000\000\v*\213IVU\000\000\000\215`\307"...}, tid = 0}, stack = 0x7f2200000002, beg = 135661933824356, end = 0, old_mid = 0, new_mid = 10458245367602}, BadParamsToAnnotateDoubleEndedContiguousContainer = {<__asan::ErrorBase> = {scariness = {score = 46, descr = "4-byte-write-heap-use-after-free\000\000\000\0002\000\000\000\000\000\000\000\000\260\340\306\377\177\000\0002\000\000\000\000\000\000\000 \202B@\"{\000\0001\000\000\000\000\000\000\000\210\212`\307\377\177\000\000 \202B@\"{\000\000\360\201`\307\377\177\000\000\037\353FC\"\177\000\000\001\000\000\000\000\000\000\000 \202B@\"{\000\000@\212`\307\377\177\000\000\322\205UC\"\177\000\000\000\000\000\000\000\000\000\000\305\fWC\036\000\000\000 \202`\307\377\177\000\000\003\000\000\000\000\000\000\000\020\206UC\"\177\000\000\217\v\213B\"\177\000\000\v*\213IVU\000\000\000\215`\307"...}, tid = 0}, stack = 0x7f2200000002, storage_beg = 135661933824356, storage_end = 0, old_container_beg = 0, old_container_end = 10458245367602, new_container_beg = 135661933824356, new_container_end = 20}, BadParamsToCopyContiguousContainerAnnotations = {<__asan::ErrorBase> = {scariness = {score = 46, descr = "4-byte-write-heap-use-after-free\000\000\000\0002\000\000\000\000\000\000\000\000\260\340\306\377\177\000\0002\000\000\000\000\000\000\000 \202B@\"{\000\0001\000\000\000\000\000\000\000\210\212`\307\377\177\000\000 \202B@\"{\000\000\360\201`\307\377\177\000\000\037\353FC\"\177\000\000\001\000\000\000\000\000\000\000 \202B@\"{\000\000@\212`\307\377\177\000\000\322\205UC\"\177\000\000\000\000\000\000\000\000\000\000\305\fWC\036\000\000\000 \202`\307\377\177\000\000\003\000\000\000\000\000\000\000\020\206UC\"\177\000\000\217\v\213B\"\177\000\000\v*\213IVU\000\000\000\215`\307"...}, tid = 0}, stack = 0x7f2200000002, old_storage_beg = 135661933824356, old_storage_end = 0, new_storage_beg = 0, new_storage_end = 10458245367602}, ODRViolation = {<__asan::ErrorBase> = {scariness = {score = 46, descr = "4-byte-write-heap-use-after-free\000\000\000\0002\000\000\000\000\000\000\000\000\260\340\306\377\177\000\0002\000\000\000\000\000\000\000 \202B@\"{\000\0001\000\000\000\000\000\000\000\210\212`\307\377\177\000\000 \202B@\"{\000\000\360\201`\307\377\177\000\000\037\353FC\"\177\000\000\001\000\000\000\000\000\000\000 \202B@\"{\000\000@\212`\307\377\177\000\000\322\205UC\"\177\000\000\000\000\000\000\000\000\000\000\305\fWC\036\000\000\000 \202`\307\377\177\000\000\003\000\000\000\000\000\000\000\020\206UC\"\177\000\000\217\v\213B\"\177\000\000\v*\213IVU\000\000\000\215`\307"...}, tid = 0}, global1 = {beg = 139784005615618, size = 135661933824356, size_with_redzone = 0, name = 0x0, module_name = 0x98300000732 <error: Cannot access memory at address 0x98300000732>, has_dynamic_init = 135661933824356, gcc_location = 0x14, odr_indicator = 135661933824336}, global2 = {beg = 40, size = 55200024125448, size_with_redzone = 4585564030955459840, name = 0x7b4241609630 "K\004", module_name = 0x7f22429f8682 "T ", has_dynamic_init = 140736538380311, gcc_location = 0xf, odr_indicator = 140736538380311}, stack_id1 = 16, stack_id2 = 48}, InvalidPointerPair = {<__asan::ErrorBase> = {scariness = {score = 46, descr = "4-byte-write-heap-use-after-free\000\000\000\0002\000\000\000\000\000\000\000\000\260\340\306\377\177\000\0002\000\000\000\000\000\000\000 \202B@\"{\000\0001\000\000\000\000\000\000\000\210\212`\307\377\177\000\000 \202B@\"{\000\000\360\201`\307\377\177\000\000\037\353FC\"\177\000\000\001\000\000\000\000\000\000\000 \202B@\"{\000\000@\212`\307\377\177\000\000\322\205UC\"\177\000\000\000\000\000\000\000\000\000\000\305\fWC\036\000\000\000 \202`\307\377\177\000\000\003\000\000\000\000\000\000\000\020\206UC\"\177\000\000\217\v\213B\"\177\000\000\v*\213IVU\000\000\000\215`\307"...}, tid = 0}, pc = 139784005615618, bp = 135661933824356, sp = 0, addr1_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 10458245367602, kind = (unknown: 0x64), shadow_byte = 9 '\t'}, heap = {addr = 10458245367602, alloc_tid = 135661933824356, free_tid = 20, alloc_stack_id = 1096812880, free_stack_id = 31586, chunk_access = {bad_addr = 40, offset = 55200024125448, chunk_begin = 4585564030955459840, chunk_size = 135524494906928, user_requested_alignment = 1666, access_type = 0, alloc_type = 2}}, stack = {addr = 10458245367602, tid = 135661933824356, offset = 20, frame_pc = 135661933824336, access_size = 40, frame_descr = 0x323441d46008 <error: Cannot access memory at address 0x323441d46008>}, global = {addr = 10458245367602, static kMaxGlobals = 4, globals = {{beg = 135661933824356, size = 20, size_with_redzone = 135661933824336, name = 0x28 <error: Cannot access memory at address 0x28>, module_name = 0x323441d46008 <error: Cannot access memory at address 0x323441d46008>, has_dynamic_init = 4585564030955459840, gcc_location = 0x7b4241609630, odr_indicator = 139785123366530}, {beg = 140736538380311, size = 15, size_with_redzone = 140736538380311, name = 0x3000000010 <error: Cannot access memory at address 0x3000000010>, module_name = 0x7fffc7608df0 "P\t`Ab{", has_dynamic_init = 140736538381568, gcc_location = 0x7f2242a2ade0 <_nl_C_locobj>, odr_indicator = 139785122397027}, {beg = 139785110069456, size = 4585564030955459840, size_with_redzone = 135592117534720, name = 0x7fffc7608830 "f\rWC\"\177", module_name = 0x81 <error: Cannot access memory at address 0x81>, has_dynamic_init = 135387037204896, gcc_location = 0x7fffc7608830, odr_indicator = 49}, {beg = 140736538380096, size = 139785121813564, size_with_redzone = 206158430240, name = 0x7fffc7608750 "\037\353FC\"\177", module_name = 0x7fffc7608690 "0\214`\307\377\177", has_dynamic_init = 4585564030955459840, gcc_location = 0x7fffc7608c30, odr_indicator = 0}}, reg_sites = {3344992324, 32767, 1230918371, 21846}, access_size = 140736538381792, size = 208 '\320'}, wild = {addr = 10458245367602, access_size = 135661933824356}}}}, addr2_description = {data = {kind = __asan::kAddressKindGlobal, {shadow = {addr = 139785135720343, kind = __asan::kShadowKindGap, shadow_byte = 253 '\375'}, heap = {addr = 139785135720343, alloc_tid = 56293186403585, free_tid = 16923379650608, alloc_stack_id = 65535, free_stack_id = 0, chunk_access = {bad_addr = 93829090601088, offset = 140736538381440, chunk_begin = 135593214252992, chunk_size = 93829087236022, user_requested_alignment = 1600, access_type = 3, alloc_type = 3}}, stack = {addr = 139785135720343, tid = 56293186403585, offset = 16923379650608, frame_pc = 65535, access_size = 93829090601088, frame_descr = 0x7fffc7608c80 "@\366.@\"{"}, global = {addr = 139785135720343, static kMaxGlobals = 4, globals = {{beg = 56293186403585, size = 16923379650608, size_with_redzone = 65535, name = 0x5556499d6880 "%s:%s() ", module_name = 0x7fffc7608c80 "@\366.@\"{", has_dynamic_init = 135593214252992, gcc_location = 0x5556496a0fb6 <btd_debug+358>, odr_indicator = 135387035924032}, {beg = 93829090719264, size = 30064836607, size_with_redzone = 93829090713888, name = 0x7b22404280a0 "0", module_name = 0x7b22402ecd60 "pN^A\222{", has_dynamic_init = 140736538381520, gcc_location = 0x7f2243596f7d <__sanitizer::DTLS_on_tls_get_addr(void*, void*, unsigned long, unsigned long)+125>, odr_indicator = 96}, {beg = 4585564030955459840, size = 140736538381568, size_with_redzone = 4585564030955459840, name = 0xf6448084ff0 <error: Cannot access memory at address 0xf6448084ff0>, module_name = 0x7f2243600f78 "\001", has_dynamic_init = 65535, gcc_location = 0x3fa33230d7e89500, odr_indicator = 139785113979064}, {beg = 135387035913568, size = 93829090601024, size_with_redzone = 93829090610016, name = 0x7b6241600950 "\203\t", module_name = 0xa9964 <error: Cannot access memory at address 0xa9964>, has_dynamic_init = 140736538381664, gcc_location = 0x7b2240428080, odr_indicator = 16923379650576}}, reg_sites = {65535, 0, 1235165472, 21846}, access_size = 140736538381680, size = 96 '`'}, wild = {addr = 139785135720343, access_size = 56293186403585}}}}}, Generic = {<__asan::ErrorBase> = {scariness = {score = 46, descr = "4-byte-write-heap-use-after-free\000\000\000\0002\000\000\000\000\000\000\000\000\260\340\306\377\177\000\0002\000\000\000\000\000\000\000 \202B@\"{\000\0001\000\000\000\000\000\000\000\210\212`\307\377\177\000\000 \202B@\"{\000\000\360\201`\307\377\177\000\000\037\353FC\"\177\000\000\001\000\000\000\000\000\000\000 \202B@\"{\000\000@\212`\307\377\177\000\000\322\205UC\"\177\000\000\000\000\000\000\000\000\000\000\305\fWC\036\000\000\000 \202`\307\377\177\000\000\003\000\000\000\000\000\000\000\020\206UC\"\177\000\000\217\v\213B\"\177\000\000\v*\213IVU\000\000\000\215`\307"...