[PATCH BlueZ v1 00/11] Cover a BAP stream to a coordinated set

[PATCH BlueZ v1 00/11] Cover a BAP stream to a coordinated set

[Luiz Augusto von Dentz]

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

These add the functional test cases for a BAP unicast stereo stream to
a coordinated set of two acceptors, one taking the left channel and one
the right, which is what a pair of earbuds does, together with the
fixes they turned out to need.

Covering a set takes three hosts talking to each other, which the
emulator does not get right: every device assigns its own connection
handles, but the events and the data delivered to the peer carried the
handle of the sender, so everything beyond the first link referred to a
handle the receiving side knows nothing about and was dropped. It is
invisible with two devices, as both sides then assign the same handles,
and it is what kept the second member of the set from exchanging
anything at all. A CIG was also limited to three CIS, one less than a
stereo stream to a set of two needs.

Encrypting the SIRK gave a value the initiator was unable to decrypt,
so the set was resolved under a SIRK that is not the one the members
were configured with: LE legacy pairing distributes one long term key
per role, and only the last one to arrive was kept, so the two sides
did not necessarily encrypt and decrypt with the same key.

The auto agent registers with no capability, which is KeyboardDisplay,
so a peer may well choose the entry of a passkey, a method the auto
agent has no answer for: the pairing then only completes once the
request times out, as a failure. A capability can now be given after
the name, e.g. auto:NoInputNoOutput, to pair Just Works instead.

The first two patches are a fix of their own, for a source pushed to a
BASS session before it is ready, and the rest of the test changes make
a failure easier to tell: a test now fails as soon as an operation
does, instead of waiting for its timeout, and reports what it is
waiting for while it waits.

The tests pass with "make check-functional", on their own as well as
alongside the others.

Luiz Augusto von Dentz (11):
  shared/bass: add a ready callback
  bass: wait for the session to be ready before pushing a source
  test: functional: report what a test is waiting for
  test: functional: answer the notification registered by the victim
  doc: describe the BAP coordinated set test cases
  emulator: use the handle of the receiving side
  emulator: allow the maximum number of CIS of a CIG
  device: keep the long term key of both roles
  client: allow a capability with the auto agent
  test: functional: fail as soon as an operation fails
  test: functional: add the BAP coordinated set tests

 client/agent.c                       |  14 +-
 client/main.c                        |  14 +-
 client/scripts/bap-sink-lc3-left.bt  |  30 ++++
 client/scripts/bap-sink-lc3-right.bt |  30 ++++
 doc/bluetoothctl.rst                 |   6 +-
 doc/functional-bap.rst               | 111 ++++++++++++
 emulator/btdev.c                     |  89 +++++++---
 profiles/audio/bass.c                | 124 +++++++++++--
 src/device.c                         |  45 +++--
 src/shared/bass.c                    | 107 +++++++++++
 src/shared/bass.h                    |   6 +
 test/functional/conftest.py          | 201 +++++++++++++++++++++
 test/functional/test_avrcp.py        |  13 ++
 test/functional/test_bap.py          | 256 ++++++++++++++++++++++++++-
 14 files changed, 987 insertions(+), 59 deletions(-)
 create mode 100644 client/scripts/bap-sink-lc3-left.bt
 create mode 100644 client/scripts/bap-sink-lc3-right.bt

-- 
2.55.0

[PATCH BlueZ v1 01/11] shared/bass: add a ready callback

[Luiz Augusto von Dentz]

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

A BASS client has no way to tell when the session is usable, i.e. when
the service discovery, the reads and the subscriptions triggered by
bt_bass_attach() are complete.

Without it an upper layer may write to the Broadcast Audio Scan Control
Point before the Broadcast Receive State notifications are enabled, and
miss the state changes the write causes, as the notifications are only
sent to clients that have enabled them.

Register for the GATT client idle event and notify the registered
callbacks once it is reached, as done for BAP.

Assisted-by: opencode:claude-opus-5
---
 src/shared/bass.c | 107 ++++++++++++++++++++++++++++++++++++++++++++++
 src/shared/bass.h |   6 +++
 2 files changed, 113 insertions(+)

diff --git a/src/shared/bass.c b/src/shared/bass.c
index 6566b89ae368..aad1edad48d8 100644
--- a/src/shared/bass.c
+++ b/src/shared/bass.c
@@ -30,6 +30,13 @@
 
 struct bt_bass_db;
 
+struct bt_bass_ready {
+	unsigned int id;
+	bt_bass_ready_func_t func;
+	bt_bass_destroy_func_t destroy;
+	void *data;
+};
+
 struct bt_bass_cb {
 	unsigned int id;
 	bt_bass_func_t attached;
@@ -67,8 +74,10 @@ struct bt_bass {
 
 	struct queue *src_cbs;
 	struct queue *cp_handlers;
+	struct queue *ready_cbs;
 
 	unsigned int disconn_id;
+	unsigned int idle_id;
 
 	void *user_data;
 };
@@ -1520,6 +1529,8 @@ static void bass_attach_att(struct bt_bass *bass, struct bt_att *att)
 							bass, NULL);
 }
 
+static void bass_idle(void *data);
+
 bool bt_bass_attach(struct bt_bass *bass, struct bt_gatt_client *client)
 {
 	bt_uuid_t uuid;
@@ -1546,6 +1557,14 @@ bool bt_bass_attach(struct bt_bass *bass, struct bt_gatt_client *client)
 
 	bass_attach_att(bass, bt_gatt_client_get_att(client));
 
+	/* Notify the upper layer once the discovery, reads and
+	 * subscriptions are complete, so it does not attempt any
+	 * operation before it is able to receive the notifications it
+	 * would generate.
+	 */
+	bass->idle_id = bt_gatt_client_idle_register(bass->client, bass_idle,
+								bass, NULL);
+
 	bt_uuid16_create(&uuid, BASS_UUID);
 	gatt_db_foreach_service(bass->rdb->db, &uuid, foreach_bass_service,
 				bass);
@@ -1584,6 +1603,11 @@ void bt_bass_detach(struct bt_bass *bass)
 
 	bt_att_unregister_disconnect(att, bass->disconn_id);
 
+	if (bass->idle_id) {
+		bt_gatt_client_idle_unregister(bass->client, bass->idle_id);
+		bass->idle_id = 0;
+	}
+
 	bt_gatt_client_unref(bass->client);
 	bass->client = NULL;
 
@@ -1605,6 +1629,87 @@ static void bass_db_free(void *data)
 	free(bdb);
 }
 
+static void bass_ready_free(void *data)
+{
+	struct bt_bass_ready *ready = data;
+
+	if (ready->destroy)
+		ready->destroy(ready->data);
+
+	free(ready);
+}
+
+static void bass_notify_ready(struct bt_bass *bass)
+{
+	const struct queue_entry *entry;
+
+	bt_bass_ref(bass);
+
+	for (entry = queue_get_entries(bass->ready_cbs); entry;
+							entry = entry->next) {
+		struct bt_bass_ready *ready = entry->data;
+
+		ready->func(bass, ready->data);
+	}
+
+	bt_bass_unref(bass);
+}
+
+static void bass_idle(void *data)
+{
+	struct bt_bass *bass = data;
+
+	bass->idle_id = 0;
+
+	bass_notify_ready(bass);
+}
+
+unsigned int bt_bass_ready_register(struct bt_bass *bass,
+				bt_bass_ready_func_t func, void *user_data,
+				bt_bass_destroy_func_t destroy)
+{
+	struct bt_bass_ready *ready;
+	static unsigned int id;
+
+	if (!bass)
+		return 0;
+
+	ready = new0(struct bt_bass_ready, 1);
+	ready->id = ++id ? id : ++id;
+	ready->func = func;
+	ready->destroy = destroy;
+	ready->data = user_data;
+
+	queue_push_tail(bass->ready_cbs, ready);
+
+	return ready->id;
+}
+
+static bool match_ready_id(const void *data, const void *match_data)
+{
+	const struct bt_bass_ready *ready = data;
+	unsigned int id = PTR_TO_UINT(match_data);
+
+	return (ready->id == id);
+}
+
+bool bt_bass_ready_unregister(struct bt_bass *bass, unsigned int id)
+{
+	struct bt_bass_ready *ready;
+
+	if (!bass)
+		return false;
+
+	ready = queue_remove_if(bass->ready_cbs, match_ready_id,
+						UINT_TO_PTR(id));
+	if (!ready)
+		return false;
+
+	bass_ready_free(ready);
+
+	return true;
+}
+
 static void bass_free(void *data)
 {
 	struct bt_bass *bass = data;
@@ -1614,6 +1719,7 @@ static void bass_free(void *data)
 	queue_destroy(bass->notify, NULL);
 	queue_destroy(bass->src_cbs, bass_src_changed_free);
 	queue_destroy(bass->cp_handlers, bass_cp_handler_free);
+	queue_destroy(bass->ready_cbs, bass_ready_free);
 
 	free(bass);
 }
@@ -1710,6 +1816,7 @@ struct bt_bass *bt_bass_new(struct gatt_db *ldb, struct gatt_db *rdb,
 	bass->notify = queue_new();
 	bass->src_cbs = queue_new();
 	bass->cp_handlers = queue_new();
+	bass->ready_cbs = queue_new();
 
 	if (!rdb)
 		goto done;
diff --git a/src/shared/bass.h b/src/shared/bass.h
index a7b7741db3b7..b617f85396c6 100644
--- a/src/shared/bass.h
+++ b/src/shared/bass.h
@@ -95,6 +95,7 @@ struct bt_bass_remove_src_params {
 
 typedef void (*bt_bass_func_t)(struct bt_bass *bass, void *user_data);
 typedef void (*bt_bass_destroy_func_t)(void *user_data);
+typedef void (*bt_bass_ready_func_t)(struct bt_bass *bass, void *user_data);
 typedef void (*bt_bass_debug_func_t)(const char *str, void *user_data);
 typedef void (*bt_bass_src_func_t)(uint8_t id, uint32_t bid, uint8_t enc,
 				   uint8_t state, uint32_t bis_sync,
@@ -116,6 +117,11 @@ bool bt_bass_set_user_data(struct bt_bass *bass, void *user_data);
 struct bt_bass *bt_bass_ref(struct bt_bass *bass);
 void bt_bass_unref(struct bt_bass *bass);
 bool bt_bass_attach(struct bt_bass *bass, struct bt_gatt_client *client);
+
+unsigned int bt_bass_ready_register(struct bt_bass *bass,
+				bt_bass_ready_func_t func, void *user_data,
+				bt_bass_destroy_func_t destroy);
+bool bt_bass_ready_unregister(struct bt_bass *bass, unsigned int id);
 bool bt_bass_set_att(struct bt_bass *bass, struct bt_att *att);
 void bt_bass_detach(struct bt_bass *bass);
 void bt_bass_add_db(struct gatt_db *db, const bdaddr_t *adapter_bdaddr);
-- 
2.55.0

RE: Cover a BAP stream to a coordinated set

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 850 bytes --]

This is an automated email and please do not reply to this email.

Dear Submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
While preparing the CI tests, the patches you submitted couldn't be applied to the current HEAD of the repository.

----- Output -----

error: patch failed: test/functional/conftest.py:2
error: test/functional/conftest.py: patch does not apply
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config set advice.mergeConflict false"

Please resolve the issue and submit the patches again.


---
Regards,
Linux Bluetooth

RE: Cover a BAP stream to a coordinated set

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 102252 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1165926/

---Test result---

Test Summary:
CheckPatch                    PASS      19.73 seconds
GitLint                       FAIL      2.55 seconds
BuildEll                      PASS      15.74 seconds
BluezMake                     PASS      286.34 seconds
MakeCheck                     PASS      13.44 seconds
MakeDistcheck                 PASS      119.58 seconds
CheckValgrind                 PASS      188.86 seconds
CheckSmatch                   WARNING   225.59 seconds
bluezmakeextell               PASS      71.40 seconds
TestFunctional                FAIL      908.91 seconds
IncrementalBuild              PASS      305.14 seconds
ScanBuild                     PASS      802.64 seconds

Details
##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
[BlueZ,v1,04/11] test: functional: answer the notification registered by the victim

1: T1 Title exceeds max length (83>80): "[BlueZ,v1,04/11] test: functional: answer the notification registered by the victim"
##############################
Test: CheckSmatch - WARNING
Desc: Run smatch tool with source
Output:
emulator/btdev.c:481:29: warning: Variable length array is used.emulator/btdev.c:481:29: warning: Variable length array is used.
##############################
Test: TestFunctional - FAIL
Desc: Run test-functional
Output:
FAIL functional.test_bap::test_bap_unicast_set_transport_created[hosts7-vm3]: failed on teardown with "pytest_bluezenv.plugin.CoredumpWarning: Core dump: test-bluezenv-hosts7.0-bluetoothd-1789518918-51.core
        /usr/bin/gdb: warning: Couldn't determine a path for the index cache directory.
        [New LWP 51]
        [Thread debugging using libthread_db enabled]
        Using host libthread_db library "/usr/lib/x86_64-linux-gnu/libthread_db.so.1".
        Core was generated by `/home/runner/work/bluez/bluez/src/src/src/bluetoothd --nodetach -f /run/bluetoo'.
        Program terminated with signal SIGABRT, Aborted.
        #0  __pthread_kill_implementation (threadid=<optimized out>, signo=6, no_tid=0) at ./nptl/pthread_kill.c:44