}, tid = 0}, addr_description = {data = {kind = __asan::kAddressKindHeap, {shadow = {addr = 135661933824356, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 135661933824356, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1842, free_stack_id = 2435, chunk_access = {bad_addr = 135661933824356, offset = 20, chunk_begin = 135661933824336, chunk_size = 40, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, stack = {addr = 135661933824356, tid = 0, offset = 0, frame_pc = 10458245367602, access_size = 135661933824356, frame_descr = 0x14 <error: Cannot access memory at address 0x14>}, global = {addr = 135661933824356, static kMaxGlobals = 4, globals = {{beg = 0, size = 0, size_with_redzone = 10458245367602, name = 0x7b6241600964 "", module_name = 0x14 <error: Cannot access memory at address 0x14>, has_dynamic_init = 135661933824336, gcc_location = 0x28, odr_indicator = 55200024125448}, {beg = 4585564030955459840, size = 135524494906928, size_with_redzone = 139785123366530, name = 0x7fffc7608817 "", module_name = 0xf <error: Cannot access memory at address 0xf>, has_dynamic_init = 140736538380311, gcc_location = 0x3000000010, odr_indicator = 140736538381808}, {beg = 140736538381568, size = 139785123573216, size_with_redzone = 139785122397027, name = 0x7f2241d4a0d0 "", module_name = 0x3fa33230d7e89500 <error: Cannot access memory at address 0x3fa33230d7e89500>, has_dynamic_init = 135592117534720, gcc_location = 0x7fffc7608830, odr_indicator = 129}, {beg = 135387037204896, size = 140736538380336, size_with_redzone = 49, name = 0x7fffc7608740 " \202B@\"{", module_name = 0x7f224287d43c <__GI___dprintf+156> "H\213\225H\377\377\377dH+\024%(", has_dynamic_init = 206158430240, gcc_location = 0x7fffc7608750, odr_indicator = 140736538379920}}, reg_sites = {3622343936, 1067659824, 3344993328, 32767}, access_size = 0, size = 68 'D'}, wild = {addr = 135661933824356, access_size = 0}}}}, pc = 93829086466787, bp = 140736538381792, sp = 140736538381776, access_size = 4, bug_descr = 0x7f22435c0797 "heap-use-after-free", is_write = true, shadow_val = 253 '\375'}}}, halt_on_error_ = true}
                error = {<__asan::ErrorBase> = {scariness = {score = 46, descr = "4-byte-write-heap-use-after-free\000\000\000\0002\000\000\000\000\000\000\000\000\260\340\306\377\177\000\0002\000\000\000\000\000\000\000 \202B@\"{\000\0001\000\000\000\000\000\000\000\210\212`\307\377\177\000\000 \202B@\"{\000\000\360\201`\307\377\177\000\000\037\353FC\"\177\000\000\001\000\000\000\000\000\000\000 \202B@\"{\000\000@\212`\307\377\177\000\000\322\205UC\"\177\000\000\000\000\000\000\000\000\000\000\305\fWC\036\000\000\000 \202`\307\377\177\000\000\003\000\000\000\000\000\000\000\020\206UC\"\177\000\000\217\v\213B\"\177\000\000\v*\213IVU\000\000\000\215`\307"...}, tid = 0}, addr_description = {data = {kind = __asan::kAddressKindHeap, {shadow = {addr = 135661933824356, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 135661933824356, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1842, free_stack_id = 2435, chunk_access = {bad_addr = 135661933824356, offset = 20, chunk_begin = 135661933824336, chunk_size = 40, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, stack = {addr = 135661933824356, tid = 0, offset = 0, frame_pc = 10458245367602, access_size = 135661933824356, frame_descr = 0x14 <error: Cannot access memory at address 0x14>}, global = {addr = 135661933824356, static kMaxGlobals = 4, globals = {{beg = 0, size = 0, size_with_redzone = 10458245367602, name = 0x7b6241600964 "", module_name = 0x14 <error: Cannot access memory at address 0x14>, has_dynamic_init = 135661933824336, gcc_location = 0x28, odr_indicator = 55200024125448}, {beg = 4585564030955459840, size = 135524494906928, size_with_redzone = 139785123366530, name = 0x7fffc7608817 "", module_name = 0xf <error: Cannot access memory at address 0xf>, has_dynamic_init = 140736538380311, gcc_location = 0x3000000010, odr_indicator = 140736538381808}, {beg = 140736538381568, size = 139785123573216, size_with_redzone = 139785122397027, name = 0x7f2241d4a0d0 "", module_name = 0x3fa33230d7e89500 <error: Cannot access memory at address 0x3fa33230d7e89500>, has_dynamic_init = 135592117534720, gcc_location = 0x7fffc7608830, odr_indicator = 129}, {beg = 135387037204896, size = 140736538380336, size_with_redzone = 49, name = 0x7fffc7608740 " \202B@\"{", module_name = 0x7f224287d43c <__GI___dprintf+156> "H\213\225H\377\377\377dH+\024%(", has_dynamic_init = 206158430240, gcc_location = 0x7fffc7608750, odr_indicator = 140736538379920}}, reg_sites = {3622343936, 1067659824, 3344993328, 32767}, access_size = 0, size = 68 'D'}, wild = {addr = 135661933824356, access_size = 0}}}}, pc = 93829086466787, bp = 140736538381792, sp = 140736538381776, access_size = 4, bug_descr = 0x7f22435c0797 "heap-use-after-free", is_write = true, shadow_val = 253 '\375'}
        #9  0x00007f2243564f8d in __asan::ReportGenericError (pc=<optimized out>, bp=bp@entry=140736538381792, sp=sp@entry=140736538381776, addr=<optimized out>, is_write=is_write@entry=true, access_size=access_size@entry=4, exp=<optimized out>, fatal=true) at ../../../../src/libsanitizer/asan/asan_report.cpp:536
                in_report = <optimized out>
                error = <optimized out>
                enable_fp = <optimized out>
        #10 0x00007f224356685c in __asan::__asan_report_store4 (addr=<optimized out>) at ../../../../src/libsanitizer/asan/asan_rtl.cpp:135
                bp = 140736538381792
                pc = <optimized out>
                local_stack = 135524494906960
                sp = 140736538381776
        #11 0x00005556495e52e3 in report_notify_destroy (user_data=<optimized out>) at profiles/input/hog-lib.c:359
                report = <optimized out>
                __func__ = "report_notify_destroy"
        #12 0x0000555649687f52 in attrib_callbacks_destroy (data=0x7b82415f2680) at attrib/gattrib.c:126
                cb = 0x7b82415f2680
        #13 0x0000555649876d6b in notify_data_unref (data=<optimized out>) at src/shared/gatt-client.c:256
                notify_data = <optimized out>
        #14 notify_data_unref (data=<optimized out>) at src/shared/gatt-client.c:248
                notify_data = <optimized out>
        #15 0x0000555649821382 in queue_remove_all (queue=queue@entry=0x7b52415e97c0, function=function@entry=0x0, user_data=user_data@entry=0x0, destroy=0x555649876e70 <notify_data_cleanup>) at src/shared/queue.c:341
                tmp = 0x7b4241609650
                entry = 0x0
                count = <optimized out>
        #16 0x0000555649821679 in queue_destroy (queue=0x7b52415e97c0, destroy=<optimized out>) at src/shared/queue.c:60
        No locals.
        #17 0x000055564987d8ba in bt_gatt_client_free (client=0x7c32415e1080) at src/shared/gatt-client.c:2293
        No locals.
        #18 0x000055564987f56c in bt_gatt_client_unref (client=<optimized out>) at src/shared/gatt-client.c:2605
        No locals.
        #19 0x00005556496894ed in g_attrib_unref (attrib=0x7b92415e50a0) at attrib/gattrib.c:154
                __func__ = "g_attrib_unref"
        #20 0x000055564978cd7e in attio_cleanup (device=<optimized out>) at src/device.c:874
                attrib = <optimized out>
        #21 0x000055564978d2c7 in device_free (user_data=0x7c92415e0080) at src/device.c:918
                device = 0x7c92415e0080
                __func__ = "device_free"
        #22 0x000055564980aeda in remove_interface (data=0x7b92415e4e70, name=name@entry=0x555649a17ae0 "org.bluez.Device1") at gdbus/object.c:742
                iface = 0x7b82415e5ae0
        #23 0x000055564980da9c in g_dbus_unregister_interface (connection=<optimized out>, path=<optimized out>, name=<optimized out>) at gdbus/object.c:1499
                data = <optimized out>
        #24 0x0000555649748598 in adapter_remove (adapter=adapter@entry=0x7c52415e0200) at src/adapter.c:7321
                device = 0x7c92415e0080
                db = <optimized out>
                ranging_manager = <optimized out>
                __func__ = "adapter_remove"
        #25 0x00005556497490d8 in adapter_cleanup () at src/adapter.c:11274
                adapter = 0x7c52415e0200
        #26 0x00005556494fa330 in main (argc=<optimized out>, argv=<optimized out>) at src/main.c:1723
                context = <optimized out>
                err = <optimized out>
                sdp_mtu = 0
                sdp_flags = <optimized out>
                gdbus_flags = <optimized out>
                __func__ = "main""


https://github.com/bluez/bluez/pull/2574

---
Regards,
Linux Bluetooth


^ permalink raw reply	[flat|nested] 9+ messages in thread

* [PATCH BlueZ v1 2/7] client/mgmt: Print Connection Subrate event
  2026-09-23 19:31 [PATCH BlueZ v1 0/7] Add HID over GATT functional tests Luiz Augusto von Dentz
  2026-09-23 19:31 ` [PATCH BlueZ v1 1/7] client/gatt: Fix setting descriptor value from scripts Luiz Augusto von Dentz
@ 2026-09-23 19:31 ` Luiz Augusto von Dentz
  2026-09-23 19:31 ` [PATCH BlueZ v1 3/7] emulator: Default to the latest BR/EDR+LE version Luiz Augusto von Dentz
                   ` (4 subsequent siblings)
  6 siblings, 0 replies; 9+ messages in thread
From: Luiz Augusto von Dentz @ 2026-09-23 19:31 UTC (permalink / raw)
  To: linux-bluetooth

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

Print the MGMT Connection Subrate event, generated as a result of a
LE Connection Rate Request, e.g. after mgmt.conn-subrate, or a change
initiated by the remote device, so the new connection rate can be
confirmed.
---
 client/mgmt.c | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/client/mgmt.c b/client/mgmt.c
index cd2ef80221ad..a7069e5bbb37 100644
--- a/client/mgmt.c
+++ b/client/mgmt.c
@@ -499,6 +499,35 @@ static void disconnected(uint16_t index, uint16_t len, const void *param,
 			index, addr, typestr(ev->addr.type), reason);
 }
 
+static void conn_subrate(uint16_t index, uint16_t len, const void *param,
+							void *user_data)
+{
+	const struct mgmt_ev_conn_subrate *ev = param;
+	char addr[18];
+
+	if (len < sizeof(*ev)) {
+		error("Invalid connection subrate event length (%u bytes)",
+									len);
+		return;
+	}
+
+	ba2str(&ev->addr.bdaddr, addr);
+
+	if (ev->status) {
+		print("hci%u %s type %s connection subrate failed status "
+			"0x%02x (%s)", index, addr, typestr(ev->addr.type),
+			ev->status, mgmt_errstr(ev->status));
+		return;
+	}
+
+	print("hci%u %s type %s connection subrate interval 0x%04x "
+		"subrate 0x%04x latency 0x%04x cont_num 0x%04x timeout 0x%04x",
+		index, addr, typestr(ev->addr.type),
+		le16_to_cpu(ev->interval), le16_to_cpu(ev->subrate),
+		le16_to_cpu(ev->latency), le16_to_cpu(ev->cont_num),
+		le16_to_cpu(ev->supv_timeout));
+}
+
 static void conn_failed(uint16_t index, uint16_t len, const void *param,
 							void *user_data)
 {
@@ -6006,6 +6035,8 @@ static void register_mgmt_callbacks(struct mgmt *mgmt, uint16_t index)
 								NULL, NULL);
 	mgmt_register(mgmt, MGMT_EV_CONNECT_FAILED, index, conn_failed,
 								NULL, NULL);
+	mgmt_register(mgmt, MGMT_EV_CONN_SUBRATE, index, conn_subrate,
+								NULL, NULL);
 	mgmt_register(mgmt, MGMT_EV_AUTH_FAILED, index, auth_failed,
 								NULL, NULL);
 	mgmt_register(mgmt, MGMT_EV_CLASS_OF_DEV_CHANGED, index,
-- 
2.55.0


^ permalink raw reply related	[flat|nested] 9+ messages in thread

* [PATCH BlueZ v1 3/7] emulator: Default to the latest BR/EDR+LE version
  2026-09-23 19:31 [PATCH BlueZ v1 0/7] Add HID over GATT functional tests Luiz Augusto von Dentz
  2026-09-23 19:31 ` [PATCH BlueZ v1 1/7] client/gatt: Fix setting descriptor value from scripts Luiz Augusto von Dentz
  2026-09-23 19:31 ` [PATCH BlueZ v1 2/7] client/mgmt: Print Connection Subrate event Luiz Augusto von Dentz
@ 2026-09-23 19:31 ` Luiz Augusto von Dentz
  2026-09-23 19:31 ` [PATCH BlueZ v1 4/7] client/scripts: Add HoG device scripts Luiz Augusto von Dentz
                   ` (3 subsequent siblings)
  6 siblings, 0 replies; 9+ messages in thread
From: Luiz Augusto von Dentz @ 2026-09-23 19:31 UTC (permalink / raw)
  To: linux-bluetooth

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

Emulate BR/EDR+LE 6.2 controllers by default, for both local (-l) and
server (--server, --tcp) controllers, so the latest features such as
Shorter Connection Intervals (LE Connection Rate Request) are
supported, e.g. by test-functional which uses --server.