        warning: 44	./nptl/pthread_kill.c: No such file or directory

        Thread 1 (Thread 0x7f05cc9f8900 (LWP 51)):
        #0  __pthread_kill_implementation (threadid=<optimized out>, signo=6, no_tid=0) at ./nptl/pthread_kill.c:44
                tid = <optimized out>
                ret = 0
                pd = <optimized out>
                old_mask = {__val = {0}}
                ret = <optimized out>
        #1  __pthread_kill_internal (threadid=<optimized out>, signo=6) at ./nptl/pthread_kill.c:89
        No locals.
        #2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ./nptl/pthread_kill.c:100
        No locals.
        #3  0x00007f05cd153b7e in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
                ret = <optimized out>
        #4  0x00007f05cd1368ec in __GI_abort () at ./stdlib/abort.c:77
                act = {__sigaction_handler = {sa_handler = 0x0, sa_sigaction = 0x0}, sa_mask = {__val = {0 <repeats 16 times>}}, sa_flags = 0, sa_restorer = 0x0}
        #5  0x00007f05cdd5ea0f in __sanitizer::Abort () at ../../../../src/libsanitizer/sanitizer_common/sanitizer_posix_libcdep.cpp:165
        No locals.
        #6  0x00007f05cde84c2d in __sanitizer::Die () at ../../../../src/libsanitizer/sanitizer_common/sanitizer_termination.cpp:58
        No locals.
        #7  0x00007f05cde5993c in __asan::ScopedInErrorReport::~ScopedInErrorReport (this=0x7fffc84a8e96) at ../../../../src/libsanitizer/asan/asan_report.cpp:221
                buffer_copy = {buffer_ = {<__sanitizer::InternalMmapVectorNoCtor<char, false>> = {data_ = 0x7f05cc603000 '=' <repeats 65 times>, "\n==51==ERROR: AddressSanitizer: heap-use-after-free on address 0x7c75cbee040b at pc 0x7f05cde0e445 bp 0x7fffc84aa390 sp 0x7fffc84a9b38\n"..., capacity_bytes_ = 4096, size_ = 3838}, <No data fields>}}
                buffer_copy = <optimized out>
                l = <optimized out>
        #8  0x00007f05cde58e02 in __asan::ReportGenericError (pc=139662905631813, bp=140736553722768, sp=sp@entry=140736553720632, addr=addr@entry=136845374391307, is_write=is_write@entry=false, access_size=6, fatal=false, exp=<optimized out>) at ../../../../src/libsanitizer/asan/asan_report.cpp:536
                in_report = {error_report_lock_ = {<No data fields>}, static current_error_ = {kind = __asan::kErrorKindGeneric, {Base = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\377\177\000\000\002\000\000\000bluetoothd[5\000\371\020\212\322\373|\347nal] org`\231J\310\377\177\000\000\020\217J\310\377\177\000\000.l#\315\005\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\220\227J\310\377\177\000\000\211M\032\315\005\177\000\000L\217J\310\377\177\000\000L\217J\310\377\177\000\000L\227J\310\377\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\005\177\000\000\002\000\000\000bluetoothd[51]: [signal] org.fre"...}, tid = 0}, DeadlySignal = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\377\177\000\000\002\000\000\000bluetoothd[5\000\371\020\212\322\373|\347nal] org`\231J\310\377\177\000\000\020\217J\310\377\177\000\000.l#\315\005\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\220\227J\310\377\177\000\000\211M\032\315\005\177\000\000L\217J\310\377\177\000\000L\217J\310\377\177\000\000L\227J\310\377\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\005\177\000\000\002\000\000\000bluetoothd[51]: [signal] org.fre"...}, tid = 0}, signal = {siginfo = 0xffffffff00000002, context = 0x7c75cbee040b, addr = 0, pc = 0, sp = 11493332485693, bp = 136845374391307, is_memory_access = 11, write_flag = __sanitizer::SignalContext::Unknown, is_true_faulting_addr = false}}, DoubleFree = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\377\177\000\000\002\000\000\000bluetoothd[5\000\371\020\212\322\373|\347nal] org`\231J\310\377\177\000\000\020\217J\310\377\177\000\000.l#\315\005\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\220\227J\310\377\177\000\000\211M\032\315\005\177\000\000L\217J\310\377\177\000\000L\217J\310\377\177\000\000L\227J\310\377\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\005\177\000\000\002\000\000\000bluetoothd[51]: [signal] org.fre"...}, tid = 0}, second_free_stack = 0xffffffff00000002, addr_description = {addr = 136845374391307, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1597, free_stack_id = 2676, chunk_access = {bad_addr = 136845374391307, offset = 11, chunk_begin = 136845374391296, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}}, NewDeleteTypeMismatch = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\377\177\000\000\002\000\000\000bluetoothd[5\000\371\020\212\322\373|\347nal] org`\231J\310\377\177\000\000\020\217J\310\377\177\000\000.l#\315\005\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\220\227J\310\377\177\000\000\211M\032\315\005\177\000\000L\217J\310\377\177\000\000L\217J\310\377\177\000\000L\227J\310\377\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\005\177\000\000\002\000\000\000bluetoothd[51]: [signal] org.fre"...}, tid = 0}, free_stack = 0xffffffff00000002, addr_description = {addr = 136845374391307, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1597, free_stack_id = 2676, chunk_access = {bad_addr = 136845374391307, offset = 11, chunk_begin = 136845374391296, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, delete_size = 135264807845024, delete_alignment = 140736553718560}, FreeNotMalloced = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\377\177\000\000\002\000\000\000bluetoothd[5\000\371\020\212\322\373|\347nal] org`\231J\310\377\177\000\000\020\217J\310\377\177\000\000.l#\315\005\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\220\227J\310\377\177\000\000\211M\032\315\005\177\000\000L\217J\310\377\177\000\000L\217J\310\377\177\000\000L\227J\310\377\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\005\177\000\000\002\000\000\000bluetoothd[51]: [signal] org.fre"...}, tid = 0}, free_stack = 0xffffffff00000002, addr_description = {data = {kind = 3421373451, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11493332485693, alloc_stack_id = 3421373451, free_stack_id = 31861, chunk_access = {bad_addr = 11, offset = 136845374391296, chunk_begin = 752, chunk_size = 140736553705480, user_requested_alignment = 3232, access_type = 3, alloc_type = 1}}, stack = {addr = 0, tid = 0, offset = 11493332485693, frame_pc = 136845374391307, access_size = 11, frame_descr = 0x7c75cbee0400 "t\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11493332485693, size_with_redzone = 136845374391307, name = 0xb <error: Cannot access memory at address 0xb>, module_name = 0x7c75cbee0400 "t\n", has_dynamic_init = 752, gcc_location = 0x7fffc84a6008, odr_indicator = 135264807845024}, {beg = 140736553718560, size = 139662904929055, size_with_redzone = 1, name = 0x7b05cad27ca0 "\340n\365\313e{", module_name = 0x7fffc84a9b70 "\200\233J\310\377\177", has_dynamic_init = 139662905886162, gcc_location = 0x7f05cc63e0d0, odr_indicator = 132209349504}, {beg = 140736553718608, size = 3, size_with_redzone = 139662905886224, name = 0x7f05cd1a4b8f <__vasprintf_internal+255> "I\211\004$H\205\300t(H\213\265\330\376\377\377L\211\352H\211\307\350\366\032\371\377H\211\301\353\212\350\254\346\n", module_name = 0x5608285f380b <bt_log_vprintf+171> "\205\300\017\210=\001", has_dynamic_init = 140736553721392, gcc_location = 0x7fffc84a9410, odr_indicator = 2}, {beg = 139662906601408, size = 135677143772688, size_with_redzone = 140736553718752, name = 0x7f05cdd68738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", module_name = 0x3e <error: Cannot access memory at address 0x3e>, has_dynamic_init = 135677143772688, gcc_location = 0x7f05cc63e0d0, odr_indicator = 140736553718784}}, reg_sites = {3421859360, 31589, 81, 0}, access_size = 140736553720944, size = 69 'E'}, wild = {addr = 0, access_size = 0}}}}}, AllocTypeMismatch = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\377\177\000\000\002\000\000\000bluetoothd[5\000\371\020\212\322\373|\347nal] org`\231J\310\377\177\000\000\020\217J\310\377\177\000\000.l#\315\005\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\220\227J\310\377\177\000\000\211M\032\315\005\177\000\000L\217J\310\377\177\000\000L\217J\310\377\177\000\000L\227J\310\377\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\005\177\000\000\002\000\000\000bluetoothd[51]: [signal] org.fre"...}, tid = 0}, dealloc_stack = 0xffffffff00000002, alloc_type = 3421373451, dealloc_type = 31861, addr_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 0, kind = (__asan::kShadowKindGap | unknown: 0x3c), shadow_byte = 6 '\006'}, heap = {addr = 0, alloc_tid = 11493332485693, free_tid = 136845374391307, alloc_stack_id = 11, free_stack_id = 0, chunk_access = {bad_addr = 136845374391296, offset = 752, chunk_begin = 140736553705480, chunk_size = 135264807845024, user_requested_alignment = 800, access_type = 1, alloc_type = 2}}, stack = {addr = 0, tid = 11493332485693, offset = 136845374391307, frame_pc = 11, access_size = 136845374391296, frame_descr = 0x2f0 <error: Cannot access memory at address 0x2f0>}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 11493332485693, size = 136845374391307, size_with_redzone = 11, name = 0x7c75cbee0400 "t\n", module_name = 0x2f0 <error: Cannot access memory at address 0x2f0>, has_dynamic_init = 140736553705480, gcc_location = 0x7b05cad27ca0, odr_indicator = 140736553718560}, {beg = 139662904929055, size = 1, size_with_redzone = 135264807845024, name = 0x7fffc84a9b70 "\200\233J\310\377\177", module_name = 0x7f05cde4c5d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", has_dynamic_init = 139662880661712, gcc_location = 0x1ec84a9380, odr_indicator = 140736553718608}, {beg = 3, size = 139662905886224, size_with_redzone = 139662892616591, name = 0x5608285f380b <bt_log_vprintf+171> "\205\300\017\210=\001", module_name = 0x7fffc84a9e30 "\324\237J\310\377\177", has_dynamic_init = 140736553718800, gcc_location = 0x2, odr_indicator = 139662906601408}, {beg = 135677143772688, size = 140736553718752, size_with_redzone = 139662904952632, name = 0x3e <error: Cannot access memory at address 0x3e>, module_name = 0x7b65cbf56e10 "\003\021", has_dynamic_init = 139662880661712, gcc_location = 0x7fffc84a9400, odr_indicator = 135677143772704}}, reg_sites = {81, 0, 3360332912, 32767}, access_size = 139662905631813, size = 144 '\220'}, wild = {addr = 0, access_size = 11493332485693}}}}}, MallocUsableSizeNotOwned = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\377\177\000\000\002\000\000\000bluetoothd[5\000\371\020\212\322\373|\347nal] org`\231J\310\377\177\000\000\020\217J\310\377\177\000\000.l#\315\005\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\220\227J\310\377\177\000\000\211M\032\315\005\177\000\000L\217J\310\377\177\000\000L\217J\310\377\177\000\000L\227J\310\377\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\005\177\000\000\002\000\000\000bluetoothd[51]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, addr_description = {data = {kind = 3421373451, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11493332485693, alloc_stack_id = 3421373451, free_stack_id = 31861, chunk_access = {bad_addr = 11, offset = 136845374391296, chunk_begin = 752, chunk_size = 140736553705480, user_requested_alignment = 3232, access_type = 3, alloc_type = 1}}, stack = {addr = 0, tid = 0, offset = 11493332485693, frame_pc = 136845374391307, access_size = 11, frame_descr = 0x7c75cbee0400 "t\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11493332485693, size_with_redzone = 136845374391307, name = 0xb <error: Cannot access memory at address 0xb>, module_name = 0x7c75cbee0400 "t\n", has_dynamic_init = 752, gcc_location = 0x7fffc84a6008, odr_indicator = 135264807845024}, {beg = 140736553718560, size = 139662904929055, size_with_redzone = 1, name = 0x7b05cad27ca0 "\340n\365\313e{", module_name = 0x7fffc84a9b70 "\200\233J\310\377\177", has_dynamic_init = 139662905886162, gcc_location = 0x7f05cc63e0d0, odr_indicator = 132209349504}, {beg = 140736553718608, size = 3, size_with_redzone = 139662905886224, name = 0x7f05cd1a4b8f <__vasprintf_internal+255> "I\211\004$H\205\300t(H\213\265\330\376\377\377L\211\352H\211\307\350\366\032\371\377H\211\301\353\212\350\254\346\n", module_name = 0x5608285f380b <bt_log_vprintf+171> "\205\300\017\210=\001", has_dynamic_init = 140736553721392, gcc_location = 0x7fffc84a9410, odr_indicator = 2}, {beg = 139662906601408, size = 135677143772688, size_with_redzone = 140736553718752, name = 0x7f05cdd68738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", module_name = 0x3e <error: Cannot access memory at address 0x3e>, has_dynamic_init = 135677143772688, gcc_location = 0x7f05cc63e0d0, odr_indicator = 140736553718784}}, reg_sites = {3421859360, 31589, 81, 0}, access_size = 140736553720944, size = 69 'E'}, wild = {addr = 0, access_size = 0}}}}}, SanitizerGetAllocatedSizeNotOwned = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\377\177\000\000\002\000\000\000bluetoothd[5\000\371\020\212\322\373|\347nal] org`\231J\310\377\177\000\000\020\217J\310\377\177\000\000.l#\315\005\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\220\227J\310\377\177\000\000\211M\032\315\005\177\000\000L\217J\310\377\177\000\000L\217J\310\377\177\000\000L\227J\310\377\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\005\177\000\000\002\000\000\000bluetoothd[51]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, addr_description = {data = {kind = 3421373451, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11493332485693, alloc_stack_id = 3421373451, free_stack_id = 31861, chunk_access = {bad_addr = 11, offset = 136845374391296, chunk_begin = 752, chunk_size = 140736553705480, user_requested_alignment = 3232, access_type = 3, alloc_type = 1}}, stack = {addr = 0, tid = 0, offset = 11493332485693, frame_pc = 136845374391307, access_size = 11, frame_descr = 0x7c75cbee0400 "t\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11493332485693, size_with_redzone = 136845374391307, name = 0xb <error: Cannot access memory at address 0xb>, module_name = 0x7c75cbee0400 "t\n", has_dynamic_init = 752, gcc_location = 0x7fffc84a6008, odr_indicator = 135264807845024}, {beg = 140736553718560, size = 139662904929055, size_with_redzone = 1, name = 0x7b05cad27ca0 "\340n\365\313e{", module_name = 0x7fffc84a9b70 "\200\233J\310\377\177", has_dynamic_init = 139662905886162, gcc_location = 0x7f05cc63e0d0, odr_indicator = 132209349504}, {beg = 140736553718608, size = 3, size_with_redzone = 139662905886224, name = 0x7f05cd1a4b8f <__vasprintf_internal+255> "I\211\004$H\205\300t(H\213\265\330\376\377\377L\211\352H\211\307\350\366\032\371\377H\211\301\353\212\350\254\346\n", module_name = 0x5608285f380b <bt_log_vprintf+171> "\205\300\017\210=\001", has_dynamic_init = 140736553721392, gcc_location = 0x7fffc84a9410, odr_indicator = 2}, {beg = 139662906601408, size = 135677143772688, size_with_redzone = 140736553718752, name = 0x7f05cdd68738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", module_name = 0x3e <error: Cannot access memory at address 0x3e>, has_dynamic_init = 135677143772688, gcc_location = 0x7f05cc63e0d0, odr_indicator = 140736553718784}}, reg_sites = {3421859360, 31589, 81, 0}, access_size = 140736553720944, size = 69 'E'}, wild = {addr = 0, access_size = 0}}}}}, CallocOverflow = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\377\177\000\000\002\000\000\000bluetoothd[5\000\371\020\212\322\373|\347nal] org`\231J\310\377\177\000\000\020\217J\310\377\177\000\000.l#\315\005\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\220\227J\310\377\177\000\000\211M\032\315\005\177\000\000L\217J\310\377\177\000\000L\217J\310\377\177\000\000L\227J\310\377\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\005\177\000\000\002\000\000\000bluetoothd[51]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, count = 136845374391307, size = 0}, ReallocArrayOverflow = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\377\177\000\000\002\000\000\000bluetoothd[5\000\371\020\212\322\373|\347nal] org`\231J\310\377\177\000\000\020\217J\310\377\177\000\000.l#\315\005\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\220\227J\310\377\177\000\000\211M\032\315\005\177\000\000L\217J\310\377\177\000\000L\217J\310\377\177\000\000L\227J\310\377\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\005\177\000\000\002\000\000\000bluetoothd[51]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, count = 136845374391307, size = 0}, PvallocOverflow = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\377\177\000\000\002\000\000\000bluetoothd[5\000\371\020\212\322\373|\347nal] org`\231J\310\377\177\000\000\020\217J\310\377\177\000\000.l#\315\005\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\220\227J\310\377\177\000\000\211M\032\315\005\177\000\000L\217J\310\377\177\000\000L\217J\310\377\177\000\000L\227J\310\377\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\005\177\000\000\002\000\000\000bluetoothd[51]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, size = 136845374391307}, InvalidAllocationAlignment = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\377\177\000\000\002\000\000\000bluetoothd[5\000\371\020\212\322\373|\347nal] org`\231J\310\377\177\000\000\020\217J\310\377\177\000\000.l#\315\005\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\220\227J\310\377\177\000\000\211M\032\315\005\177\000\000L\217J\310\377\177\000\000L\217J\310\377\177\000\000L\227J\310\377\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\005\177\000\000\002\000\000\000bluetoothd[51]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, alignment = 136845374391307}, InvalidAlignedAllocAlignment = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\377\177\000\000\002\000\000\000bluetoothd[5\000\371\020\212\322\373|\347nal] org`\231J\310\377\177\000\000\020\217J\310\377\177\000\000.l#\315\005\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\220\227J\310\377\177\000\000\211M\032\315\005\177\000\000L\217J\310\377\177\000\000L\217J\310\377\177\000\000L\227J\310\377\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\005\177\000\000\002\000\000\000bluetoothd[51]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, size = 136845374391307, alignment = 0}, InvalidPosixMemalignAlignment = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\377\177\000\000\002\000\000\000bluetoothd[5\000\371\020\212\322\373|\347nal] org`\231J\310\377\177\000\000\020\217J\310\377\177\000\000.l#\315\005\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\220\227J\310\377\177\000\000\211M\032\315\005\177\000\000L\217J\310\377\177\000\000L\217J\310\377\177\000\000L\227J\310\377\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\005\177\000\000\002\000\000\000bluetoothd[51]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, alignment = 136845374391307}, AllocationSizeTooBig = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\377\177\000\000\002\000\000\000bluetoothd[5\000\371\020\212\322\373|\347nal] org`\231J\310\377\177\000\000\020\217J\310\377\177\000\000.l#\315\005\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\220\227J\310\377\177\000\000\211M\032\315\005\177\000\000L\217J\310\377\177\000\000L\217J\310\377\177\000\000L\227J\310\377\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\005\177\000\000\002\000\000\000bluetoothd[51]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, user_size = 136845374391307, total_size = 0, max_size = 0}, RssLimitExceeded = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\377\177\000\000\002\000\000\000bluetoothd[5\000\371\020\212\322\373|\347nal] org`\231J\310\377\177\000\000\020\217J\310\377\177\000\000.l#\315\005\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\220\227J\310\377\177\000\000\211M\032\315\005\177\000\000L\217J\310\377\177\000\000L\217J\310\377\177\000\000L\227J\310\377\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\005\177\000\000\002\000\000\000bluetoothd[51]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002}, OutOfMemory = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\377\177\000\000\002\000\000\000bluetoothd[5\000\371\020\212\322\373|\347nal] org`\231J\310\377\177\000\000\020\217J\310\377\177\000\000.l#\315\005\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\220\227J\310\377\177\000\000\211M\032\315\005\177\000\000L\217J\310\377\177\000\000L\217J\310\377\177\000\000L\227J\310\377\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\005\177\000\000\002\000\000\000bluetoothd[51]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, requested_size = 136845374391307}, StringFunctionMemoryRangesOverlap = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\377\177\000\000\002\000\000\000bluetoothd[5\000\371\020\212\322\373|\347nal] org`\231J\310\377\177\000\000\020\217J\310\377\177\000\000.l#\315\005\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\220\227J\310\377\177\000\000\211M\032\315\005\177\000\000L\217J\310\377\177\000\000L\217J\310\377\177\000\000L\227J\310\377\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\005\177\000\000\002\000\000\000bluetoothd[51]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, length1 = 136845374391307, length2 = 0, addr1_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 11493332485693, kind = (__asan::kShadowKindGap | __asan::kShadowKindHigh | unknown: 0x8), shadow_byte = 4 '\004'}, heap = {addr = 11493332485693, alloc_tid = 136845374391307, free_tid = 11, alloc_stack_id = 3421373440, free_stack_id = 31861, chunk_access = {bad_addr = 752, offset = 140736553705480, chunk_begin = 135264807845024, chunk_size = 140736553718560, user_requested_alignment = 2847, access_type = 2, alloc_type = 0}}, stack = {addr = 11493332485693, tid = 136845374391307, offset = 11, frame_pc = 136845374391296, access_size = 752, frame_descr = 0x7fffc84a6008 "\200\3000\313\005{"}, global = {addr = 11493332485693, static kMaxGlobals = 4, globals = {{beg = 136845374391307, size = 11, size_with_redzone = 136845374391296, name = 0x2f0 <error: Cannot access memory at address 0x2f0>, module_name = 0x7fffc84a6008 "\200\3000\313\005{", has_dynamic_init = 135264807845024, gcc_location = 0x7fffc84a9320, odr_indicator = 139662904929055}, {beg = 1, size = 135264807845024, size_with_redzone = 140736553720688, name = 0x7f05cde4c5d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", module_name = 0x7f05cc63e0d0 "", has_dynamic_init = 132209349504, gcc_location = 0x7fffc84a9350, odr_indicator = 3}, {beg = 139662905886224, size = 139662892616591, size_with_redzone = 94593037056011, name = 0x7fffc84a9e30 "\324\237J\310\377\177", module_name = 0x7fffc84a9410 "\030", has_dynamic_init = 2, gcc_location = 0x7f05cdefafc0 <__asan::instance>, odr_indicator = 135677143772688}, {beg = 140736553718752, size = 139662904952632, size_with_redzone = 62, name = 0x7b65cbf56e10 "\003\021", module_name = 0x7f05cc63e0d0 "", has_dynamic_init = 140736553718784, gcc_location = 0x7b65cbf56e20, odr_indicator = 81}}, reg_sites = {3360332912, 32767, 3454067781, 32517}, access_size = 140736553722768, size = 56 '8'}, wild = {addr = 11493332485693, access_size = 136845374391307}}}}, addr2_description = {data = {kind = 6, {shadow = {addr = 139662906312599, kind = __asan::kShadowKindLow, shadow_byte = 253 '\375'}, heap = {addr = 139662906312599, alloc_tid = 139662906621184, free_tid = 140736553722320, alloc_stack_id = 3454322130, free_stack_id = 32517, chunk_access = {bad_addr = 8315162673665959470, offset = 130735371371, chunk_begin = 140736553720240, chunk_size = 3, user_requested_alignment = 1552, access_type = 0, alloc_type = 3}}, stack = {addr = 139662906312599, tid = 139662906621184, offset = 140736553722320, frame_pc = 139662905886162, access_size = 8315162673665959470, frame_descr = 0x1e706f746b <error: Cannot access memory at address 0x1e706f746b>}, global = {addr = 139662906312599, static kMaxGlobals = 4, globals = {{beg = 139662906621184, size = 140736553722320, size_with_redzone = 139662905886162, name = 0x736564656572662e <error: Cannot access memory at address 0x736564656572662e>, module_name = 0x1e706f746b <error: Cannot access memory at address 0x1e706f746b>, has_dynamic_init = 140736553720240, gcc_location = 0x3, odr_indicator = 139662905886224}, {beg = 139662892616591, size = 94593037056011, size_with_redzone = 140736553723024, name = 0x7fffc84a9a30 "P\232J\310\377\177", module_name = 0x7f05cdef4f78 "\001", has_dynamic_init = 140736553720432, gcc_location = 0x5608287345c0, odr_indicator = 139662884571320}, {beg = 65535, size = 140736553720352, size_with_redzone = 139662905717593, name = 0x40 <error: Cannot access memory at address 0x40>, module_name = 0x7b05caf4d200 "\0166\340E", has_dynamic_init = 140736553720400, gcc_location = 0x7f05cdd6f74a <__asan_stack_malloc_0(__sanitizer::uptr)+234>, odr_indicator = 140736553720400}, {beg = 139662906142589, size = 140736553720432, size_with_redzone = 139662905986406, name = 0x7fffc84a9af0 "", module_name = 0x2 <error: Cannot access memory at address 0x2>, has_dynamic_init = 139662906601408, gcc_location = 0x7b45cbf48e80, odr_indicator = 140736553720512}}, reg_sites = {3453388600, 32517, 40, 0}, access_size = 139662906092061, size = 208 '\320'}, wild = {addr = 139662906312599, access_size = 139662906621184}}}}, function = 0x7fffc84a9ae0 "\220\243J\310\377\177"}, StringFunctionSizeOverflow = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\377\177\000\000\002\000\000\000bluetoothd[5\000\371\020\212\322\373|\347nal] org`\231J\310\377\177\000\000\020\217J\310\377\177\000\000.l#\315\005\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\220\227J\310\377\177\000\000\211M\032\315\005\177\000\000L\217J\310\377\177\000\000L\217J\310\377\177\000\000L\227J\310\377\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\005\177\000\000\002\000\000\000bluetoothd[51]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, addr_description = {data = {kind = 3421373451, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11493332485693, alloc_stack_id = 3421373451, free_stack_id = 31861, chunk_access = {bad_addr = 11, offset = 136845374391296, chunk_begin = 752, chunk_size = 140736553705480, user_requested_alignment = 3232, access_type = 3, alloc_type = 1}}, stack = {addr = 0, tid = 0, offset = 11493332485693, frame_pc = 136845374391307, access_size = 11, frame_descr = 0x7c75cbee0400 "t\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11493332485693, size_with_redzone = 136845374391307, name = 0xb <error: Cannot access memory at address 0xb>, module_name = 0x7c75cbee0400 "t\n", has_dynamic_init = 752, gcc_location = 0x7fffc84a6008, odr_indicator = 135264807845024}, {beg = 140736553718560, size = 139662904929055, size_with_redzone = 1, name = 0x7b05cad27ca0 "\340n\365\313e{", module_name = 0x7fffc84a9b70 "\200\233J\310\377\177", has_dynamic_init = 139662905886162, gcc_location = 0x7f05cc63e0d0, odr_indicator = 132209349504}, {beg = 140736553718608, size = 3, size_with_redzone = 139662905886224, name = 0x7f05cd1a4b8f <__vasprintf_internal+255> "I\211\004$H\205\300t(H\213\265\330\376\377\377L\211\352H\211\307\350\366\032\371\377H\211\301\353\212\350\254\346\n", module_name = 0x5608285f380b <bt_log_vprintf+171> "\205\300\017\210=\001", has_dynamic_init = 140736553721392, gcc_location = 0x7fffc84a9410, odr_indicator = 2}, {beg = 139662906601408, size = 135677143772688, size_with_redzone = 140736553718752, name = 0x7f05cdd68738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", module_name = 0x3e <error: Cannot access memory at address 0x3e>, has_dynamic_init = 135677143772688, gcc_location = 0x7f05cc63e0d0, odr_indicator = 140736553718784}}, reg_sites = {3421859360, 31589, 81, 0}, access_size = 140736553720944, size = 69 'E'}, wild = {addr = 0, access_size = 0}}}}, size = 140736553722768}, BadParamsToAnnotateContiguousContainer = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\377\177\000\000\002\000\000\000bluetoothd[5\000\371\020\212\322\373|\347nal] org`\231J\310\377\177\000\000\020\217J\310\377\177\000\000.l#\315\005\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\220\227J\310\377\177\000\000\211M\032\315\005\177\000\000L\217J\310\377\177\000\000L\217J\310\377\177\000\000L\227J\310\377\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\005\177\000\000\002\000\000\000bluetoothd[51]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, beg = 136845374391307, end = 0, old_mid = 0, new_mid = 11493332485693}, BadParamsToAnnotateDoubleEndedContiguousContainer = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\377\177\000\000\002\000\000\000bluetoothd[5\000\371\020\212\322\373|\347nal] org`\231J\310\377\177\000\000\020\217J\310\377\177\000\000.l#\315\005\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\220\227J\310\377\177\000\000\211M\032\315\005\177\000\000L\217J\310\377\177\000\000L\217J\310\377\177\000\000L\227J\310\377\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\005\177\000\000\002\000\000\000bluetoothd[51]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, storage_beg = 136845374391307, storage_end = 0, old_container_beg = 0, old_container_end = 11493332485693, new_container_beg = 136845374391307, new_container_end = 11}, BadParamsToCopyContiguousContainerAnnotations = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\377\177\000\000\002\000\000\000bluetoothd[5\000\371\020\212\322\373|\347nal] org`\231J\310\377\177\000\000\020\217J\310\377\177\000\000.l#\315\005\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\220\227J\310\377\177\000\000\211M\032\315\005\177\000\000L\217J\310\377\177\000\000L\217J\310\377\177\000\000L\227J\310\377\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\005\177\000\000\002\000\000\000bluetoothd[51]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, old_storage_beg = 136845374391307, old_storage_end = 0, new_storage_beg = 0, new_storage_end = 11493332485693}, ODRViolation = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\377\177\000\000\002\000\000\000bluetoothd[5\000\371\020\212\322\373|\347nal] org`\231J\310\377\177\000\000\020\217J\310\377\177\000\000.l#\315\005\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\220\227J\310\377\177\000\000\211M\032\315\005\177\000\000L\217J\310\377\177\000\000L\217J\310\377\177\000\000L\227J\310\377\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\005\177\000\000\002\000\000\000bluetoothd[51]: [signal] org.fre"...}, tid = 0}, global1 = {beg = 18446744069414584322, size = 136845374391307, size_with_redzone = 0, name = 0x0, module_name = 0xa740000063d <error: Cannot access memory at address 0xa740000063d>, has_dynamic_init = 136845374391307, gcc_location = 0xb, odr_indicator = 136845374391296}, global2 = {beg = 752, size = 140736553705480, size_with_redzone = 135264807845024, name = 0x7fffc84a9320 "p\233J\310\377\177", module_name = 0x7f05cdd62b1f <__asan::asan_malloc(unsigned long, __sanitizer::BufferedStackTrace*)+47> "H\205\300t\f\311\303f.\017\037\204", has_dynamic_init = 1, gcc_location = 0x7b05cad27ca0, odr_indicator = 140736553720688}, stack_id1 = 3454322130, stack_id2 = 32517}, InvalidPointerPair = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\377\177\000\000\002\000\000\000bluetoothd[5\000\371\020\212\322\373|\347nal] org`\231J\310\377\177\000\000\020\217J\310\377\177\000\000.l#\315\005\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\220\227J\310\377\177\000\000\211M\032\315\005\177\000\000L\217J\310\377\177\000\000L\217J\310\377\177\000\000L\227J\310\377\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\005\177\000\000\002\000\000\000bluetoothd[51]: [signal] org.fre"...