Add the -C/--core=<version> option to emulate older versions instead:
5.0, 5.2, 6.0 or 6.2.
---
 emulator/main.c   | 54 ++++++++++++++++++++++++++++++++++++++++++++---
 emulator/server.c | 15 ++++++++++++-
 emulator/server.h |  2 ++
 3 files changed, 67 insertions(+), 4 deletions(-)

diff --git a/emulator/main.c b/emulator/main.c
index c21640adc359..b18e77cf191b 100644
--- a/emulator/main.c
+++ b/emulator/main.c
@@ -24,8 +24,8 @@
 #include "src/shared/util.h"
 
 #include "serial.h"
-#include "server.h"
 #include "btdev.h"
+#include "server.h"
 #include "vhci.h"
 #include "le.h"
 
@@ -54,6 +54,9 @@ static void usage(void)
 		"\t-U[num]               Number of test LE controllers\n"
 		"\t-B                    Create BR/EDR only controller\n"
 		"\t-A                    Create AMP controller\n"
+		"\t-C, --core=<version>  Core Specification version of the\n"
+		"\t                      BR/EDR/LE controllers:\n"
+		"\t                      5.0, 5.2, 6.0 or 6.2 (default)\n"
 		"\t-T[num]               Number of test AMP controllers\n"
 		"\t-h, --help            Show help options\n");
 }
@@ -67,12 +70,37 @@ static const struct option main_options[] = {
 	{ "le",      no_argument,       NULL, 'L' },
 	{ "bredr",   no_argument,       NULL, 'B' },
 	{ "amp",     no_argument,       NULL, 'A' },
+	{ "core",    required_argument, NULL, 'C' },
 	{ "letest",  optional_argument, NULL, 'U' },
 	{ "version", no_argument,	NULL, 'v' },
 	{ "help",    no_argument,	NULL, 'h' },
 	{ }
 };
 
+static const struct {
+	const char *version;
+	enum btdev_type type;
+} core_versions[] = {
+	{ "5.0", BTDEV_TYPE_BREDRLE50 },
+	{ "5.2", BTDEV_TYPE_BREDRLE52 },
+	{ "6.0", BTDEV_TYPE_BREDRLE60 },
+	{ "6.2", BTDEV_TYPE_BREDRLE62 },
+};
+
+static bool parse_core_version(const char *version, enum btdev_type *type)
+{
+	size_t i;
+
+	for (i = 0; i < ARRAY_SIZE(core_versions); i++) {
+		if (!strcmp(core_versions[i].version, version)) {
+			*type = core_versions[i].type;
+			return true;
+		}
+	}
+
+	return false;
+}
+
 static void vhci_debug(const char *str, void *user_data)
 {
 	int i = PTR_TO_UINT(user_data);
@@ -101,7 +129,10 @@ int main(int argc, char *argv[])
 	bool serial_enabled = false;
 	int letest_count = 0;
 	int vhci_count = 0;
-	enum btdev_type type = BTDEV_TYPE_BREDRLE60;
+	/* Default to the latest version supported by the emulator */
+	enum btdev_type bredrle_type = BTDEV_TYPE_BREDRLE62;
+	enum btdev_type type;
+	bool type_set = false;
 	int i;
 
 	mainloop_init();
@@ -109,7 +140,7 @@ int main(int argc, char *argv[])
 	for (;;) {
 		int opt;
 
-		opt = getopt_long(argc, argv, "dSs::t::l::LBAU::T::vh",
+		opt = getopt_long(argc, argv, "dSs::t::l::LBAC:U::T::vh",
 						main_options, NULL);
 		if (opt < 0)
 			break;
@@ -140,12 +171,22 @@ int main(int argc, char *argv[])
 			break;
 		case 'L':
 			type = BTDEV_TYPE_LE;
+			type_set = true;
 			break;
 		case 'B':
 			type = BTDEV_TYPE_BREDR;
+			type_set = true;
 			break;
 		case 'A':
 			type = BTDEV_TYPE_AMP;
+			type_set = true;
+			break;
+		case 'C':
+			if (!parse_core_version(optarg, &bredrle_type)) {
+				fprintf(stderr, "Unsupported version: %s\n",
+								optarg);
+				return EXIT_FAILURE;
+			}
 			break;
 		case 'U':
 			if (optarg)
@@ -164,6 +205,9 @@ int main(int argc, char *argv[])
 		}
 	}
 
+	if (!type_set)
+		type = bredrle_type;
+
 	if (letest_count < 1 && vhci_count < 1 && !server_enabled &&
 						!tcp_port && !serial_enabled) {
 		fprintf(stderr, "No emulator specified\n");
@@ -214,6 +258,8 @@ int main(int argc, char *argv[])
 		server1 = server_open_unix(SERVER_TYPE_BREDRLE, path);
 		if (!server1)
 			fprintf(stderr, "Failed to open BR/EDR/LE server\n");
+		else
+			server_set_bredrle_type(server1, bredrle_type);
 
 		snprintf(path, sizeof(path), "%s/%s", server_path,
 							"bt-server-bredr");
@@ -255,6 +301,8 @@ int main(int argc, char *argv[])
 		tcp_server = server_open_tcp(SERVER_TYPE_BREDRLE, tcp_port);
 		if (!tcp_server)
 			fprintf(stderr, "Failed to open TCP port\n");
+		else
+			server_set_bredrle_type(tcp_server, bredrle_type);
 		fprintf(stderr, "Listening TCP on 127.0.0.1:%d\n", tcp_port);
 	}
 
diff --git a/emulator/server.c b/emulator/server.c
index e3eda8458ae0..5a827b24531e 100644
--- a/emulator/server.c
+++ b/emulator/server.c
@@ -38,6 +38,7 @@
 
 struct server {
 	enum server_type type;
+	enum btdev_type bredrle_type;
 	uint16_t id;
 	int fd;
 	struct queue *clients;
@@ -281,7 +282,7 @@ static void server_accept_callback(int fd, uint32_t events, void *user_data)
 
 	switch (server->type) {
 	case SERVER_TYPE_BREDRLE:
-		type = BTDEV_TYPE_BREDRLE52;
+		type = server->bredrle_type;
 		break;
 	case SERVER_TYPE_BREDR:
 		type = BTDEV_TYPE_BREDR;
@@ -361,6 +362,7 @@ struct server *server_open_unix(enum server_type type, const char *path)
 
 	memset(server, 0, sizeof(*server));
 	server->type = type;
+	server->bredrle_type = BTDEV_TYPE_BREDRLE62;
 	server->id = 0x42;
 
 	server->fd = open_unix(path);
@@ -429,6 +431,7 @@ struct server *server_open_tcp(enum server_type type, uint16_t port)
 
 	memset(server, 0, sizeof(*server));
 	server->type = type;
+	server->bredrle_type = BTDEV_TYPE_BREDRLE62;
 	server->id = 0x43;
 
 	server->fd = open_tcp(port);
@@ -455,6 +458,16 @@ void server_close(struct server *server)
 	mainloop_remove_fd(server->fd);
 }
 
+bool server_set_bredrle_type(struct server *server, enum btdev_type type)
+{
+	if (!server || server->type != SERVER_TYPE_BREDRLE)
+		return false;
+
+	server->bredrle_type = type;
+
+	return true;
+}
+
 bool server_set_debug(struct server *server, server_debug_func_t callback,
 			void *user_data, server_destroy_func_t destroy)
 {
diff --git a/emulator/server.h b/emulator/server.h
index 1844a9871af1..5fc3a284f53f 100644
--- a/emulator/server.h
+++ b/emulator/server.h
@@ -25,6 +25,8 @@ struct server *server_open_unix(enum server_type type, const char *path);
 struct server *server_open_tcp(enum server_type type, uint16_t port);
 void server_close(struct server *server);
 
+bool server_set_bredrle_type(struct server *server, enum btdev_type type);
+
 typedef void (*server_debug_func_t)(const char *str, void *user_data);
 typedef void (*server_destroy_func_t)(void *user_data);
 bool server_set_debug(struct server *server, server_debug_func_t callback,
-- 
2.55.0


^ permalink raw reply related	[flat|nested] 9+ messages in thread

* [PATCH BlueZ v1 4/7] client/scripts: Add HoG device scripts
  2026-09-23 19:31 [PATCH BlueZ v1 0/7] Add HID over GATT functional tests Luiz Augusto von Dentz
                   ` (2 preceding siblings ...)
  2026-09-23 19:31 ` [PATCH BlueZ v1 3/7] emulator: Default to the latest BR/EDR+LE version Luiz Augusto von Dentz
@ 2026-09-23 19:31 ` Luiz Augusto von Dentz
  2026-09-23 19:31 ` [PATCH BlueZ v1 5/7] doc: Add functional-hog documentation Luiz Augusto von Dentz
                   ` (2 subsequent siblings)
  6 siblings, 0 replies; 9+ messages in thread
From: Luiz Augusto von Dentz @ 2026-09-23 19:31 UTC (permalink / raw)
  To: linux-bluetooth

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

Add scripts registering a HID Service (HIDS) acting as a HID over GATT
keyboard, with and without Shorter Connection Interval (SCI) support.

HID SCI Mode can be notified so the device can confirm a mode change.
---
 client/scripts/hog-device-sci.bt | 49 ++++++++++++++++++++++++++++++++
 client/scripts/hog-device.bt     | 38 +++++++++++++++++++++++++
 2 files changed, 87 insertions(+)
 create mode 100644 client/scripts/hog-device-sci.bt
 create mode 100644 client/scripts/hog-device.bt

diff --git a/client/scripts/hog-device-sci.bt b/client/scripts/hog-device-sci.bt
new file mode 100644
index 000000000000..1bf3a0a90db7
--- /dev/null
+++ b/client/scripts/hog-device-sci.bt
@@ -0,0 +1,49 @@
+#
+# Register a HID Service (HIDS) acting as a HID over GATT (HoG) keyboard
+# with Shorter Connection Interval (SCI) support.
+#
+gatt.register-service 0x1812
+# Primary
+yes
+#
+# HID Information: bcdHID 1.11, bCountryCode 0x00,
+# Flags: NormallyConnectable and SCI Supported
+gatt.register-characteristic 0x2a4a read
+0x11 0x01 0x00 0x06
+#
+# Report Map: keyboard with Report ID 1
+gatt.register-characteristic 0x2a4b read
+0x05 0x01 0x09 0x06 0xa1 0x01 0x85 0x01 0x05 0x07 0x19 0xe0 0x29 0xe7 0x15 0x00 0x25 0x01 0x75 0x01 0x95 0x08 0x81 0x02 0x95 0x01 0x75 0x08 0x81 0x01 0x95 0x06 0x75 0x08 0x15 0x00 0x25 0x65 0x05 0x07 0x19 0x00 0x29 0x65 0x81 0x00 0xc0
+#
+# Report: Input Report ID 1
+gatt.register-characteristic 0x2a4d read,notify
+0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
+# Report Reference: Report ID 1, Input
+gatt.register-descriptor 0x2908 read
+0x01 0x01
+#
+# Protocol Mode: Report Protocol Mode
+gatt.register-characteristic 0x2a4e read,write-without-response
+0x01
+#
+# HID Control Point
+gatt.register-characteristic 0x2a4c write-without-response
+0x00
+#
+# HID SCI Mode: None (0x00), notified when changed
+gatt.register-characteristic 0x2c39 read,write,notify
+0x00
+#
+# HID SCI Information (intervals in units of 0.125 ms):
+# Minimum Supported Connection Interval: 0x08 (1 ms)
+# Number of Supported Subgroups: 1
+# Subgroup[0]: Min 0x0008 (1 ms) Max 0x0050 (10 ms) Stride 0x0008 (1 ms)
+gatt.register-characteristic 0x2c3a read
+0x08 0x01 0x08 0x00 0x50 0x00 0x08 0x00
+#
+gatt.register-application
+#
+# Advertise as a keyboard with HIDS
+advertise.uuids 0x1812
+advertise.appearance 0x03c1
+power on
diff --git a/client/scripts/hog-device.bt b/client/scripts/hog-device.bt
new file mode 100644
index 000000000000..42b324eda020
--- /dev/null
+++ b/client/scripts/hog-device.bt
@@ -0,0 +1,38 @@
+#
+# Register a HID Service (HIDS) acting as a HID over GATT (HoG) keyboard
+# without Shorter Connection Interval (SCI) support.
+#
+gatt.register-service 0x1812
+# Primary
+yes
+#
+# HID Information: bcdHID 1.11, bCountryCode 0x00,
+# Flags: NormallyConnectable
+gatt.register-characteristic 0x2a4a read
+0x11 0x01 0x00 0x02
+#
+# Report Map: keyboard with Report ID 1
+gatt.register-characteristic 0x2a4b read
+0x05 0x01 0x09 0x06 0xa1 0x01 0x85 0x01 0x05 0x07 0x19 0xe0 0x29 0xe7 0x15 0x00 0x25 0x01 0x75 0x01 0x95 0x08 0x81 0x02 0x95 0x01 0x75 0x08 0x81 0x01 0x95 0x06 0x75 0x08 0x15 0x00 0x25 0x65 0x05 0x07 0x19 0x00 0x29 0x65 0x81 0x00 0xc0
+#
+# Report: Input Report ID 1
+gatt.register-characteristic 0x2a4d read,notify
+0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
+# Report Reference: Report ID 1, Input
+gatt.register-descriptor 0x2908 read
+0x01 0x01
+#
+# Protocol Mode: Report Protocol Mode
+gatt.register-characteristic 0x2a4e read,write-without-response
+0x01
+#
+# HID Control Point
+gatt.register-characteristic 0x2a4c write-without-response
+0x00
+#
+gatt.register-application
+#
+# Advertise as a keyboard with HIDS
+advertise.uuids 0x1812
+advertise.appearance 0x03c1
+power on
-- 
2.55.0


^ permalink raw reply related	[flat|nested] 9+ messages in thread

* [PATCH BlueZ v1 5/7] doc: Add functional-hog documentation
  2026-09-23 19:31 [PATCH BlueZ v1 0/7] Add HID over GATT functional tests Luiz Augusto von Dentz
                   ` (3 preceding siblings ...)
  2026-09-23 19:31 ` [PATCH BlueZ v1 4/7] client/scripts: Add HoG device scripts Luiz Augusto von Dentz
@ 2026-09-23 19:31 ` Luiz Augusto von Dentz
  2026-09-23 19:31 ` [PATCH BlueZ v1 6/7] test: functional: add HoG tests Luiz Augusto von Dentz
  2026-09-23 19:31 ` [PATCH BlueZ v1 7/7] test: functional: limit the workers by the memory available Luiz Augusto von Dentz
  6 siblings, 0 replies; 9+ messages in thread
From: Luiz Augusto von Dentz @ 2026-09-23 19:31 UTC (permalink / raw)
  To: linux-bluetooth

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

Document the HoG functional tests, where bluetoothctl registers a HID
Service with and without Shorter Connection Interval (SCI) support
using client/scripts/hog-device*.bt, and the HID host:

- checks HID Information, HID SCI Mode and HID SCI Information with
  gatt.select-attribute/gatt.read
- receives a few Input Reports notified by the HID device
- changes the SCI mode, followed by the connection rate with
  mgmt.conn-subrate, and receives the notification from the HID device
  confirming the mode has been changed
---
 Makefile.am                |   1 +
 doc/functional-hog.rst     | 188 +++++++++++++++++++++++++++++++++++++
 doc/functional-testing.rst |   1 +
 3 files changed, 190 insertions(+)
 create mode 100644 doc/functional-hog.rst