}, tid = 0}, pc = 18446744069414584322, bp = 136845374391307, sp = 0, addr1_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 11493332485693, kind = (__asan::kShadowKindGap | __asan::kShadowKindHigh | unknown: 0x8), shadow_byte = 4 '\004'}, heap = {addr = 11493332485693, alloc_tid = 136845374391307, free_tid = 11, alloc_stack_id = 3421373440, free_stack_id = 31861, chunk_access = {bad_addr = 752, offset = 140736553705480, chunk_begin = 135264807845024, chunk_size = 140736553718560, user_requested_alignment = 2847, access_type = 2, alloc_type = 0}}, stack = {addr = 11493332485693, tid = 136845374391307, offset = 11, frame_pc = 136845374391296, access_size = 752, frame_descr = 0x7fffc84a6008 "\200\3000\313\005{"}, global = {addr = 11493332485693, static kMaxGlobals = 4, globals = {{beg = 136845374391307, size = 11, size_with_redzone = 136845374391296, name = 0x2f0 <error: Cannot access memory at address 0x2f0>, module_name = 0x7fffc84a6008 "\200\3000\313\005{", has_dynamic_init = 135264807845024, gcc_location = 0x7fffc84a9320, odr_indicator = 139662904929055}, {beg = 1, size = 135264807845024, size_with_redzone = 140736553720688, name = 0x7f05cde4c5d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", module_name = 0x7f05cc63e0d0 "", has_dynamic_init = 132209349504, gcc_location = 0x7fffc84a9350, odr_indicator = 3}, {beg = 139662905886224, size = 139662892616591, size_with_redzone = 94593037056011, name = 0x7fffc84a9e30 "\324\237J\310\377\177", module_name = 0x7fffc84a9410 "\030", has_dynamic_init = 2, gcc_location = 0x7f05cdefafc0 <__asan::instance>, odr_indicator = 135677143772688}, {beg = 140736553718752, size = 139662904952632, size_with_redzone = 62, name = 0x7b65cbf56e10 "\003\021", module_name = 0x7f05cc63e0d0 "", has_dynamic_init = 140736553718784, gcc_location = 0x7b65cbf56e20, odr_indicator = 81}}, reg_sites = {3360332912, 32767, 3454067781, 32517}, access_size = 140736553722768, size = 56 '8'}, wild = {addr = 11493332485693, access_size = 136845374391307}}}}, addr2_description = {data = {kind = 6, {shadow = {addr = 139662906312599, kind = __asan::kShadowKindLow, shadow_byte = 253 '\375'}, heap = {addr = 139662906312599, alloc_tid = 139662906621184, free_tid = 140736553722320, alloc_stack_id = 3454322130, free_stack_id = 32517, chunk_access = {bad_addr = 8315162673665959470, offset = 130735371371, chunk_begin = 140736553720240, chunk_size = 3, user_requested_alignment = 1552, access_type = 0, alloc_type = 3}}, stack = {addr = 139662906312599, tid = 139662906621184, offset = 140736553722320, frame_pc = 139662905886162, access_size = 8315162673665959470, frame_descr = 0x1e706f746b <error: Cannot access memory at address 0x1e706f746b>}, global = {addr = 139662906312599, static kMaxGlobals = 4, globals = {{beg = 139662906621184, size = 140736553722320, size_with_redzone = 139662905886162, name = 0x736564656572662e <error: Cannot access memory at address 0x736564656572662e>, module_name = 0x1e706f746b <error: Cannot access memory at address 0x1e706f746b>, has_dynamic_init = 140736553720240, gcc_location = 0x3, odr_indicator = 139662905886224}, {beg = 139662892616591, size = 94593037056011, size_with_redzone = 140736553723024, name = 0x7fffc84a9a30 "P\232J\310\377\177", module_name = 0x7f05cdef4f78 "\001", has_dynamic_init = 140736553720432, gcc_location = 0x5608287345c0, odr_indicator = 139662884571320}, {beg = 65535, size = 140736553720352, size_with_redzone = 139662905717593, name = 0x40 <error: Cannot access memory at address 0x40>, module_name = 0x7b05caf4d200 "\0166\340E", has_dynamic_init = 140736553720400, gcc_location = 0x7f05cdd6f74a <__asan_stack_malloc_0(__sanitizer::uptr)+234>, odr_indicator = 140736553720400}, {beg = 139662906142589, size = 140736553720432, size_with_redzone = 139662905986406, name = 0x7fffc84a9af0 "", module_name = 0x2 <error: Cannot access memory at address 0x2>, has_dynamic_init = 139662906601408, gcc_location = 0x7b45cbf48e80, odr_indicator = 140736553720512}}, reg_sites = {3453388600, 32517, 40, 0}, access_size = 139662906092061, size = 208 '\320'}, wild = {addr = 139662906312599, access_size = 139662906621184}}}}}, Generic = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\377\177\000\000\002\000\000\000bluetoothd[5\000\371\020\212\322\373|\347nal] org`\231J\310\377\177\000\000\020\217J\310\377\177\000\000.l#\315\005\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\220\227J\310\377\177\000\000\211M\032\315\005\177\000\000L\217J\310\377\177\000\000L\217J\310\377\177\000\000L\227J\310\377\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\005\177\000\000\002\000\000\000bluetoothd[51]: [signal] org.fre"...}, tid = 0}, addr_description = {data = {kind = __asan::kAddressKindHeap, {shadow = {addr = 136845374391307, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 136845374391307, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1597, free_stack_id = 2676, chunk_access = {bad_addr = 136845374391307, offset = 11, chunk_begin = 136845374391296, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, stack = {addr = 136845374391307, tid = 0, offset = 0, frame_pc = 11493332485693, access_size = 136845374391307, frame_descr = 0xb <error: Cannot access memory at address 0xb>}, global = {addr = 136845374391307, static kMaxGlobals = 4, globals = {{beg = 0, size = 0, size_with_redzone = 11493332485693, name = 0x7c75cbee040b "B", module_name = 0xb <error: Cannot access memory at address 0xb>, has_dynamic_init = 136845374391296, gcc_location = 0x2f0, odr_indicator = 140736553705480}, {beg = 135264807845024, size = 140736553718560, size_with_redzone = 139662904929055, name = 0x1 <error: Cannot access memory at address 0x1>, module_name = 0x7b05cad27ca0 "\340n\365\313e{", has_dynamic_init = 140736553720688, gcc_location = 0x7f05cde4c5d2 <___interceptor_malloc(__sanitizer::uptr)+130>, odr_indicator = 139662880661712}, {beg = 132209349504, size = 140736553718608, size_with_redzone = 3, name = 0x7f05cde4c610 <___interceptor_malloc(__sanitizer::uptr)+192> "D\213\215\314\367\377\377E\205\311tTH\211m\330A\203\371\001t*E\017\276\3061\311H\211\352H\211\306H\215\275\320\367\377\377\350\"\004\001", module_name = 0x7f05cd1a4b8f <__vasprintf_internal+255> "I\211\004$H\205\300t(H\213\265\330\376\377\377L\211\352H\211\307\350\366\032\371\377H\211\301\353\212\350\254\346\n", has_dynamic_init = 94593037056011, gcc_location = 0x7fffc84a9e30, odr_indicator = 140736553718800}, {beg = 2, size = 139662906601408, size_with_redzone = 135677143772688, name = 0x7fffc84a93e0 "\220\243J\310\377\177", module_name = 0x7f05cdd68738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", has_dynamic_init = 62, gcc_location = 0x7b65cbf56e10, odr_indicator = 139662880661712}}, reg_sites = {3360330752, 32767, 3421859360, 31589}, access_size = 81, size = 112 'p'}, wild = {addr = 136845374391307, access_size = 0}}}}, pc = 139662905631813, bp = 140736553722768, sp = 140736553720632, access_size = 6, bug_descr = 0x7f05cdeb4797 "heap-use-after-free", is_write = false, shadow_val = 253 '\375'}}}, halt_on_error_ = true}
                error = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\377\177\000\000\002\000\000\000bluetoothd[5\000\371\020\212\322\373|\347nal] org`\231J\310\377\177\000\000\020\217J\310\377\177\000\000.l#\315\005\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\220\227J\310\377\177\000\000\211M\032\315\005\177\000\000L\217J\310\377\177\000\000L\217J\310\377\177\000\000L\227J\310\377\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\005\177\000\000\002\000\000\000bluetoothd[51]: [signal] org.fre"...}, tid = 0}, addr_description = {data = {kind = __asan::kAddressKindHeap, {shadow = {addr = 136845374391307, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 136845374391307, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1597, free_stack_id = 2676, chunk_access = {bad_addr = 136845374391307, offset = 11, chunk_begin = 136845374391296, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, stack = {addr = 136845374391307, tid = 0, offset = 0, frame_pc = 11493332485693, access_size = 136845374391307, frame_descr = 0xb <error: Cannot access memory at address 0xb>}, global = {addr = 136845374391307, static kMaxGlobals = 4, globals = {{beg = 0, size = 0, size_with_redzone = 11493332485693, name = 0x7c75cbee040b "B", module_name = 0xb <error: Cannot access memory at address 0xb>, has_dynamic_init = 136845374391296, gcc_location = 0x2f0, odr_indicator = 140736553705480}, {beg = 135264807845024, size = 140736553718560, size_with_redzone = 139662904929055, name = 0x1 <error: Cannot access memory at address 0x1>, module_name = 0x7b05cad27ca0 "\340n\365\313e{", has_dynamic_init = 140736553720688, gcc_location = 0x7f05cde4c5d2 <___interceptor_malloc(__sanitizer::uptr)+130>, odr_indicator = 139662880661712}, {beg = 132209349504, size = 140736553718608, size_with_redzone = 3, name = 0x7f05cde4c610 <___interceptor_malloc(__sanitizer::uptr)+192> "D\213\215\314\367\377\377E\205\311tTH\211m\330A\203\371\001t*E\017\276\3061\311H\211\352H\211\306H\215\275\320\367\377\377\350\"\004\001", module_name = 0x7f05cd1a4b8f <__vasprintf_internal+255> "I\211\004$H\205\300t(H\213\265\330\376\377\377L\211\352H\211\307\350\366\032\371\377H\211\301\353\212\350\254\346\n", has_dynamic_init = 94593037056011, gcc_location = 0x7fffc84a9e30, odr_indicator = 140736553718800}, {beg = 2, size = 139662906601408, size_with_redzone = 135677143772688, name = 0x7fffc84a93e0 "\220\243J\310\377\177", module_name = 0x7f05cdd68738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", has_dynamic_init = 62, gcc_location = 0x7b65cbf56e10, odr_indicator = 139662880661712}}, reg_sites = {3360330752, 32767, 3421859360, 31589}, access_size = 81, size = 112 'p'}, wild = {addr = 136845374391307, access_size = 0}}}}, pc = 139662905631813, bp = 140736553722768, sp = 140736553720632, access_size = 6, bug_descr = 0x7f05cdeb4797 "heap-use-after-free", is_write = false, shadow_val = 253 '\375'}
        #9  0x00007f05cde58f8d in __asan::ReportGenericError (pc=<optimized out>, bp=bp@entry=140736553722768, sp=sp@entry=140736553720632, addr=addr@entry=136845374391307, is_write=is_write@entry=false, access_size=access_size@entry=6, exp=<optimized out>, fatal=false) at ../../../../src/libsanitizer/asan/asan_report.cpp:536
                in_report = <optimized out>
                error = <optimized out>
                enable_fp = <optimized out>
        #10 0x00007f05cde0e468 in MemcmpInterceptorCommon (ctx=ctx@entry=0x7fffc84aa3a0, real_fn=<optimized out>, a1=a1@entry=0x7c75cbee040b, a2=a2@entry=0x7b05cac89e20, size=size@entry=6) at ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:848
                bp = 140736553722768
                pc = <optimized out>
                local_stack = 136501777006656
                sp = 140736553720632
                _ctx = 0x7fffc84aa3a0
                suppressed = <optimized out>
                __offset = 136845374391307
                __size = 6
                __bad = <optimized out>
                result = <optimized out>
        #11 0x00007f05cde0e835 in ___interceptor_memcmp (a1=0x7c75cbee040b, a2=0x7b05cac89e20, size=6) at ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:880
                ctx = 0x7fffc84aa3a0
                _ctx = {interceptor_name = 0x7f05cdeb86b6 "memcmp"}
        #12 ___interceptor_memcmp (a1=0x7c75cbee040b, a2=0x7b05cac89e20, size=6) at ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:875
                ctx = <optimized out>
                _ctx = <optimized out>
        #13 0x00005608284d72e8 in bacmp (ba1=0x7c75cbee040b, ba2=0x7b05cac89e20) at ./lib/bluetooth/bluetooth.h:438
        No locals.
        #14 device_addr_type_cmp (a=0x7c75cbee0400, b=0x7b05cac89e20) at src/device.c:5661
                dev = 0x7c75cbee0400
                addr = 0x7b05cac89e20
                cmp = <optimized out>
        #15 0x00007f05cdb884c2 in g_slist_find_custom () from /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
        No symbol table info available.
        #16 0x0000560828456824 in btd_adapter_find_device (adapter=<optimized out>, dst=dst@entry=0x7b45cbf23a18, bdaddr_type=1 '\001') at src/adapter.c:1055
                addr = <optimized out>
                device = <optimized out>
                list = <optimized out>
        #17 0x00005608283f8d37 in att_disconnected (err=<optimized out>, user_data=0x7b45cbf23a10) at src/gatt-database.c:335
                state = 0x7b45cbf23a10
                device = <optimized out>
                __func__ = "att_disconnected"
        #18 0x000056082840fc64 in btd_gatt_database_att_disconnected (database=<optimized out>, device=<optimized out>) at src/gatt-database.c:4238
                server = <optimized out>
                att = <optimized out>
                state = <optimized out>
                addr = <optimized out>
                type = <optimized out>
                __func__ = "btd_gatt_database_att_disconnected"
        #19 0x00005608284b9346 in gatt_server_cleanup (device=device@entry=0x7c75cbee0080) at src/device.c:842
        No locals.
        #20 0x00005608284cdb9c in attio_cleanup (device=0x7c75cbee0080) at src/device.c:862
        No locals.
        #21 0x00005608284ce1e7 in device_free (user_data=0x7c75cbee0080) at src/device.c:918
                device = 0x7c75cbee0080
                __func__ = "device_free"
        #22 0x000056082854bcea in remove_interface (data=0x7b75cbeeb000, name=name@entry=0x560828758ca0 "org.bluez.Device1") at gdbus/object.c:742
                iface = 0x7b65cbefe380
        #23 0x000056082854e8ac in g_dbus_unregister_interface (connection=<optimized out>, path=<optimized out>, name=<optimized out>) at gdbus/object.c:1499
                data = <optimized out>
        #24 0x0000560828489573 in adapter_remove (adapter=adapter@entry=0x7c35cbee0200) at src/adapter.c:7354
                l = 0x7b25cbf0b3f0 = {0x7c75cbee0080}
                db = <optimized out>
                ranging_manager = <optimized out>
                __func__ = "adapter_remove"
        #25 0x000056082848a108 in adapter_cleanup () at src/adapter.c:11309
                adapter = 0x7c35cbee0200
        #26 0x000056082823b400 in main (argc=<optimized out>, argv=<optimized out>) at src/main.c:1723
                context = <optimized out>
                err = <optimized out>
                sdp_mtu = 0
                sdp_flags = <optimized out>
                gdbus_flags = <optimized out>
                __func__ = "main""
FAIL functional.test_bap::test_bap_unicast_set_transport_acquire[hosts7-vm3]: failed on setup with "pytest_bluezenv.rpc.RemoteTimeoutError: Connection recv timed out"
FAIL functional.test_bap::test_bap_unicast_set_transport_acquire[hosts7-vm3]: failed on teardown with "pytest_bluezenv.plugin.CoredumpWarning: Core dump: test-bluezenv-hosts7.0-bluetoothd-1789518934-68.core
        /usr/bin/gdb: warning: Couldn't determine a path for the index cache directory.
        [New LWP 68]
        [Thread debugging using libthread_db enabled]
        Using host libthread_db library "/usr/lib/x86_64-linux-gnu/libthread_db.so.1".
        Core was generated by `/home/runner/work/bluez/bluez/src/src/src/bluetoothd --nodetach -f /run/bluetoo'.
        Program terminated with signal SIGABRT, Aborted.
        #0  __pthread_kill_implementation (threadid=<optimized out>, signo=6, no_tid=0) at ./nptl/pthread_kill.c:44