diff --git a/Makefile.am b/Makefile.am
index 1d46b9b938cf..17348788a30b 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -501,6 +501,7 @@ EXTRA_DIST += doc/assigned-numbers.rst doc/supported-features.txt \
 				doc/functional-a2dp.rst \
 				doc/functional-avrcp.rst \
 				doc/functional-bap.rst \
+				doc/functional-hog.rst \
 				doc/functional-mpris-proxy.rst \
 				doc/functional-obex.rst \
 				doc/settings-storage.txt
diff --git a/doc/functional-hog.rst b/doc/functional-hog.rst
new file mode 100644
index 000000000000..d748f241a378
--- /dev/null
+++ b/doc/functional-hog.rst
@@ -0,0 +1,188 @@
+==============
+functional-hog
+==============
+
+DESCRIPTION
+===========
+
+HID over GATT (HoG) functional tests, `test/functional/test_hog.py`,
+driven through **bluetoothctl(1)**. See **functional-testing(7)** for
+the conventions used here, and **test-functional(1)** for how to run
+the suite.
+
+SETUP
+=====
+
+Two hosts, connected over LE, both running **bluetoothd(8)** with
+``ControllerMode = le`` and ``ExportClaimedServices = read-write``, as
+the HID Service is claimed by the input plugin of the HID host and
+bluetoothctl has to write HID SCI Mode:
+
+.. code-block::
+
+	+------------------------+                 +------------------------+
+	| host0                  |       LE        | host1                  |
+	| central                | --------------> | peripheral             |
+	| bluetoothctl           |                 | bluetoothctl           |
+	| HID host               |   GATT (HIDS)   | hog-device[-sci].bt    |
+	|                        | <============== | HID Service            |
+	+------------------------+                 +------------------------+
+
+	--> connection is initiated by      ==> reports flow towards
+
+host1 starts `bluetoothctl` with a script registering a HID Service
+(HIDS, ``00001812-0000-1000-8000-00805f9b34fb``) acting as a keyboard,
+through the ``gatt.register-service``, ``gatt.register-characteristic``
+and ``gatt.register-descriptor`` commands:
+
+``client/scripts/hog-device.bt``
+	HIDS without Shorter Connection Interval (SCI) support:
+
+	- HID Information (0x2A4A): ``11 01 00 02``, i.e. bcdHID 1.11,
+	  bCountryCode 0x00 and Flags NormallyConnectable.
+	- Report Map (0x2A4B): keyboard with Report ID 1.
+	- Report (0x2A4D), with a Report Reference descriptor (0x2908)
+	  ``01 01``, i.e. Report ID 1, Input Report.
+	- Protocol Mode (0x2A4E): ``01``, i.e. Report Protocol Mode.
+	- HID Control Point (0x2A4C).
+
+``client/scripts/hog-device-sci.bt``
+	Same as above, with SCI support:
+
+	- HID Information (0x2A4A): ``11 01 00 06``, i.e. the SCI
+	  Supported flag (0x04) is set as well.
+	- HID SCI Mode (0x2C39): ``00``, i.e. None, with the notify
+	  property so the HID device can confirm a mode change.
+	- HID SCI Information (0x2C3A): ``08 01 08 00 50 00 08 00``, i.e.
+	  Minimum Supported Connection Interval 1 ms, and one subgroup
+	  with Min 1 ms, Max 10 ms and Stride 1 ms (in units of 0.125 ms).
+
+Both scripts set the advertising data to the HIDS UUID and the
+keyboard appearance (0x03C1). The same scripts can be used manually to
+emulate a HoG device:
+
+.. code-block::
+
+	$ bluetoothctl --init-script client/scripts/hog-device-sci.bt
+	[bluetoothctl]> advertise on
+
+host0 runs a plain `bluetoothctl`, and both use
+``-a auto:NoInputNoOutput`` so pairing is Just Works.
+
+TEST CASES
+==========
+
+test_hog[no-sci]
+----------------
+
+:Setup: As above, with ``client/scripts/hog-device.bt`` on host1.
+
+:Steps:
+	1. host1: start `bluetoothctl` with the script.
+	2. host0: ``scan on``; host1: ``advertise on``.
+	3. host0: ``pair <host1 bdaddr>``.
+	4. host0: ``info <host1 bdaddr>``.
+	5. host0: ``gatt.select-attribute 2a4a`` and ``gatt.read``.
+	6. host0: ``gatt.select-attribute 2a4d`` and ``gatt.notify on``.
+	7. host1: ``gatt.select-attribute local
+	   /org/bluez/app/service0/chrc2``, then for each report
+	   ``gatt.write "<report>"``: ``00 00 04 00 00 00 00 00`` (a
+	   pressed), ``02 00 05 00 00 00 00 00`` (Left Shift + b pressed)
+	   and ``00 00 00 00 00 00 00 00`` (released).
+
+:Expected:
+	1. ``Application registered`` on host1.
+	2. ``Advertising object registered`` on host1 and the device found
+	   on host0.
+	3. ``Pairing successful`` and ``ServicesResolved: yes``.
+	4. ``Human Interface Device (00001812-...)`` is listed in the UUIDs.
+	5. HID Information reads ``11 01 00 02``:
+
+	   .. code-block::
+
+		[bluetoothctl]> gatt.select-attribute 2a4a
+		[bluetoothctl]> gatt.read
+		Attempting to read /org/bluez/hci0/dev_XX/service0013/char001e
+		  11 01 00 02                                      ....
+
+	6. ``Notify started``, and the Report subscribed on host1
+	   (``Notify sock acquired``, as the input plugin already
+	   subscribed with AcquireNotify).
+	7. Each report is notified to host0, in order:
+
+	   .. code-block::
+
+		[CHG] Attribute /org/bluez/hci0/dev_XX/service0013/char0018 Value:
+		  00 00 04 00 00 00 00 00                          ........
+
+:Notes: The service is checked at the GATT level only, so the test
+	does not depend on the kernel supporting uhid. The HID Service is
+	claimed by the input plugin on host0, but it is still exported
+	read-only over D-Bus by default (see ``ExportClaimedServices`` in
+	**bluetoothd(8)**), so it can be read with bluetoothctl.
+
+test_hog[sci]
+-------------
+
+:Setup: As above, with ``client/scripts/hog-device-sci.bt`` on host1.
+
+:Steps: As for test_hog[no-sci], then:
+
+	8. host0: ``gatt.select-attribute 2c39`` and ``gatt.read``.
+	9. host0: ``gatt.select-attribute 2c3a`` and ``gatt.read``.
+	10. host0: ``gatt.select-attribute 2c39`` and ``gatt.notify on``.
+	11. host0: ``gatt.write "0x03"``, i.e. SCI Fast Mode.
+	12. host0: ``mgmt.conn-subrate <host1 bdaddr> 0x0008 0x0010 1 1 0 0
+	    0x01f4``, i.e. interval 1 ms to 2 ms, within the range given in
+	    HID SCI Information, no subrating, no latency and 5 s
+	    supervision timeout.
+	13. host1: ``gatt.select-attribute local
+	    /org/bluez/app/service0/chrc5`` and ``gatt.write "0x03"``.
+
+:Expected: As for test_hog[no-sci], except HID Information reads
+	``11 01 00 06``, then:
+
+	8. HID SCI Mode reads ``00``.
+	9. HID SCI Information reads ``08 01 08 00 50 00 08 00``.
+	10. ``Notify started`` and HID SCI Mode subscribed on host1.
+	11. host1 receives the write:
+
+	    .. code-block::
+
+		[/org/bluez/app/service0/chrc5 (HID SCI Mode)] WriteValue: XX offset 0 link LE
+		  03                                               .
+
+	12. ``Connection Subrate loaded successfully``, then the MGMT
+	    Connection Subrate event with the new interval on both hosts:
+
+	    .. code-block::
+
+		hci0 XX type LE Public connection subrate interval 0x0008 subrate 0x0001 latency 0x0000 cont_num 0x0000 timeout 0x01f4
+
+	13. The new mode is notified to host0, confirming it has been
+	    changed:
+
+	    .. code-block::
+
+		[CHG] Attribute /org/bluez/hci0/dev_XX/service0015/char0018 Value:
+		  03                                               .
+
+	.. code-block::
+
+		[bluetoothctl]> gatt.select-attribute 2c39
+		[bluetoothctl]> gatt.read
+		  00                                               .
+
+		[bluetoothctl]> gatt.select-attribute 2c3a
+		[bluetoothctl]> gatt.read
+		  08 01 08 00 50 00 08 00                          ....P...
+
+:Notes: As the SCI Supported flag is set, the input plugin on host0
+	reads HID SCI Mode and HID SCI Information as well, which can be
+	seen in the **bluetoothd(8)** debug output (``SCI Mode:`` and
+	``SCI Info:``).
+
+	The kernel only issues the LE Connection Rate Request as central,
+	so the connection rate is changed by the HID host. This requires
+	the controllers to support Shorter Connection Intervals, which
+	btvirt emulates as a BR/EDR/LE 6.2 controller.
diff --git a/doc/functional-testing.rst b/doc/functional-testing.rst
index ca7bfa672a76..7b3cad1c66b1 100644
--- a/doc/functional-testing.rst
+++ b/doc/functional-testing.rst
@@ -15,6 +15,7 @@ are documented separately:
 - **functional-a2dp(7)**: `test/functional/test_a2dp.py`
 - **functional-avrcp(7)**: `test/functional/test_avrcp.py`
 - **functional-bap(7)**: `test/functional/test_bap.py`
+- **functional-hog(7)**: `test/functional/test_hog.py`
 - **functional-mpris-proxy(7)**: `test/functional/test_mpris_proxy.py`
 - **functional-obex(7)**: `test/functional/test_obex.py`
 
-- 
2.55.0


^ permalink raw reply related	[flat|nested] 9+ messages in thread

* [PATCH BlueZ v1 6/7] test: functional: add HoG tests
  2026-09-23 19:31 [PATCH BlueZ v1 0/7] Add HID over GATT functional tests Luiz Augusto von Dentz
                   ` (4 preceding siblings ...)
  2026-09-23 19:31 ` [PATCH BlueZ v1 5/7] doc: Add functional-hog documentation Luiz Augusto von Dentz
@ 2026-09-23 19:31 ` Luiz Augusto von Dentz
  2026-09-23 19:31 ` [PATCH BlueZ v1 7/7] test: functional: limit the workers by the memory available Luiz Augusto von Dentz
  6 siblings, 0 replies; 9+ messages in thread
From: Luiz Augusto von Dentz @ 2026-09-23 19:31 UTC (permalink / raw)
  To: linux-bluetooth

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

Add tests where bluetoothctl registers a HID Service, with and without
SCI support, using client/scripts/hog-device*.bt, and the HID host
checks the service, receives Input Reports and, with SCI support,
changes the SCI mode and the connection rate.

See doc/functional-hog.rst for details.
---
 test/functional/test_hog.py | 252 ++++++++++++++++++++++++++++++++++++
 1 file changed, 252 insertions(+)
 create mode 100644 test/functional/test_hog.py

diff --git a/test/functional/test_hog.py b/test/functional/test_hog.py
new file mode 100644
index 000000000000..ea54882d059d
--- /dev/null
+++ b/test/functional/test_hog.py
@@ -0,0 +1,252 @@
+# -*- coding: utf-8; mode: python; eval: (blacken-mode); -*-
+# SPDX-License-Identifier: GPL-2.0-or-later
+"""
+Tests for HID over GATT (HoG) using bluetoothctl in VM instances
+
+The HID device (host1) registers a HID Service (HIDS) with bluetoothctl,
+using client/scripts/hog-device.bt or client/scripts/hog-device-sci.bt,
+and the HID host (host0) pairs with it and checks the service over GATT.
+"""
+
+import warnings
+
+import pytest
+
+from pytest_bluezenv import Bluetoothd, Pexpect, find_exe, host_config
+from pytest_bluezenv.utils import bluez_src_dir
+
+pytestmark = [pytest.mark.vm]
+
+# The HID Service is claimed by the input plugin of the HID host, so it
+# has to be exported read-write for bluetoothctl to write HID SCI Mode
+HOG_CONF = """[General]
+ControllerMode = le
+
+[GATT]
+ExportClaimedServices = read-write
+"""
+
+HIDS_UUID = "00001812-0000-1000-8000-00805f9b34fb"
+
+# Local attributes registered by client/scripts/hog-device*.bt
+LOCAL_REPORT = "/org/bluez/app/service0/chrc2"
+LOCAL_SCI_MODE = "/org/bluez/app/service0/chrc5"
+
+# Keyboard Input Reports: Modifiers, Reserved, then 6 Key Codes
+REPORTS = [
+    "00 00 04 00 00 00 00 00",  # a pressed
+    "02 00 05 00 00 00 00 00",  # Left Shift + b pressed
+    "00 00 00 00 00 00 00 00",  # released
+]
+
+# HID SCI Mode: Fast Mode
+SCI_FAST_MODE = "03"
+
+# LE Connection Rate parameters requested with mgmt.conn-subrate once in
+# SCI Fast Mode: interval 1 ms to 2 ms (units of 0.125 ms), within the
+# range given in HID SCI Information, no subrating, no latency and 5 s
+# supervision timeout (units of 10 ms)
+SCI_RATE = ["0x0008", "0x0010", "1", "1", "0", "0", "0x01f4"]
+
+# Reported when an operation cannot complete, so a test does not have to
+# wait for its timeout to know it is not going to
+FAILURES = [
+    r"(Failed to \w+[^\r\n]*)",
+    r"(Device \S+ not available)",
+    r"(No device connected)",
+    r"(No attribute selected)",
+]
+
+# What a command reports is printed as it runs, unlike what the peers
+# report over the air, so waiting the default timeout for it only makes
+# a failure slower
+REPLY_TIMEOUT = 5
+
+
+def script(name):
+    src = bluez_src_dir()
+    if src is None:
+        pytest.skip("BlueZ source directory not known")
+
+    path = src / "client" / "scripts" / name
+    if not path.exists():
+        pytest.skip(f"{path} not found")
+
+    return str(path)
+
+
+def spawn_bluetoothctl(host, init_script=None):
+    exe = find_exe("client", "bluetoothctl")
+    # Accept pairing and authorize services without prompting, with a
+    # capability pairing Just Works, as there is no one to answer the
+    # entry of a passkey
+    args = [exe, "-a", "auto:NoInputNoOutput"]
+    if init_script:
+        args += ["--init-script", script(init_script)]
+    return host.pexpect.spawn(args)
+
+
+def expect(ctl, patterns, **kwargs):
+    """
+    Expect one of the patterns, failing as soon as one of the failures
+    shows up. Return the index of the pattern matched and its groups.
+    """
+    if isinstance(patterns, str):
+        patterns = [patterns]
+
+    idx, m = ctl.expect(FAILURES + list(patterns), **kwargs)
+    if idx < len(FAILURES):
+        raise AssertionError(m[0].decode("utf-8") if m else "failed")
+
+    return idx - len(FAILURES), m
+
+
+def expect_all(ctl, patterns, **kwargs):
+    """Expect all the given patterns, in any order."""
+    pending = list(patterns)
+
+    while pending:
+        idx, _ = expect(ctl, pending, **kwargs)
+        pending.pop(idx)
+
+
+def pair_le(host0, ctl0, host1, ctl1):
+    ctl0.send("scan on\n")
+    expect(ctl0, f"Controller {host0.bdaddr.upper()} Discovering: yes")
+
+    ctl1.send("advertise on\n")
+    expect(ctl1, "Advertising object registered")
+
+    expect(ctl0, f"Device {host1.bdaddr.upper()}")
+    ctl0.send(f"pair {host1.bdaddr.upper()}\n")
+
+    # See test_bluetoothctl_pair_le: passkey confirmation is handled by
+    # the auto agent, but legacy passkey entry still needs an answer
+    legacy = r"\[agent\].*Passkey:.*m(\d+)"
+    pending = [
+        r"Pairing successful",
+        f"Device {host1.bdaddr.upper()} ServicesResolved: yes",
+    ]
+
+    while pending:
+        idx, m = expect(ctl0, [legacy] + pending)
+        if idx == 0:
+            warnings.warn(
+                "BUG: we got passkey authentication, bluetoothd/kernel "
+                "should be fixed"
+            )
+            ctl1.expect(r"\[agent\] Enter passkey \(number in 0-999999\):")
+            ctl1.send(f"{m[0].decode('utf-8')}\n")
+            continue
+        pending.pop(idx - 1)
+
+    ctl0.send("scan off\n")
+
+
+def read_attribute(ctl, uuid):
+    """Read the given remote attribute, returning its value as hex string."""
+    ctl.send(f"gatt.select-attribute {uuid}\n")
+    ctl.send("gatt.read\n")
+    expect(ctl, r"Attempting to read \S+", timeout=REPLY_TIMEOUT)
+    return expect_hexdump(ctl)
+
+
+def hexbytes(value):
+    """Turn a hex string into the format taken by gatt.write."""
+    return " ".join(f"0x{byte}" for byte in value.split())
+
+
+def expect_hexdump(ctl, **kwargs):
+    """Expect a value printed by bluetoothctl, returning it as hex string."""
+    _, m = expect(ctl, r"((?: [0-9a-f]{2})+)  ", **kwargs)
+    return m[0].decode("utf-8").strip()
+
+
+def expect_notification(ctl):
+    """Expect a notification of the remote attribute, returning its value."""
+    expect(ctl, rf"CHG.*? Attribute /\S+ Value:")
+    return expect_hexdump(ctl)
+
+
+def enable_notifications(ctl, device, uuid, local):
+    """Enable notifications of the given attribute, on the HID host."""
+    ctl.send(f"gatt.select-attribute {uuid}\n")
+    ctl.send("gatt.notify on\n")
+    expect(ctl, r"Notify started", timeout=REPLY_TIMEOUT)
+    # Either subscribed with StartNotify, or with AcquireNotify as done by
+    # the input plugin of the HID host for the Input Reports
+    expect(
+        device,
+        rf"Attribute {local} (\S+ )?(notifications enabled|Notify sock acquired)",
+    )
+
+
+def notify(device, local, value):
+    """Notify the given value of a local attribute, on the HID device."""
+    device.send(f"gatt.select-attribute local {local}\n")
+    device.send(f'gatt.write "{hexbytes(value)}"\n')
+    expect(device, rf"Attribute {local} .*written", timeout=REPLY_TIMEOUT)
+
+
+@host_config(
+    [Bluetoothd(conf=HOG_CONF), Pexpect()],
+    [Bluetoothd(conf=HOG_CONF), Pexpect()],
+)
+@pytest.mark.parametrize(
+    "init_script, flags, sci",
+    [
+        ("hog-device.bt", "02", None),
+        ("hog-device-sci.bt", "06", ("00", "08 01 08 00 50 00 08 00")),
+    ],
+    ids=["no-sci", "sci"],
+)
+def test_hog(hosts, init_script, flags, sci):
+    host0, host1 = hosts
+
+    device = spawn_bluetoothctl(host1, init_script)
+    expect(device, "Application registered")
+
+    ctl = spawn_bluetoothctl(host0)
+    pair_le(host0, ctl, host1, device)
+
+    ctl.send(f"info {host1.bdaddr.upper()}\n")
+    expect(ctl, rf"Human Interface Device\s+\({HIDS_UUID}\)", timeout=REPLY_TIMEOUT)
+
+    # HID Information: bcdHID 1.11, bCountryCode 0x00 and Flags
+    assert read_attribute(ctl, "2a4a") == f"11 01 00 {flags}"
+
+    # Input Reports: the HID device notifies a few key presses
+    enable_notifications(ctl, device, "2a4d", LOCAL_REPORT)
+
+    for report in REPORTS:
+        notify(device, LOCAL_REPORT, report)
+        assert expect_notification(ctl) == report
+
+    if sci is None:
+        return
+
+    mode, info = sci
+    assert read_attribute(ctl, "2c39") == mode
+    assert read_attribute(ctl, "2c3a") == info
+
+    # SCI mode change: the HID host writes the new mode to the HID device
+    enable_notifications(ctl, device, "2c39", LOCAL_SCI_MODE)
+
+    ctl.send(f'gatt.write "{hexbytes(SCI_FAST_MODE)}"\n')
+    expect(device, rf"\[{LOCAL_SCI_MODE} .*\] WriteValue:")
+    assert expect_hexdump(device) == SCI_FAST_MODE
+
+    # The HID host, as central, changes the connection rate accordingly
+    ctl.send(f"mgmt.conn-subrate {host1.bdaddr} {' '.join(SCI_RATE)}\n")
+    # The connection rate may change before the command completes, so the
+    # event may be printed before the reply
+    rate = rf"{{}} type .* connection subrate interval {SCI_RATE[0]}"
+    expect_all(
+        ctl,
+        [r"Connection Subrate loaded successfully", rate.format(host1.bdaddr.upper())],
+    )
+    expect(device, rate.format(host0.bdaddr.upper()))
+
+    # Then the HID device confirms the mode has been changed
+    notify(device, LOCAL_SCI_MODE, SCI_FAST_MODE)
+    assert expect_notification(ctl) == SCI_FAST_MODE
-- 
2.55.0