        warning: 44	./nptl/pthread_kill.c: No such file or directory

        Thread 1 (Thread 0x7f9addaf4900 (LWP 68)):
        #0  __pthread_kill_implementation (threadid=<optimized out>, signo=6, no_tid=0) at ./nptl/pthread_kill.c:44
                tid = <optimized out>
                ret = 0
                pd = <optimized out>
                old_mask = {__val = {0}}
                ret = <optimized out>
        #1  __pthread_kill_internal (threadid=<optimized out>, signo=6) at ./nptl/pthread_kill.c:89
        No locals.
        #2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ./nptl/pthread_kill.c:100
        No locals.
        #3  0x00007f9ade24fb7e in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
                ret = <optimized out>
        #4  0x00007f9ade2328ec in __GI_abort () at ./stdlib/abort.c:77
                act = {__sigaction_handler = {sa_handler = 0x0, sa_sigaction = 0x0}, sa_mask = {__val = {0 <repeats 16 times>}}, sa_flags = 0, sa_restorer = 0x0}
        #5  0x00007f9adee5aa0f in __sanitizer::Abort () at ../../../../src/libsanitizer/sanitizer_common/sanitizer_posix_libcdep.cpp:165
        No locals.
        #6  0x00007f9adef80c2d in __sanitizer::Die () at ../../../../src/libsanitizer/sanitizer_common/sanitizer_termination.cpp:58
        No locals.
        #7  0x00007f9adef5593c in __asan::ScopedInErrorReport::~ScopedInErrorReport (this=0x7ffff8f62286) at ../../../../src/libsanitizer/asan/asan_report.cpp:221
                buffer_copy = {buffer_ = {<__sanitizer::InternalMmapVectorNoCtor<char, false>> = {data_ = 0x7f9add308000 '=' <repeats 65 times>, "\n==68==ERROR: AddressSanitizer: heap-use-after-free on address 0x7d0adcfe0208 at pc 0x5588162bc14c bp 0x7ffff8f62f00 sp 0x7ffff8f62ef0\n"..., capacity_bytes_ = 4096, size_ = 3419}, <No data fields>}}
                buffer_copy = <optimized out>
                l = <optimized out>
        #8  0x00007f9adef54e02 in __asan::ReportGenericError (pc=94042975879500, bp=140737370271488, sp=sp@entry=140737370271472, addr=137485610779144, is_write=is_write@entry=false, access_size=8, fatal=true, exp=<optimized out>) at ../../../../src/libsanitizer/asan/asan_report.cpp:536
                in_report = {error_report_lock_ = {<No data fields>}, static current_error_ = {kind = __asan::kErrorKindGeneric, {Base = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\232{\000\000\377\000\000\000\000\000\000\000 ;Y\026\210U\000\000f\r\366\336\232\177\000\000p#\366\370\377\177\000\000\002\000\000\000\000\000\000\000\300o\377\336\232\177\000\000\220\003\377\334\032|\000\000@#\366\370\377\177\000\0008G\346\336\232\177\000\000^\000\000\000\000\000\000\000\220\003\377\334\032|\000\000\320\240s\335\232\177\000\000`#\366\370\377\177\000\000\240\003\377\334\032|\000\000q\000\000\000\000\000\000\000\320+\366\370\377\177\000\000^\000\000\000\000\000\000\000\220+\366\370\377\177\000\000\301s\364\336\232\177\000\000BZR\026\210U\000\000\270\377\377\377"...}, tid = 0}, DeadlySignal = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\232{\000\000\377\000\000\000\000\000\000\000 ;Y\026\210U\000\000f\r\366\336\232\177\000\000p#\366\370\377\177\000\000\002\000\000\000\000\000\000\000\300o\377\336\232\177\000\000\220\003\377\334\032|\000\000@#\366\370\377\177\000\0008G\346\336\232\177\000\000^\000\000\000\000\000\000\000\220\003\377\334\032|\000\000\320\240s\335\232\177\000\000`#\366\370\377\177\000\000\240\003\377\334\032|\000\000q\000\000\000\000\000\000\000\320+\366\370\377\177\000\000^\000\000\000\000\000\000\000\220+\366\370\377\177\000\000\301s\364\336\232\177\000\000BZR\026\210U\000\000\270\377\377\377"...}, tid = 0}, signal = {siginfo = 0x7fff00000002, context = 0x7d0adcfe0208, addr = 0, pc = 0, sp = 11085310592500, bp = 137485610779144, is_memory_access = 136, write_flag = __sanitizer::SignalContext::Unknown, is_true_faulting_addr = 128}}, DoubleFree = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\232{\000\000\377\000\000\000\000\000\000\000 ;Y\026\210U\000\000f\r\366\336\232\177\000\000p#\366\370\377\177\000\000\002\000\000\000\000\000\000\000\300o\377\336\232\177\000\000\220\003\377\334\032|\000\000@#\366\370\377\177\000\0008G\346\336\232\177\000\000^\000\000\000\000\000\000\000\220\003\377\334\032|\000\000\320\240s\335\232\177\000\000`#\366\370\377\177\000\000\240\003\377\334\032|\000\000q\000\000\000\000\000\000\000\320+\366\370\377\177\000\000^\000\000\000\000\000\000\000\220+\366\370\377\177\000\000\301s\364\336\232\177\000\000BZR\026\210U\000\000\270\377\377\377"...}, tid = 0}, second_free_stack = 0x7fff00000002, addr_description = {addr = 137485610779144, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1524, free_stack_id = 2581, chunk_access = {bad_addr = 137485610779144, offset = 392, chunk_begin = 137485610778752, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}}, NewDeleteTypeMismatch = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\232{\000\000\377\000\000\000\000\000\000\000 ;Y\026\210U\000\000f\r\366\336\232\177\000\000p#\366\370\377\177\000\000\002\000\000\000\000\000\000\000\300o\377\336\232\177\000\000\220\003\377\334\032|\000\000@#\366\370\377\177\000\0008G\346\336\232\177\000\000^\000\000\000\000\000\000\000\220\003\377\334\032|\000\000\320\240s\335\232\177\000\000`#\366\370\377\177\000\000\240\003\377\334\032|\000\000q\000\000\000\000\000\000\000\320+\366\370\377\177\000\000^\000\000\000\000\000\000\000\220+\366\370\377\177\000\000\301s\364\336\232\177\000\000BZR\026\210U\000\000\270\377\377\377"...}, tid = 0}, free_stack = 0x7fff00000002, addr_description = {addr = 137485610779144, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1524, free_stack_id = 2581, chunk_access = {bad_addr = 137485610779144, offset = 392, chunk_begin = 137485610778752, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, delete_size = 140303141301023, delete_alignment = 1}, FreeNotMalloced = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\232{\000\000\377\000\000\000\000\000\000\000 ;Y\026\210U\000\000f\r\366\336\232\177\000\000p#\366\370\377\177\000\000\002\000\000\000\000\000\000\000\300o\377\336\232\177\000\000\220\003\377\334\032|\000\000@#\366\370\377\177\000\0008G\346\336\232\177\000\000^\000\000\000\000\000\000\000\220\003\377\334\032|\000\000\320\240s\335\232\177\000\000`#\366\370\377\177\000\000\240\003\377\334\032|\000\000q\000\000\000\000\000\000\000\320+\366\370\377\177\000\000^\000\000\000\000\000\000\000\220+\366\370\377\177\000\000\301s\364\336\232\177\000\000BZR\026\210U\000\000\270\377\377\377"...}, tid = 0}, free_stack = 0x7fff00000002, addr_description = {data = {kind = 3707634184, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11085310592500, alloc_stack_id = 3707634184, free_stack_id = 32010, chunk_access = {bad_addr = 392, offset = 137485610778752, chunk_begin = 752, chunk_size = 140737370284040, user_requested_alignment = 2847, access_type = 2, alloc_type = 3}}, stack = {addr = 0, tid = 0, offset = 11085310592500, frame_pc = 137485610779144, access_size = 392, frame_descr = 0x7d0adcfe0080 "\025\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11085310592500, size_with_redzone = 137485610779144, name = 0x188 <error: Cannot access memory at address 0x188>, module_name = 0x7d0adcfe0080 "\025\n", has_dynamic_init = 752, gcc_location = 0x7ffff8f66008, odr_indicator = 140303141301023}, {beg = 1, size = 136729696684544, size_with_redzone = 140737370271568, name = 0x7f9adef485d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", module_name = 0x3 <error: Cannot access memory at address 0x3>, has_dynamic_init = 132564361216, gcc_location = 0x7ffff8f62730, odr_indicator = 2}, {beg = 140303142258192, size = 94042976438598, size_with_redzone = 140737370269664, name = 0x7 <error: Cannot access memory at address 0x7>, module_name = 0x7f9adeff6fc0 <__asan::instance> "", has_dynamic_init = 136042502840128, gcc_location = 0x7ffff8f627b0, odr_indicator = 140303142358374}, {beg = 140737370269712, size = 6, size_with_redzone = 140303142973376, name = 0x7c5add0170b0 "\003\021", module_name = 0x7ffff8f627e0 "\b", has_dynamic_init = 140303141324600, gcc_location = 0x78, odr_indicator = 136729696759984}}, reg_sites = {4176881616, 32767, 3727892846, 32666}, access_size = 0, size = 76 'L'}, wild = {addr = 0, access_size = 0}}}}}, AllocTypeMismatch = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\232{\000\000\377\000\000\000\000\000\000\000 ;Y\026\210U\000\000f\r\366\336\232\177\000\000p#\366\370\377\177\000\000\002\000\000\000\000\000\000\000\300o\377\336\232\177\000\000\220\003\377\334\032|\000\000@#\366\370\377\177\000\0008G\346\336\232\177\000\000^\000\000\000\000\000\000\000\220\003\377\334\032|\000\000\320\240s\335\232\177\000\000`#\366\370\377\177\000\000\240\003\377\334\032|\000\000q\000\000\000\000\000\000\000\320+\366\370\377\177\000\000^\000\000\000\000\000\000\000\220+\366\370\377\177\000\000\301s\364\336\232\177\000\000BZR\026\210U\000\000\270\377\377\377"...}, tid = 0}, dealloc_stack = 0x7fff00000002, alloc_type = 3707634184, dealloc_type = 32010, addr_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 0, kind = (unknown: 0xf4), shadow_byte = 5 '\005'}, heap = {addr = 0, alloc_tid = 11085310592500, free_tid = 137485610779144, alloc_stack_id = 392, free_stack_id = 0, chunk_access = {bad_addr = 137485610778752, offset = 752, chunk_begin = 140737370284040, chunk_size = 140303141301023, user_requested_alignment = 1, access_type = 0, alloc_type = 0}}, stack = {addr = 0, tid = 11085310592500, offset = 137485610779144, frame_pc = 392, access_size = 137485610778752, frame_descr = 0x2f0 <error: Cannot access memory at address 0x2f0>}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 11085310592500, size = 137485610779144, size_with_redzone = 392, name = 0x7d0adcfe0080 "\025\n", module_name = 0x2f0 <error: Cannot access memory at address 0x2f0>, has_dynamic_init = 140737370284040, gcc_location = 0x7f9adee5eb1f <__asan::asan_malloc(unsigned long, __sanitizer::BufferedStackTrace*)+47>, odr_indicator = 1}, {beg = 136729696684544, size = 140737370271568, size_with_redzone = 140303142258130, name = 0x3 <error: Cannot access memory at address 0x3>, module_name = 0x1edd73a000 <error: Cannot access memory at address 0x1edd73a000>, has_dynamic_init = 140737370269488, gcc_location = 0x2, odr_indicator = 140303142258192}, {beg = 94042976438598, size = 140737370269664, size_with_redzone = 7, name = 0x7f9adeff6fc0 <__asan::instance> "", module_name = 0x7bbadd0e5f40 "\003\021", has_dynamic_init = 140737370269616, gcc_location = 0x7f9adef60d66 <__sanitizer::RunFreeHooks(void*)+86>, odr_indicator = 140737370269712}, {beg = 6, size = 140303142973376, size_with_redzone = 136729696759984, name = 0x7ffff8f627e0 "\b", module_name = 0x7f9adee64738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", has_dynamic_init = 120, gcc_location = 0x7c5add0170b0, odr_indicator = 140737370269648}}, reg_sites = {3727892846, 32666, 0, 0}, access_size = 94042975879500, size = 0 '\000'}, wild = {addr = 0, access_size = 11085310592500}}}}}, MallocUsableSizeNotOwned = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\232{\000\000\377\000\000\000\000\000\000\000 ;Y\026\210U\000\000f\r\366\336\232\177\000\000p#\366\370\377\177\000\000\002\000\000\000\000\000\000\000\300o\377\336\232\177\000\000\220\003\377\334\032|\000\000@#\366\370\377\177\000\0008G\346\336\232\177\000\000^\000\000\000\000\000\000\000\220\003\377\334\032|\000\000\320\240s\335\232\177\000\000`#\366\370\377\177\000\000\240\003\377\334\032|\000\000q\000\000\000\000\000\000\000\320+\366\370\377\177\000\000^\000\000\000\000\000\000\000\220+\366\370\377\177\000\000\301s\364\336\232\177\000\000BZR\026\210U\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7fff00000002, addr_description = {data = {kind = 3707634184, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11085310592500, alloc_stack_id = 3707634184, free_stack_id = 32010, chunk_access = {bad_addr = 392, offset = 137485610778752, chunk_begin = 752, chunk_size = 140737370284040, user_requested_alignment = 2847, access_type = 2, alloc_type = 3}}, stack = {addr = 0, tid = 0, offset = 11085310592500, frame_pc = 137485610779144, access_size = 392, frame_descr = 0x7d0adcfe0080 "\025\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11085310592500, size_with_redzone = 137485610779144, name = 0x188 <error: Cannot access memory at address 0x188>, module_name = 0x7d0adcfe0080 "\025\n", has_dynamic_init = 752, gcc_location = 0x7ffff8f66008, odr_indicator = 140303141301023}, {beg = 1, size = 136729696684544, size_with_redzone = 140737370271568, name = 0x7f9adef485d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", module_name = 0x3 <error: Cannot access memory at address 0x3>, has_dynamic_init = 132564361216, gcc_location = 0x7ffff8f62730, odr_indicator = 2}, {beg = 140303142258192, size = 94042976438598, size_with_redzone = 140737370269664, name = 0x7 <error: Cannot access memory at address 0x7>, module_name = 0x7f9adeff6fc0 <__asan::instance> "", has_dynamic_init = 136042502840128, gcc_location = 0x7ffff8f627b0, odr_indicator = 140303142358374}, {beg = 140737370269712, size = 6, size_with_redzone = 140303142973376, name = 0x7c5add0170b0 "\003\021", module_name = 0x7ffff8f627e0 "\b", has_dynamic_init = 140303141324600, gcc_location = 0x78, odr_indicator = 136729696759984}}, reg_sites = {4176881616, 32767, 3727892846, 32666}, access_size = 0, size = 76 'L'}, wild = {addr = 0, access_size = 0}}}}}, SanitizerGetAllocatedSizeNotOwned = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\232{\000\000\377\000\000\000\000\000\000\000 ;Y\026\210U\000\000f\r\366\336\232\177\000\000p#\366\370\377\177\000\000\002\000\000\000\000\000\000\000\300o\377\336\232\177\000\000\220\003\377\334\032|\000\000@#\366\370\377\177\000\0008G\346\336\232\177\000\000^\000\000\000\000\000\000\000\220\003\377\334\032|\000\000\320\240s\335\232\177\000\000`#\366\370\377\177\000\000\240\003\377\334\032|\000\000q\000\000\000\000\000\000\000\320+\366\370\377\177\000\000^\000\000\000\000\000\000\000\220+\366\370\377\177\000\000\301s\364\336\232\177\000\000BZR\026\210U\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7fff00000002, addr_description = {data = {kind = 3707634184, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11085310592500, alloc_stack_id = 3707634184, free_stack_id = 32010, chunk_access = {bad_addr = 392, offset = 137485610778752, chunk_begin = 752, chunk_size = 140737370284040, user_requested_alignment = 2847, access_type = 2, alloc_type = 3}}, stack = {addr = 0, tid = 0, offset = 11085310592500, frame_pc = 137485610779144, access_size = 392, frame_descr = 0x7d0adcfe0080 "\025\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11085310592500, size_with_redzone = 137485610779144, name = 0x188 <error: Cannot access memory at address 0x188>, module_name = 0x7d0adcfe0080 "\025\n", has_dynamic_init = 752, gcc_location = 0x7ffff8f66008, odr_indicator = 140303141301023}, {beg = 1, size = 136729696684544, size_with_redzone = 140737370271568, name = 0x7f9adef485d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", module_name = 0x3 <error: Cannot access memory at address 0x3>, has_dynamic_init = 132564361216, gcc_location = 0x7ffff8f62730, odr_indicator = 2}, {beg = 140303142258192, size = 94042976438598, size_with_redzone = 140737370269664, name = 0x7 <error: Cannot access memory at address 0x7>, module_name = 0x7f9adeff6fc0 <__asan::instance> "", has_dynamic_init = 136042502840128, gcc_location = 0x7ffff8f627b0, odr_indicator = 140303142358374}, {beg = 140737370269712, size = 6, size_with_redzone = 140303142973376, name = 0x7c5add0170b0 "\003\021", module_name = 0x7ffff8f627e0 "\b", has_dynamic_init = 140303141324600, gcc_location = 0x78, odr_indicator = 136729696759984}}, reg_sites = {4176881616, 32767, 3727892846, 32666}, access_size = 0, size = 76 'L'}, wild = {addr = 0, access_size = 0}}}}}, CallocOverflow = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\232{\000\000\377\000\000\000\000\000\000\000 ;Y\026\210U\000\000f\r\366\336\232\177\000\000p#\366\370\377\177\000\000\002\000\000\000\000\000\000\000\300o\377\336\232\177\000\000\220\003\377\334\032|\000\000@#\366\370\377\177\000\0008G\346\336\232\177\000\000^\000\000\000\000\000\000\000\220\003\377\334\032|\000\000\320\240s\335\232\177\000\000`#\366\370\377\177\000\000\240\003\377\334\032|\000\000q\000\000\000\000\000\000\000\320+\366\370\377\177\000\000^\000\000\000\000\000\000\000\220+\366\370\377\177\000\000\301s\364\336\232\177\000\000BZR\026\210U\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7fff00000002, count = 137485610779144, size = 0}, ReallocArrayOverflow = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\232{\000\000\377\000\000\000\000\000\000\000 ;Y\026\210U\000\000f\r\366\336\232\177\000\000p#\366\370\377\177\000\000\002\000\000\000\000\000\000\000\300o\377\336\232\177\000\000\220\003\377\334\032|\000\000@#\366\370\377\177\000\0008G\346\336\232\177\000\000^\000\000\000\000\000\000\000\220\003\377\334\032|\000\000\320\240s\335\232\177\000\000`#\366\370\377\177\000\000\240\003\377\334\032|\000\000q\000\000\000\000\000\000\000\320+\366\370\377\177\000\000^\000\000\000\000\000\000\000\220+\366\370\377\177\000\000\301s\364\336\232\177\000\000BZR\026\210U\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7fff00000002, count = 137485610779144, size = 0}, PvallocOverflow = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\232{\000\000\377\000\000\000\000\000\000\000 ;Y\026\210U\000\000f\r\366\336\232\177\000\000p#\366\370\377\177\000\000\002\000\000\000\000\000\000\000\300o\377\336\232\177\000\000\220\003\377\334\032|\000\000@#\366\370\377\177\000\0008G\346\336\232\177\000\000^\000\000\000\000\000\000\000\220\003\377\334\032|\000\000\320\240s\335\232\177\000\000`#\366\370\377\177\000\000\240\003\377\334\032|\000\000q\000\000\000\000\000\000\000\320+\366\370\377\177\000\000^\000\000\000\000\000\000\000\220+\366\370\377\177\000\000\301s\364\336\232\177\000\000BZR\026\210U\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7fff00000002, size = 137485610779144}, InvalidAllocationAlignment = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\232{\000\000\377\000\000\000\000\000\000\000 ;Y\026\210U\000\000f\r\366\336\232\177\000\000p#\366\370\377\177\000\000\002\000\000\000\000\000\000\000\300o\377\336\232\177\000\000\220\003\377\334\032|\000\000@#\366\370\377\177\000\0008G\346\336\232\177\000\000^\000\000\000\000\000\000\000\220\003\377\334\032|\000\000\320\240s\335\232\177\000\000`#\366\370\377\177\000\000\240\003\377\334\032|\000\000q\000\000\000\000\000\000\000\320+\366\370\377\177\000\000^\000\000\000\000\000\000\000\220+\366\370\377\177\000\000\301s\364\336\232\177\000\000BZR\026\210U\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7fff00000002, alignment = 137485610779144}, InvalidAlignedAllocAlignment = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\232{\000\000\377\000\000\000\000\000\000\000 ;Y\026\210U\000\000f\r\366\336\232\177\000\000p#\366\370\377\177\000\000\002\000\000\000\000\000\000\000\300o\377\336\232\177\000\000\220\003\377\334\032|\000\000@#\366\370\377\177\000\0008G\346\336\232\177\000\000^\000\000\000\000\000\000\000\220\003\377\334\032|\000\000\320\240s\335\232\177\000\000`#\366\370\377\177\000\000\240\003\377\334\032|\000\000q\000\000\000\000\000\000\000\320+\366\370\377\177\000\000^\000\000\000\000\000\000\000\220+\366\370\377\177\000\000\301s\364\336\232\177\000\000BZR\026\210U\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7fff00000002, size = 137485610779144, alignment = 0}, InvalidPosixMemalignAlignment = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\232{\000\000\377\000\000\000\000\000\000\000 ;Y\026\210U\000\000f\r\366\336\232\177\000\000p#\366\370\377\177\000\000\002\000\000\000\000\000\000\000\300o\377\336\232\177\000\000\220\003\377\334\032|\000\000@#\366\370\377\177\000\0008G\346\336\232\177\000\000^\000\000\000\000\000\000\000\220\003\377\334\032|\000\000\320\240s\335\232\177\000\000`#\366\370\377\177\000\000\240\003\377\334\032|\000\000q\000\000\000\000\000\000\000\320+\366\370\377\177\000\000^\000\000\000\000\000\000\000\220+\366\370\377\177\000\000\301s\364\336\232\177\000\000BZR\026\210U\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7fff00000002, alignment = 137485610779144}, AllocationSizeTooBig = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\232{\000\000\377\000\000\000\000\000\000\000 ;Y\026\210U\000\000f\r\366\336\232\177\000\000p#\366\370\377\177\000\000\002\000\000\000\000\000\000\000\300o\377\336\232\177\000\000\220\003\377\334\032|\000\000@#\366\370\377\177\000\0008G\346\336\232\177\000\000^\000\000\000\000\000\000\000\220\003\377\334\032|\000\000\320\240s\335\232\177\000\000`#\366\370\377\177\000\000\240\003\377\334\032|\000\000q\000\000\000\000\000\000\000\320+\366\370\377\177\000\000^\000\000\000\000\000\000\000\220+\366\370\377\177\000\000\301s\364\336\232\177\000\000BZR\026\210U\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7fff00000002, user_size = 137485610779144, total_size = 0, max_size = 0}, RssLimitExceeded = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\232{\000\000\377\000\000\000\000\000\000\000 ;Y\026\210U\000\000f\r\366\336\232\177\000\000p#\366\370\377\177\000\000\002\000\000\000\000\000\000\000\300o\377\336\232\177\000\000\220\003\377\334\032|\000\000@#\366\370\377\177\000\0008G\346\336\232\177\000\000^\000\000\000\000\000\000\000\220\003\377\334\032|\000\000\320\240s\335\232\177\000\000`#\366\370\377\177\000\000\240\003\377\334\032|\000\000q\000\000\000\000\000\000\000\320+\366\370\377\177\000\000^\000\000\000\000\000\000\000\220+\366\370\377\177\000\000\301s\364\336\232\177\000\000BZR\026\210U\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7fff00000002}, OutOfMemory = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\232{\000\000\377\000\000\000\000\000\000\000 ;Y\026\210U\000\000f\r\366\336\232\177\000\000p#\366\370\377\177\000\000\002\000\000\000\000\000\000\000\300o\377\336\232\177\000\000\220\003\377\334\032|\000\000@#\366\370\377\177\000\0008G\346\336\232\177\000\000^\000\000\000\000\000\000\000\220\003\377\334\032|\000\000\320\240s\335\232\177\000\000`#\366\370\377\177\000\000\240\003\377\334\032|\000\000q\000\000\000\000\000\000\000\320+\366\370\377\177\000\000^\000\000\000\000\000\000\000\220+\366\370\377\177\000\000\301s\364\336\232\177\000\000BZR\026\210U\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7fff00000002, requested_size = 137485610779144}, StringFunctionMemoryRangesOverlap = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\232{\000\000\377\000\000\000\000\000\000\000 ;Y\026\210U\000\000f\r\366\336\232\177\000\000p#\366\370\377\177\000\000\002\000\000\000\000\000\000\000\300o\377\336\232\177\000\000\220\003\377\334\032|\000\000@#\366\370\377\177\000\0008G\346\336\232\177\000\000^\000\000\000\000\000\000\000\220\003\377\334\032|\000\000\320\240s\335\232\177\000\000`#\366\370\377\177\000\000\240\003\377\334\032|\000\000q\000\000\000\000\000\000\000\320+\366\370\377\177\000\000^\000\000\000\000\000\000\000\220+\366\370\377\177\000\000\301s\364\336\232\177\000\000BZR\026\210U\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7fff00000002, length1 = 137485610779144, length2 = 0, addr1_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 11085310592500, kind = (unknown: 0x8), shadow_byte = 2 '\002'}, heap = {addr = 11085310592500, alloc_tid = 137485610779144, free_tid = 392, alloc_stack_id = 3707633792, free_stack_id = 32010, chunk_access = {bad_addr = 752, offset = 140737370284040, chunk_begin = 140303141301023, chunk_size = 1, user_requested_alignment = 2560, access_type = 0, alloc_type = 1}}, stack = {addr = 11085310592500, tid = 137485610779144, offset = 392, frame_pc = 137485610778752, access_size = 752, frame_descr = 0x7ffff8f66008 <error: Cannot access memory at address 0x7ffff8f66008>}, global = {addr = 11085310592500, static kMaxGlobals = 4, globals = {{beg = 137485610779144, size = 392, size_with_redzone = 137485610778752, name = 0x2f0 <error: Cannot access memory at address 0x2f0>, module_name = 0x7ffff8f66008 <error: Cannot access memory at address 0x7ffff8f66008>, has_dynamic_init = 140303141301023, gcc_location = 0x1, odr_indicator = 136729696684544}, {beg = 140737370271568, size = 140303142258130, size_with_redzone = 3, name = 0x1edd73a000 <error: Cannot access memory at address 0x1edd73a000>, module_name = 0x7ffff8f62730 "\020\206\364\336\232\177", has_dynamic_init = 2, gcc_location = 0x7f9adef48610 <___interceptor_malloc(__sanitizer::uptr)+192>, odr_indicator = 94042976438598}, {beg = 140737370269664, size = 7, size_with_redzone = 140303142973376, name = 0x7bbadd0e5f40 "\003\021", module_name = 0x7ffff8f627b0 "\320'\366\370\377\177", has_dynamic_init = 140303142358374, gcc_location = 0x7ffff8f62810, odr_indicator = 6}, {beg = 140303142973376, size = 136729696759984, size_with_redzone = 140737370269664, name = 0x7f9adee64738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", module_name = 0x78 <error: Cannot access memory at address 0x78>, has_dynamic_init = 136729696759984, gcc_location = 0x7ffff8f627d0, odr_indicator = 140303129583982}}, reg_sites = {0, 0, 371966284, 21896}, access_size = 140737370271488, size = 240 '\360'}, wild = {addr = 11085310592500, access_size = 137485610779144}}}}, addr2_description = {data = {kind = 8, {shadow = {addr = 140303142684567, kind = __asan::kShadowKindLow, shadow_byte = 253 '\375'}, heap = {addr = 140303142684567, alloc_tid = 140303139208448, free_tid = 140737370271136, alloc_stack_id = 3740354771, free_stack_id = 32666, chunk_access = {bad_addr = 140737370271136, offset = 3737729592, chunk_begin = 140737370271232, chunk_size = 140303139200598, user_requested_alignment = 384, access_type = 0, alloc_type = 0}}, stack = {addr = 140303142684567, tid = 140303139208448, offset = 140737370271136, frame_pc = 140303142045907, access_size = 140737370271136, frame_descr = 0xdec93a38 <error: Cannot access memory at address 0xdec93a38>}, global = {addr = 140303142684567, static kMaxGlobals = 4, globals = {{beg = 140303139208448, size = 140737370271136, size_with_redzone = 140303142045907, name = 0x7ffff8f62da0 "\200\001\376\334\252|", module_name = 0xdec93a38 <error: Cannot access memory at address 0xdec93a38>, has_dynamic_init = 140737370271232, gcc_location = 0x7f9adec5de56, odr_indicator = 137073293918592}, {beg = 140303139200548, size = 140737370271184, size_with_redzone = 6901425113760, name = 0x1c <error: Cannot access memory at address 0x1c>, module_name = 0x2ca6a22b <error: Cannot access memory at address 0x2ca6a22b>, has_dynamic_init = 140737370271216, gcc_location = 0x7bfadcfe0aa0, odr_indicator = 140737370271248}, {beg = 136729696760000, size = 137073293918592, size_with_redzone = 136179941189008, name = 0x55881649c9a0 <watch_destroy> "\363\017\036\372SH\211\373H\203\354\020H\205\377\017\2049\002", module_name = 0x7f9adecc2dce "I\211\305L9\360tJH\205\300tUH\213E\310dH+\004%(", has_dynamic_init = 136729696760000, gcc_location = 0x7f9adecc2dce, odr_indicator = 94042977847712}, {beg = 0, size = 140737370271344, size_with_redzone = 140303139614158, name = 0x7c9adcfe0440 "\001", module_name = 0x7bdadcff84d0 "\002", has_dynamic_init = 44, gcc_location = 0x0, odr_indicator = 136179940820184}}, reg_sites = {3708102056, 31706, 3707733232, 31706}, access_size = 94042977849582, size = 144 '\220'}, wild = {addr = 140303142684567, access_size = 140303139208448}}}}, function = 0xc933e1b1e5043100 <error: Cannot access memory at address 0xc933e1b1e5043100>}, StringFunctionSizeOverflow = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\232{\000\000\377\000\000\000\000\000\000\000 ;Y\026\210U\000\000f\r\366\336\232\177\000\000p#\366\370\377\177\000\000\002\000\000\000\000\000\000\000\300o\377\336\232\177\000\000\220\003\377\334\032|\000\000@#\366\370\377\177\000\0008G\346\336\232\177\000\000^\000\000\000\000\000\000\000\220\003\377\334\032|\000\000\320\240s\335\232\177\000\000`#\366\370\377\177\000\000\240\003\377\334\032|\000\000q\000\000\000\000\000\000\000\320+\366\370\377\177\000\000^\000\000\000\000\000\000\000\220+\366\370\377\177\000\000\301s\364\336\232\177\000\000BZR\026\210U\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7fff00000002, addr_description = {data = {kind = 3707634184, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11085310592500, alloc_stack_id = 3707634184, free_stack_id = 32010, chunk_access = {bad_addr = 392, offset = 137485610778752, chunk_begin = 752, chunk_size = 140737370284040, user_requested_alignment = 2847, access_type = 2, alloc_type = 3}}, stack = {addr = 0, tid = 0, offset = 11085310592500, frame_pc = 137485610779144, access_size = 392, frame_descr = 0x7d0adcfe0080 "\025\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11085310592500, size_with_redzone = 137485610779144, name = 0x188 <error: Cannot access memory at address 0x188>, module_name = 0x7d0adcfe0080 "\025\n", has_dynamic_init = 752, gcc_location = 0x7ffff8f66008, odr_indicator = 140303141301023}, {beg = 1, size = 136729696684544, size_with_redzone = 140737370271568, name = 0x7f9adef485d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", module_name = 0x3 <error: Cannot access memory at address 0x3>, has_dynamic_init = 132564361216, gcc_location = 0x7ffff8f62730, odr_indicator = 2}, {beg = 140303142258192, size = 94042976438598, size_with_redzone = 140737370269664, name = 0x7 <error: Cannot access memory at address 0x7>, module_name = 0x7f9adeff6fc0 <__asan::instance> "", has_dynamic_init = 136042502840128, gcc_location = 0x7ffff8f627b0, odr_indicator = 140303142358374}, {beg = 140737370269712, size = 6, size_with_redzone = 140303142973376, name = 0x7c5add0170b0 "\003\021", module_name = 0x7ffff8f627e0 "\b", has_dynamic_init = 140303141324600, gcc_location = 0x78, odr_indicator = 136729696759984}}, reg_sites = {4176881616, 32767, 3727892846, 32666}, access_size = 0, size = 76 'L'}, wild = {addr = 0, access_size = 0}}}}, size = 140737370271488}, BadParamsToAnnotateContiguousContainer = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\232{\000\000\377\000\000\000\000\000\000\000 ;Y\026\210U\000\000f\r\366\336\232\177\000\000p#\366\370\377\177\000\000\002\000\000\000\000\000\000\000\300o\377\336\232\177\000\000\220\003\377\334\032|\000\000@#\366\370\377\177\000\0008G\346\336\232\177\000\000^\000\000\000\000\000\000\000\220\003\377\334\032|\000\000\320\240s\335\232\177\000\000`#\366\370\377\177\000\000\240\003\377\334\032|\000\000q\000\000\000\000\000\000\000\320+\366\370\377\177\000\000^\000\000\000\000\000\000\000\220+\366\370\377\177\000\000\301s\364\336\232\177\000\000BZR\026\210U\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7fff00000002, beg = 137485610779144, end = 0, old_mid = 0, new_mid = 11085310592500}, BadParamsToAnnotateDoubleEndedContiguousContainer = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\232{\000\000\377\000\000\000\000\000\000\000 ;Y\026\210U\000\000f\r\366\336\232\177\000\000p#\366\370\377\177\000\000\002\000\000\000\000\000\000\000\300o\377\336\232\177\000\000\220\003\377\334\032|\000\000@#\366\370\377\177\000\0008G\346\336\232\177\000\000^\000\000\000\000\000\000\000\220\003\377\334\032|\000\000\320\240s\335\232\177\000\000`#\366\370\377\177\000\000\240\003\377\334\032|\000\000q\000\000\000\000\000\000\000\320+\366\370\377\177\000\000^\000\000\000\000\000\000\000\220+\366\370\377\177\000\000\301s\364\336\232\177\000\000BZR\026\210U\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7fff00000002, storage_beg = 137485610779144, storage_end = 0, old_container_beg = 0, old_container_end = 11085310592500, new_container_beg = 137485610779144, new_container_end = 392}, BadParamsToCopyContiguousContainerAnnotations = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\232{\000\000\377\000\000\000\000\000\000\000 ;Y\026\210U\000\000f\r\366\336\232\177\000\000p#\366\370\377\177\000\000\002\000\000\000\000\000\000\000\300o\377\336\232\177\000\000\220\003\377\334\032|\000\000@#\366\370\377\177\000\0008G\346\336\232\177\000\000^\000\000\000\000\000\000\000\220\003\377\334\032|\000\000\320\240s\335\232\177\000\000`#\366\370\377\177\000\000\240\003\377\334\032|\000\000q\000\000\000\000\000\000\000\320+\366\370\377\177\000\000^\000\000\000\000\000\000\000\220+\366\370\377\177\000\000\301s\364\336\232\177\000\000BZR\026\210U\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7fff00000002, old_storage_beg = 137485610779144, old_storage_end = 0, new_storage_beg = 0, new_storage_end = 11085310592500}, ODRViolation = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\232{\000\000\377\000\000\000\000\000\000\000 ;Y\026\210U\000\000f\r\366\336\232\177\000\000p#\366\370\377\177\000\000\002\000\000\000\000\000\000\000\300o\377\336\232\177\000\000\220\003\377\334\032|\000\000@#\366\370\377\177\000\0008G\346\336\232\177\000\000^\000\000\000\000\000\000\000\220\003\377\334\032|\000\000\320\240s\335\232\177\000\000`#\366\370\377\177\000\000\240\003\377\334\032|\000\000q\000\000\000\000\000\000\000\320+\366\370\377\177\000\000^\000\000\000\000\000\000\000\220+\366\370\377\177\000\000\301s\364\336\232\177\000\000BZR\026\210U\000\000\270\377\377\377"...