^ permalink raw reply related	[flat|nested] 9+ messages in thread

* [PATCH BlueZ v1 7/7] test: functional: limit the workers by the memory available
  2026-09-23 19:31 [PATCH BlueZ v1 0/7] Add HID over GATT functional tests Luiz Augusto von Dentz
                   ` (5 preceding siblings ...)
  2026-09-23 19:31 ` [PATCH BlueZ v1 6/7] test: functional: add HoG tests Luiz Augusto von Dentz
@ 2026-09-23 19:31 ` Luiz Augusto von Dentz
  6 siblings, 0 replies; 9+ messages in thread
From: Luiz Augusto von Dentz @ 2026-09-23 19:31 UTC (permalink / raw)
  To: linux-bluetooth

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

Each worker of pytest-xdist runs VM instances, so using one worker per
CPU could run out of memory, with the OOM killer terminating some of
them and tests failing at random.

With -n auto, limit the number of workers by the memory available,
estimating each worker needs memory for 3 VM instances of 256M of guest
memory plus the overhead of qemu, and use -n auto for check-functional
by default, which can be overridden with CHECK_FUNCTIONAL_JOBS.
---
 Makefile.am                 |  7 +++++-
 doc/test-functional.rst     | 25 ++++++++++++++++++++
 test/functional/conftest.py | 46 +++++++++++++++++++++++++++++++++++++
 3 files changed, 77 insertions(+), 1 deletion(-)

diff --git a/Makefile.am b/Makefile.am
index 17348788a30b..e5587c55d2dd 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -885,9 +885,14 @@ check-TESTS recheck: AM_MAKEFLAGS += -j$(CHECK_JOBS)
 
 # The functional tests are parallelized by pytest-xdist, loadgroup is required
 # since pytest-bluezenv groups the tests sharing a host/VM setup together.
+# Each worker runs VM instances, so by default the number of workers is limited
+# by the memory available (see test/functional/conftest.py), override with e.g.
+# CHECK_FUNCTIONAL_JOBS=4.
+CHECK_FUNCTIONAL_JOBS ?= auto
+
 check-functional: all
 	python3 -m pytest "$(srcdir)/test/functional" -v \
-		-n $(CHECK_JOBS) --dist loadgroup \
+		-n $(CHECK_FUNCTIONAL_JOBS) --dist loadgroup \
 		-m "not tester" \
 		--kernel="$(FUNCTIONAL_TESTING_KERNEL)" \
 		--bluez-build-dir="$(top_builddir)" \
diff --git a/doc/test-functional.rst b/doc/test-functional.rst
index 3ffcbf6dec5c..9cf0a8bb48e5 100644
--- a/doc/test-functional.rst
+++ b/doc/test-functional.rst
@@ -472,6 +472,31 @@ pytest-xdist is required for parallel execution. To run:
 
 	$ test/test-functional -n auto --dist loadgroup
 
+With ``-n auto`` the number of workers is limited by the memory
+available, rather than using one worker per CPU, as each worker runs
+VM instances and running out of memory makes the OOM killer terminate
+some of them, failing tests at random. Each worker is estimated to need
+memory for 3 VM instances (the maximum used by a test) of 256M of guest
+memory plus the overhead of qemu, see `test/functional/conftest.py`.
+The estimate is printed when starting:
+
+.. code-block::
+
+	Using 9 workers: 22 CPUs, 12159 MiB available, 1218 MiB per worker (3 VMs of 406 MiB)
+
+To use a given number of workers instead:
+
+.. code-block::
+
+	$ test/test-functional -n 4 --dist loadgroup
+
+``make check-functional`` uses ``-n auto`` as well, which can be
+overridden with ``CHECK_FUNCTIONAL_JOBS``:
+
+.. code-block::
+
+	$ make check-functional CHECK_FUNCTIONAL_JOBS=4
+
 Logging in to a test VM instance
 --------------------------------
 
diff --git a/test/functional/conftest.py b/test/functional/conftest.py
index 4e0bda882de3..4d4193a95cd9 100644
--- a/test/functional/conftest.py
+++ b/test/functional/conftest.py
@@ -208,6 +208,52 @@ def _setup_progress(config):
     )
 
 
+# Estimate of the memory used by a VM instance: 256M of guest memory, the
+# default of test-runner as the tests do not set it, plus the overhead of
+# qemu itself
+VM_MEM = (256 + 150) * 1024 * 1024
+
+# Maximum number of VM instances used by a test, i.e. by an xdist worker
+# as it runs one test at a time
+VM_MAX_HOSTS = 3
+
+
+def _mem_available():
+    try:
+        with open("/proc/meminfo") as f:
+            for line in f:
+                if line.startswith("MemAvailable:"):
+                    return int(line.split()[1]) * 1024
+    except (OSError, ValueError, IndexError):
+        pass
+
+    return None
+
+
+@pytest.hookimpl(optionalhook=True)
+def pytest_xdist_auto_num_workers(config):
+    """
+    Number of workers used with -n auto: limited by the memory available,
+    so running a VM instance per worker does not end up with the OOM
+    killer terminating some of them, instead of one worker per CPU.
+    """
+    cpus = os.cpu_count() or 1
+    mem = _mem_available()
+    if mem is None:
+        return cpus
+
+    per_worker = VM_MAX_HOSTS * VM_MEM
+    workers = max(1, min(cpus, mem // per_worker))
+
+    sys.stderr.write(
+        f"Using {workers} workers: {cpus} CPUs, {mem >> 20} MiB available,"
+        f" {per_worker >> 20} MiB per worker ({VM_MAX_HOSTS} VMs of"
+        f" {VM_MEM >> 20} MiB)\n"
+    )
+
+    return workers
+
+
 def pytest_configure(config):
     _setup_progress(config)
 
-- 
2.55.0


^ permalink raw reply related	[flat|nested] 9+ messages in thread

end of thread, other threads:[~2026-09-23 22:30 UTC | newest]

Thread overview: 9+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-09-23 19:31 [PATCH BlueZ v1 0/7] Add HID over GATT functional tests Luiz Augusto von Dentz
2026-09-23 19:31 ` [PATCH BlueZ v1 1/7] client/gatt: Fix setting descriptor value from scripts Luiz Augusto von Dentz
2026-09-23 22:30   ` Add HID over GATT functional tests bluez.test.bot
2026-09-23 19:31 ` [PATCH BlueZ v1 2/7] client/mgmt: Print Connection Subrate event Luiz Augusto von Dentz
2026-09-23 19:31 ` [PATCH BlueZ v1 3/7] emulator: Default to the latest BR/EDR+LE version Luiz Augusto von Dentz
2026-09-23 19:31 ` [PATCH BlueZ v1 4/7] client/scripts: Add HoG device scripts Luiz Augusto von Dentz
2026-09-23 19:31 ` [PATCH BlueZ v1 5/7] doc: Add functional-hog documentation Luiz Augusto von Dentz
2026-09-23 19:31 ` [PATCH BlueZ v1 6/7] test: functional: add HoG tests Luiz Augusto von Dentz
2026-09-23 19:31 ` [PATCH BlueZ v1 7/7] test: functional: limit the workers by the memory available Luiz Augusto von Dentz

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.