}, tid = 0}, global1 = {beg = 140733193388034, size = 137485610779144, size_with_redzone = 0, name = 0x0, module_name = 0xa15000005f4 <error: Cannot access memory at address 0xa15000005f4>, has_dynamic_init = 137485610779144, gcc_location = 0x188, odr_indicator = 137485610778752}, global2 = {beg = 752, size = 140737370284040, size_with_redzone = 140303141301023, name = 0x1 <error: Cannot access memory at address 0x1>, module_name = 0x7c5add004a00 "\200\a\376\334\n}", has_dynamic_init = 140737370271568, gcc_location = 0x7f9adef485d2 <___interceptor_malloc(__sanitizer::uptr)+130>, odr_indicator = 3}, stack_id1 = 3715342336, stack_id2 = 30}, InvalidPointerPair = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\232{\000\000\377\000\000\000\000\000\000\000 ;Y\026\210U\000\000f\r\366\336\232\177\000\000p#\366\370\377\177\000\000\002\000\000\000\000\000\000\000\300o\377\336\232\177\000\000\220\003\377\334\032|\000\000@#\366\370\377\177\000\0008G\346\336\232\177\000\000^\000\000\000\000\000\000\000\220\003\377\334\032|\000\000\320\240s\335\232\177\000\000`#\366\370\377\177\000\000\240\003\377\334\032|\000\000q\000\000\000\000\000\000\000\320+\366\370\377\177\000\000^\000\000\000\000\000\000\000\220+\366\370\377\177\000\000\301s\364\336\232\177\000\000BZR\026\210U\000\000\270\377\377\377"...}, tid = 0}, pc = 140733193388034, bp = 137485610779144, sp = 0, addr1_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 11085310592500, kind = (unknown: 0x8), shadow_byte = 2 '\002'}, heap = {addr = 11085310592500, alloc_tid = 137485610779144, free_tid = 392, alloc_stack_id = 3707633792, free_stack_id = 32010, chunk_access = {bad_addr = 752, offset = 140737370284040, chunk_begin = 140303141301023, chunk_size = 1, user_requested_alignment = 2560, access_type = 0, alloc_type = 1}}, stack = {addr = 11085310592500, tid = 137485610779144, offset = 392, frame_pc = 137485610778752, access_size = 752, frame_descr = 0x7ffff8f66008 <error: Cannot access memory at address 0x7ffff8f66008>}, global = {addr = 11085310592500, static kMaxGlobals = 4, globals = {{beg = 137485610779144, size = 392, size_with_redzone = 137485610778752, name = 0x2f0 <error: Cannot access memory at address 0x2f0>, module_name = 0x7ffff8f66008 <error: Cannot access memory at address 0x7ffff8f66008>, has_dynamic_init = 140303141301023, gcc_location = 0x1, odr_indicator = 136729696684544}, {beg = 140737370271568, size = 140303142258130, size_with_redzone = 3, name = 0x1edd73a000 <error: Cannot access memory at address 0x1edd73a000>, module_name = 0x7ffff8f62730 "\020\206\364\336\232\177", has_dynamic_init = 2, gcc_location = 0x7f9adef48610 <___interceptor_malloc(__sanitizer::uptr)+192>, odr_indicator = 94042976438598}, {beg = 140737370269664, size = 7, size_with_redzone = 140303142973376, name = 0x7bbadd0e5f40 "\003\021", module_name = 0x7ffff8f627b0 "\320'\366\370\377\177", has_dynamic_init = 140303142358374, gcc_location = 0x7ffff8f62810, odr_indicator = 6}, {beg = 140303142973376, size = 136729696759984, size_with_redzone = 140737370269664, name = 0x7f9adee64738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", module_name = 0x78 <error: Cannot access memory at address 0x78>, has_dynamic_init = 136729696759984, gcc_location = 0x7ffff8f627d0, odr_indicator = 140303129583982}}, reg_sites = {0, 0, 371966284, 21896}, access_size = 140737370271488, size = 240 '\360'}, wild = {addr = 11085310592500, access_size = 137485610779144}}}}, addr2_description = {data = {kind = 8, {shadow = {addr = 140303142684567, kind = __asan::kShadowKindLow, shadow_byte = 253 '\375'}, heap = {addr = 140303142684567, alloc_tid = 140303139208448, free_tid = 140737370271136, alloc_stack_id = 3740354771, free_stack_id = 32666, chunk_access = {bad_addr = 140737370271136, offset = 3737729592, chunk_begin = 140737370271232, chunk_size = 140303139200598, user_requested_alignment = 384, access_type = 0, alloc_type = 0}}, stack = {addr = 140303142684567, tid = 140303139208448, offset = 140737370271136, frame_pc = 140303142045907, access_size = 140737370271136, frame_descr = 0xdec93a38 <error: Cannot access memory at address 0xdec93a38>}, global = {addr = 140303142684567, static kMaxGlobals = 4, globals = {{beg = 140303139208448, size = 140737370271136, size_with_redzone = 140303142045907, name = 0x7ffff8f62da0 "\200\001\376\334\252|", module_name = 0xdec93a38 <error: Cannot access memory at address 0xdec93a38>, has_dynamic_init = 140737370271232, gcc_location = 0x7f9adec5de56, odr_indicator = 137073293918592}, {beg = 140303139200548, size = 140737370271184, size_with_redzone = 6901425113760, name = 0x1c <error: Cannot access memory at address 0x1c>, module_name = 0x2ca6a22b <error: Cannot access memory at address 0x2ca6a22b>, has_dynamic_init = 140737370271216, gcc_location = 0x7bfadcfe0aa0, odr_indicator = 140737370271248}, {beg = 136729696760000, size = 137073293918592, size_with_redzone = 136179941189008, name = 0x55881649c9a0 <watch_destroy> "\363\017\036\372SH\211\373H\203\354\020H\205\377\017\2049\002", module_name = 0x7f9adecc2dce "I\211\305L9\360tJH\205\300tUH\213E\310dH+\004%(", has_dynamic_init = 136729696760000, gcc_location = 0x7f9adecc2dce, odr_indicator = 94042977847712}, {beg = 0, size = 140737370271344, size_with_redzone = 140303139614158, name = 0x7c9adcfe0440 "\001", module_name = 0x7bdadcff84d0 "\002", has_dynamic_init = 44, gcc_location = 0x0, odr_indicator = 136179940820184}}, reg_sites = {3708102056, 31706, 3707733232, 31706}, access_size = 94042977849582, size = 144 '\220'}, wild = {addr = 140303142684567, access_size = 140303139208448}}}}}, Generic = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\232{\000\000\377\000\000\000\000\000\000\000 ;Y\026\210U\000\000f\r\366\336\232\177\000\000p#\366\370\377\177\000\000\002\000\000\000\000\000\000\000\300o\377\336\232\177\000\000\220\003\377\334\032|\000\000@#\366\370\377\177\000\0008G\346\336\232\177\000\000^\000\000\000\000\000\000\000\220\003\377\334\032|\000\000\320\240s\335\232\177\000\000`#\366\370\377\177\000\000\240\003\377\334\032|\000\000q\000\000\000\000\000\000\000\320+\366\370\377\177\000\000^\000\000\000\000\000\000\000\220+\366\370\377\177\000\000\301s\364\336\232\177\000\000BZR\026\210U\000\000\270\377\377\377"...}, tid = 0}, addr_description = {data = {kind = __asan::kAddressKindHeap, {shadow = {addr = 137485610779144, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 137485610779144, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1524, free_stack_id = 2581, chunk_access = {bad_addr = 137485610779144, offset = 392, chunk_begin = 137485610778752, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, stack = {addr = 137485610779144, tid = 0, offset = 0, frame_pc = 11085310592500, access_size = 137485610779144, frame_descr = 0x188 <error: Cannot access memory at address 0x188>}, global = {addr = 137485610779144, static kMaxGlobals = 4, globals = {{beg = 0, size = 0, size_with_redzone = 11085310592500, name = 0x7d0adcfe0208 "", module_name = 0x188 <error: Cannot access memory at address 0x188>, has_dynamic_init = 137485610778752, gcc_location = 0x2f0, odr_indicator = 140737370284040}, {beg = 140303141301023, size = 1, size_with_redzone = 136729696684544, name = 0x7ffff8f62f50 "\360B\026\026\210U", module_name = 0x7f9adef485d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", has_dynamic_init = 3, gcc_location = 0x1edd73a000, odr_indicator = 140737370269488}, {beg = 2, size = 140303142258192, size_with_redzone = 94042976438598, name = 0x7ffff8f627e0 "\b", module_name = 0x7 <error: Cannot access memory at address 0x7>, has_dynamic_init = 140303142973376, gcc_location = 0x7bbadd0e5f40, odr_indicator = 140737370269616}, {beg = 140303142358374, size = 140737370269712, size_with_redzone = 6, name = 0x7f9adeff6fc0 <__asan::instance> "", module_name = 0x7c5add0170b0 "\003\021", has_dynamic_init = 140737370269664, gcc_location = 0x7f9adee64738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248>, odr_indicator = 120}}, reg_sites = {3707859120, 31834, 4176881616, 32767}, access_size = 140303129583982, size = 0 '\000'}, wild = {addr = 137485610779144, access_size = 0}}}}, pc = 94042975879500, bp = 140737370271488, sp = 140737370271472, access_size = 8, bug_descr = 0x7f9adefb0797 "heap-use-after-free", is_write = false, shadow_val = 253 '\375'}}}, halt_on_error_ = true}
                error = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\232{\000\000\377\000\000\000\000\000\000\000 ;Y\026\210U\000\000f\r\366\336\232\177\000\000p#\366\370\377\177\000\000\002\000\000\000\000\000\000\000\300o\377\336\232\177\000\000\220\003\377\334\032|\000\000@#\366\370\377\177\000\0008G\346\336\232\177\000\000^\000\000\000\000\000\000\000\220\003\377\334\032|\000\000\320\240s\335\232\177\000\000`#\366\370\377\177\000\000\240\003\377\334\032|\000\000q\000\000\000\000\000\000\000\320+\366\370\377\177\000\000^\000\000\000\000\000\000\000\220+\366\370\377\177\000\000\301s\364\336\232\177\000\000BZR\026\210U\000\000\270\377\377\377"...}, tid = 0}, addr_description = {data = {kind = __asan::kAddressKindHeap, {shadow = {addr = 137485610779144, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 137485610779144, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1524, free_stack_id = 2581, chunk_access = {bad_addr = 137485610779144, offset = 392, chunk_begin = 137485610778752, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, stack = {addr = 137485610779144, tid = 0, offset = 0, frame_pc = 11085310592500, access_size = 137485610779144, frame_descr = 0x188 <error: Cannot access memory at address 0x188>}, global = {addr = 137485610779144, static kMaxGlobals = 4, globals = {{beg = 0, size = 0, size_with_redzone = 11085310592500, name = 0x7d0adcfe0208 "", module_name = 0x188 <error: Cannot access memory at address 0x188>, has_dynamic_init = 137485610778752, gcc_location = 0x2f0, odr_indicator = 140737370284040}, {beg = 140303141301023, size = 1, size_with_redzone = 136729696684544, name = 0x7ffff8f62f50 "\360B\026\026\210U", module_name = 0x7f9adef485d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", has_dynamic_init = 3, gcc_location = 0x1edd73a000, odr_indicator = 140737370269488}, {beg = 2, size = 140303142258192, size_with_redzone = 94042976438598, name = 0x7ffff8f627e0 "\b", module_name = 0x7 <error: Cannot access memory at address 0x7>, has_dynamic_init = 140303142973376, gcc_location = 0x7bbadd0e5f40, odr_indicator = 140737370269616}, {beg = 140303142358374, size = 140737370269712, size_with_redzone = 6, name = 0x7f9adeff6fc0 <__asan::instance> "", module_name = 0x7c5add0170b0 "\003\021", has_dynamic_init = 140737370269664, gcc_location = 0x7f9adee64738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248>, odr_indicator = 120}}, reg_sites = {3707859120, 31834, 4176881616, 32767}, access_size = 140303129583982, size = 0 '\000'}, wild = {addr = 137485610779144, access_size = 0}}}}, pc = 94042975879500, bp = 140737370271488, sp = 140737370271472, access_size = 8, bug_descr = 0x7f9adefb0797 "heap-use-after-free", is_write = false, shadow_val = 253 '\375'}
        #9  0x00007f9adef54f8d in __asan::ReportGenericError (pc=<optimized out>, bp=bp@entry=140737370271488, sp=sp@entry=140737370271472, addr=<optimized out>, is_write=is_write@entry=false, access_size=access_size@entry=8, exp=<optimized out>, fatal=true) at ../../../../src/libsanitizer/asan/asan_report.cpp:536
                in_report = <optimized out>
                error = <optimized out>
                enable_fp = <optimized out>
        #10 0x00007f9adef563f9 in __asan::__asan_report_load8 (addr=<optimized out>) at ../../../../src/libsanitizer/asan/asan_rtl.cpp:131
                bp = 140737370271488
                pc = <optimized out>
                local_stack = 140737370271600
                sp = 140737370271472
        #11 0x00005588162bc14c in device_get_adapter (device=<optimized out>) at src/device.c:6921
        No locals.
        #12 0x000055881616432f in find_cig_session (data=0x7c5add00a100, match_data=0x7b9adbe85fb0) at profiles/audio/bap.c:2500
                session = 0x7c5add00a100
                info = 0x7b9adbe85fb0
        #13 0x0000558816343321 in queue_find (queue=<optimized out>, function=function@entry=0x5588161642f0 <find_cig_session>, match_data=match_data@entry=0x7b9adbe85fb0) at src/shared/queue.c:230
                entry = 0x7bbadd09a470
        #14 0x000055881616adf4 in find_cig_enumerate (data=0x7c5add004a00) at profiles/audio/bap.c:2539
                info = <optimized out>
        #15 bap_update_cigs_cb (user_data=0x7c5add004a00) at profiles/audio/bap.c:2688
                data = 0x7c5add004a00
                cigs = <optimized out>
                unset = <optimized out>
        #16 0x00007f9adec60b9b in ?? () from /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
        No symbol table info available.
        #17 0x00007f9adec621d7 in ?? () from /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
        No symbol table info available.
        #18 0x00007f9adec62577 in g_main_loop_run () from /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
        No symbol table info available.
        #19 0x000055881649f1c9 in mainloop_run () at src/shared/mainloop-glib.c:65
        No locals.
        #20 0x000055881649fafb in mainloop_run_with_signal (func=func@entry=0x558816304c80 <signal_callback>, user_data=user_data@entry=0x0) at src/shared/mainloop-notify.c:196
                data = 0x7bcadcfe3490
                io = 0x7bdadcff9b10
                ret = <optimized out>
        #21 0x000055881601d3db in main (argc=<optimized out>, argv=<optimized out>) at src/main.c:1713
                context = <optimized out>
                err = <optimized out>
                sdp_mtu = 0
                sdp_flags = <optimized out>
                gdbus_flags = <optimized out>
                __func__ = "main""


https://github.com/bluez/bluez/pull/2533

---
Regards,
Linux Bluetooth

[PATCH BlueZ v1 02/11] bass: wait for the session to be ready before pushing a source

[Luiz Augusto von Dentz]

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

A Broadcast Assistant could write to the Broadcast Audio Scan Control
Point of a Scan Delegator before its own session had enabled the
Broadcast Receive State notifications, as the connection was completed
as soon as the session was attached.

When that happens the delegator handles the Add Source, sets the state
to request the sync info to be transferred, and notifies it, but the
notification is dropped since the assistant has not subscribed yet. The
assistant never learns it has to transfer the sync info, so PAST never
happens, and the delegator is left waiting for it until the kernel
gives up, which takes 20 seconds, and falls back to creating the sync
itself.

Complete the connection only once the session is ready, and queue any
push received in the meantime, replaying it afterwards, so it is not
rejected just because the user was quick.

With this the sync info is transferred right after the Add Source, and
test_bass_past_transport_acquire consistently takes around 11 seconds
instead of intermittently taking over 40 seconds when the transfer was
missed.

Assisted-by: opencode:claude-opus-5
---
 profiles/audio/bass.c | 124 +++++++++++++++++++++++++++++++++++++-----
 1 file changed, 109 insertions(+), 15 deletions(-)

diff --git a/profiles/audio/bass.c b/profiles/audio/bass.c
index 533d45babfeb..c9a9111e010f 100644
--- a/profiles/audio/bass.c
+++ b/profiles/audio/bass.c
@@ -94,6 +94,14 @@ struct bass_data {
 	unsigned int cp_id;
 	unsigned int bis_id;
 	unsigned int state_id;
+	unsigned int ready_id;
+	bool ready;
+	struct queue *pushes;
+};
+
+struct bass_push {
+	struct bass_assistant *assistant;
+	DBusMessage *msg;
 };
 
 struct bass_assistant {
@@ -1218,10 +1226,31 @@ static DBusMessage *push_add_src(struct bass_assistant *assistant,
 	return g_dbus_create_reply(msg, DBUS_TYPE_INVALID);
 }
 
+static DBusMessage *push_src(struct bass_assistant *assistant,
+							DBusMessage *msg)
+{
+	if (assistant->state == ASSISTANT_STATE_ACTIVE) {
+		return push_mod_src(assistant, msg);
+	} else if (assistant->state == ASSISTANT_STATE_LOCAL) {
+		struct bass_src *src;
+
+		src = queue_find(assistant->srcs, match_src_data,
+						assistant->data->bass);
+		if (src) {
+			assistant->src_id = src->src_id;
+			return push_mod_src(assistant, msg);
+		}
+	}
+
+	return push_add_src(assistant, msg);
+}
+
 static DBusMessage *push(DBusConnection *conn, DBusMessage *msg,
 							  void *user_data)
 {
 	struct bass_assistant *assistant = user_data;
+	struct bass_data *data;
+	struct bass_push *push;
 	DBusMessageIter props, dict;
 
 	DBG("");
@@ -1240,20 +1269,25 @@ static DBusMessage *push(DBusConnection *conn, DBusMessage *msg,
 		return btd_error_invalid_args(msg);
 	}
 
-	if (assistant->state == ASSISTANT_STATE_ACTIVE) {
-		return push_mod_src(assistant, msg);
-	} else if (assistant->state == ASSISTANT_STATE_LOCAL) {
-		struct bass_src *src;
+	/* Wait for the session to be ready before writing to the control
+	 * point, otherwise the Broadcast Receive State notifications may not
+	 * be enabled yet and the state changes it triggers, e.g. a request to
+	 * transfer the sync info, would be missed.
+	 */
+	data = queue_find(sessions, match_bass, assistant->data->bass);
+	if (data && !data->ready) {
+		DBG("Session not ready, queueing request");
 
-		src = queue_find(assistant->srcs, match_src_data,
-						assistant->data->bass);
-		if (src) {
-			assistant->src_id = src->src_id;
-			return push_mod_src(assistant, msg);
-		}
+		push = new0(struct bass_push, 1);
+		push->assistant = assistant;
+		push->msg = dbus_message_ref(msg);
+
+		queue_push_tail(data->pushes, push);
+
+		return NULL;
 	}
 
-	return push_add_src(assistant, msg);
+	return push_src(assistant, msg);
 }
 
 static const GDBusMethodTable assistant_methods[] = {
@@ -1754,6 +1788,7 @@ static struct bass_data *bass_data_new(struct btd_adapter *adapter,
 	data = new0(struct bass_data, 1);
 	data->adapter = adapter;
 	data->device = device;
+	data->pushes = queue_new();
 
 	return data;
 }
@@ -1788,6 +1823,19 @@ static void bass_data_add(struct bass_data *data)
 		device_set_past_support(data->device, true);
 }
 
+static void bass_push_free(void *user_data)
+{
+	struct bass_push *push = user_data;
+	DBusMessage *reply;
+
+	reply = btd_error_failed(push->msg, "Session removed");
+	if (reply)
+		g_dbus_send_message(btd_get_dbus_connection(), reply);
+
+	dbus_message_unref(push->msg);
+	free(push);
+}
+
 static void bass_data_free(struct bass_data *data)
 {
 	if (data->service) {
@@ -1798,6 +1846,11 @@ static void bass_data_free(struct bass_data *data)
 	bt_bass_src_unregister(data->bass, data->src_id);
 	bt_bass_cp_handler_unregister(data->bass, data->cp_id);
 
+	if (data->ready_id)
+		bt_bass_ready_unregister(data->bass, data->ready_id);
+
+	queue_destroy(data->pushes, bass_push_free);
+
 	bt_bass_unref(data->bass);
 
 	queue_remove_all(assistants, assistant_match_data,
@@ -2365,6 +2418,35 @@ static void bass_remove(struct btd_service *service)
 	bass_data_remove(data);
 }
 
+static void bass_ready(struct bt_bass *bass, void *user_data)
+{
+	struct btd_service *service = user_data;
+	struct bass_data *data = btd_service_get_user_data(service);
+	struct bass_push *push;
+
+	DBG("bass %p", bass);
+
+	/* The callback is unregistered with the session, not here, as it is
+	 * called while the ready callbacks are being iterated.
+	 */
+	btd_service_connecting_complete(service, 0);
+
+	if (!data)
+		return;
+
+	data->ready = true;
+
+	while ((push = queue_pop_head(data->pushes))) {
+		DBusMessage *reply = push_src(push->assistant, push->msg);
+
+		if (reply)
+			g_dbus_send_message(btd_get_dbus_connection(), reply);
+
+		dbus_message_unref(push->msg);
+		free(push);
+	}
+}
+
 static int bass_accept(struct btd_service *service)
 {
 	struct btd_device *device = btd_service_get_device(service);
@@ -2383,10 +2465,22 @@ static int bass_accept(struct btd_service *service)
 	/* Only attach client if initiator of the connection otherwise act as
 	 * delegator.
 	 */
-	if (btd_service_is_initiator(service) &&
-			!bt_bass_attach(data->bass, client)) {
-		error("BASS unable to attach");
-		return -EINVAL;
+	if (btd_service_is_initiator(service)) {
+		/* Complete the connection once the session is ready, so no
+		 * operation is attempted before the Broadcast Receive State
+		 * notifications are enabled, otherwise the state changes they
+		 * trigger, e.g. a request to transfer the sync info, would be
+		 * missed.
+		 */
+		data->ready_id = bt_bass_ready_register(data->bass, bass_ready,
+							service, NULL);
+
+		if (!bt_bass_attach(data->bass, client)) {
+			error("BASS unable to attach");
+			return -EINVAL;
+		}
+
+		return 0;
 	}
 
 	btd_service_connecting_complete(service, 0);
-- 
2.55.0

[PATCH BlueZ v1 03/11] test: functional: report what a test is waiting for

[Luiz Augusto von Dentz]

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

A test that is stuck gives no clue about what it is waiting for until it
times out, which makes it hard to tell a slow test from a hung one.

Report the calls that take too long, along with how much of their
timeout is left. When the terminal can be updated in place the report is
refreshed as it goes and erased once the call completes, so only the
waits that are actually slow are visible. The workers of pytest-xdist
share the terminal, and none of them can update a line of its own, so
they report whole lines instead, prefixed with the worker they come
from.

The report goes to the terminal directly, as pytest captures the output
at file descriptor level, and is disabled when there is none, e.g. under
CI, or with --progress=no.

Assisted-by: opencode:claude-opus-5
---
 test/functional/conftest.py | 201 ++++++++++++++++++++++++++++++++++++
 1 file changed, 201 insertions(+)

diff --git a/test/functional/conftest.py b/test/functional/conftest.py
index ce6301319031..4e0bda882de3 100644
--- a/test/functional/conftest.py
+++ b/test/functional/conftest.py
@@ -2,9 +2,14 @@
 # SPDX-License-Identifier: GPL-2.0-or-later
 import os
 import re
+import sys
+import threading
+import time
 from pathlib import Path
 import pytest
 
+from pytest_bluezenv import rpc, utils
+
 from .le_utils import host_setup_is_le, pair_le
 
 
@@ -15,15 +20,211 @@ def pytest_addoption(parser):
         default=None,
         help=("List tests"),
     )
+    parser.addoption(
+        "--progress",
+        action="store",
+        default=None,
+        choices=["yes", "no"],
+        help=("Show what a test is waiting for (default: yes on a tty)"),
+    )
+
+
+# Wait for this long before reporting what a call is waiting for, so the
+# calls that complete right away do not produce any output
+PROGRESS_DELAY = 1.0
+PROGRESS_INTERVAL = 0.25
+
+# When the line cannot be updated in place the report is repeated at this
+# interval instead, and only once the call is taking clearly too long
+PROGRESS_LINE_DELAY = 5.0
+PROGRESS_LINE_INTERVAL = 10.0
+
+PROGRESS_STREAM = None
+
+
+class Status:
+    """
+    Status line telling what a test is waiting for, updated in place by
+    the terminal reporter of pytest so the report it writes itself is
+    left alone.
+    """
+
+    def __init__(self, reporter):
+        self.reporter = reporter
+        self.shown = False
+
+    def show(self, text):
+        # Leave the line pytest is on, so what it reports there is not
+        # overwritten by the status. Nothing is written when the line
+        # is already one of ours.
+        if not self.shown:
+            self.reporter.ensure_newline()
+            self.shown = True
+
+        self.reporter.rewrite(text, erase=True, light=True)
+
+    def clear(self):
+        if not self.shown:
+            return
+
+        self.reporter.rewrite("", erase=True)
+        self.shown = False
+
+
+def _progress_desc(name, method, a):
+    """
+    Describe what a call is waiting for, e.g.
+
+        host.0.1: pexpect.expect 'Pairing successful'
+    """
+    if method == "call_plugin" and len(a) > 1:
+        plugin, func, args = a[0], a[1], a[2:]
+
+        # Drop the identifier of the spawned process, if any
+        if args and isinstance(args[0], int):
+            args = args[1:]
+
+        desc = f"{plugin}.{func}"
+    else:
+        desc, args = str(method), a
+
+    if args:
+        arg = args[0]
+        # Calls running something on a host pass the function itself
+        arg = getattr(arg, "__name__", None) or str(arg)
+        if len(arg) > 60:
+            arg = arg[:57] + "..."
+        desc = f"{desc} {arg!r}"
+
+    return f"{name}: {desc}" if name else desc
+
+
+def _progress_status(elapsed, timeout):
+    if timeout:
+        left = max(0.0, timeout - elapsed)
+        return f"{elapsed:.0f}s, {left:.0f}s left"
+
+    return f"{elapsed:.0f}s"
+
+
+def _progress_run(status, desc, timeout, done, stream=None, prefix=""):
+    start = time.monotonic()
+    next_line = PROGRESS_LINE_DELAY
+
+    while not done.wait(PROGRESS_INTERVAL if status else 0.5):
+        elapsed = time.monotonic() - start
+
+        if status:
+            if elapsed < PROGRESS_DELAY:
+                continue
+
+            status.show(f"waiting {desc} [{_progress_status(elapsed, timeout)}]")
+            continue
+
+        # The line cannot be updated in place, so report it as it goes
+        if elapsed < next_line:
+            continue
+
+        next_line = elapsed + PROGRESS_LINE_INTERVAL
+        stream.write(
+            f"{prefix}waiting {desc}" f" [{_progress_status(elapsed, timeout)}]\n"
+        )
+        stream.flush()
+
+    if status:
+        status.clear()
+
+
+def _progress_call(orig, status=None, stream=None, prefix=""):
+    def call(self, method, *a, **kw):
+        # The timeout of the calls waiting for something on a host is the
+        # one used by the plugin serving them
+        timeout = kw.get("timeout")
+        if not timeout and method == "call_plugin" and "expect" in a[:2]:
+            timeout = utils.DEFAULT_TIMEOUT
+
+        name = getattr(self.log, "name", "")
+        name = name[len("rpc.") :] if name.startswith("rpc.") else ""
+
+        done = threading.Event()
+        progress = threading.Thread(
+            target=_progress_run,
+            args=(status, _progress_desc(name, method, a), timeout, done),
+            kwargs={"stream": stream, "prefix": prefix},
+            daemon=True,
+        )
+        progress.start()
+
+        try:
+            return orig(self, method, *a, **kw)
+        finally:
+            done.set()
+            progress.join()
+
+    return call
+
+
+def _setup_progress(config):
+    """
+    Report what a test is waiting for, so it is possible to tell when one
+    is taking longer than it should.
+    """
+    global PROGRESS_STREAM
+
+    if config.option.progress == "no":
+        return
+
+    # The workers of pytest-xdist run in their own process and share the
+    # terminal with each other and with the controller reporting the
+    # results, so none of them can update a line of its own: report the
+    # calls taking too long as whole lines instead
+    worker = getattr(config, "workerinput", None)
+
+    if not worker:
+        reporter = config.pluginmanager.get_plugin("terminalreporter")
+
+        # No markup means no terminal to update a line on, e.g. when the
+        # output is redirected or under CI
+        if not reporter or not reporter.hasmarkup:
+            return
+
+        rpc.Connection.call = _progress_call(
+            rpc.Connection.call, status=Status(reporter)
+        )
+        return
+
+    # The output of a worker is captured at file descriptor level and
+    # forwarded to the controller, so it goes to the terminal directly
+    try:
+        PROGRESS_STREAM = open("/dev/tty", "w", buffering=1)
+    except OSError:
+        # Not running from a terminal, e.g. under CI
+        return
+
+    rpc.Connection.call = _progress_call(
+        rpc.Connection.call,
+        stream=PROGRESS_STREAM,
+        prefix=f"[{worker['workerid']}] ",
+    )
 
 
 def pytest_configure(config):
+    _setup_progress(config)
+
     if config.option.list:
         config.option.reportchars = "A"
         config.option.no_header = True
         config.option.verbose = -2
 
 
+def pytest_unconfigure(config):
+    global PROGRESS_STREAM
+
+    if PROGRESS_STREAM:
+        PROGRESS_STREAM.close()
+        PROGRESS_STREAM = None
+
+
 COLLECT_ERRORS = []
 
 
-- 
2.55.0

[PATCH BlueZ v1 04/11] test: functional: answer the notification registered by the victim

[Luiz Augusto von Dentz]

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

The AVRCP target of the NN-2026-0145 test tells the victim it supports
the track changed event, so the victim registers a notification for it,
but the target never answers it.

The request then times out after 10 seconds, is retried once, and times
out again, so the victim only sends the ListPlayerAttributes the test
needs 20 seconds later, which is most of the time the test takes.

Answer it with an interim response, as a target would.

Assisted-by: opencode:claude-opus-5
---
 test/functional/test_avrcp.py | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/test/functional/test_avrcp.py b/test/functional/test_avrcp.py
index f6ede96cbc0b..da892d1e8be2 100644
--- a/test/functional/test_avrcp.py
+++ b/test/functional/test_avrcp.py
@@ -70,6 +70,7 @@ def check_avrcp_GHSA_m2vx_pw5f_rc8v(bus):
     AVCTP_RESPONSE = 1
     AVC_CTYPE_ACCEPTED = 0x09
     AVC_CTYPE_STABLE = 0x0C
+    AVC_CTYPE_INTERIM = 0x0F
     AVC_OP_VENDORDEP = 0x00
     AVC_SUBUNIT_PANEL = 0x09
 
@@ -213,6 +214,18 @@ def check_avrcp_GHSA_m2vx_pw5f_rc8v(bus):
                     )
                 elif pdu_id == PDU_REGISTER_NOTIFICATION:
                     print("[*] RegisterNotification: %s" % hexdump(params), flush=True)
+
+                    # Answer as a target would, otherwise the request
+                    # times out and is retried, and the controller only
+                    # moves on to the next one 20 seconds later
+                    self.response(
+                        transaction,
+                        AVC_CTYPE_INTERIM,
+                        avrcp_pdu(
+                            PDU_REGISTER_NOTIFICATION,
+                            bytes([EVENT_TRACK_CHANGED]) + bytes(8),
+                        ),
+                    )
                 else:
                     self.response(transaction, 0x0A, avrcp_pdu(pdu_id, b"\x00"))
 
-- 
2.55.0

[PATCH BlueZ v1 05/11] doc: describe the BAP coordinated set test cases

[Luiz Augusto von Dentz]

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

Assisted-by: opencode:claude-opus-5
---
 doc/functional-bap.rst | 101 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 101 insertions(+)

diff --git a/doc/functional-bap.rst b/doc/functional-bap.rst
index f9392bd2dbce..78411f4dd47d 100644
--- a/doc/functional-bap.rst
+++ b/doc/functional-bap.rst
@@ -288,3 +288,104 @@ test_bass_past_transport_acquire
 	The stream is verified on the delegator rather than through the
 	state of the MediaAssistant object, as an object created for a
 	local stream stays in the ``local`` state.
+
+COORDINATED SET
+===============
+
+Three hosts, with the two acceptors forming a coordinated set, one for
+each side, so the initiator has to discover both before it can stream:
+
+.. code-block::
+
+	+------------------------+                 +------------------------+
+	| host1                  |      LE ACL     | host0                  |
+	| acceptor, left         | <-------------- | initiator (central)    |
+	| bluetoothctl -a auto   |                 | bluetoothctl -a auto   |
+	| bap-sink-lc3-left.bt   |  CIS 0x00 (LC3) | bap-source-lc3.bt      |
+	| PAC Sink, Front Left   | <============== | PAC Source endpoint    |
+	+------------------------+                 |                        |
+	                                           |                        |
+	+------------------------+      LE ACL     |                        |
+	| host2                  | <-------------- |                        |
+	| acceptor, right        |                 |                        |
+	| bluetoothctl -a auto   |  CIS 0x01 (LC3) |                        |
+	| bap-sink-lc3-right.bt  | <============== |                        |
+	| PAC Sink, Front Right  |                 |                        |
+	+------------------------+                 +------------------------+
+
+	both acceptors share the same SIRK, so they are resolved into a
+	single set, and one CIS per member carries its channel
+
+	--> connection is initiated by      ==> audio flows towards
+
+The acceptors run `bluetoothd` with the same SIRK, so the initiator
+resolves them into one set:
+
+.. code-block::
+
+	[CSIS]
+	SIRK = 861FAE703ED681F0C50B34155B6434FB
+	Size = 2
+	Rank = 1
+
+``Rank`` differs per member, 1 for the left and 2 for the right one,
+while ``SIRK`` and ``Size`` are the same, as they describe the set.
+
+Each acceptor also has to include the RSI in its advertising, with
+``advertise.rsi on``, otherwise the initiator cannot tell the two are
+members of the same set, and the resolved set does not appear as a
+**org.bluez.DeviceSet(5)** object.
+
+``client/scripts/bap-sink-lc3-left.bt`` on host1
+	Registers a local PAC Sink endpoint
+	(``00002bc9-0000-1000-8000-00805f9b34fb``) with LC3 and Front Left
+	as its only location, and advertises with the RSI.
+
+``client/scripts/bap-sink-lc3-right.bt`` on host2
+	As above, with Front Right as its only location.
+
+Each acceptor takes a single channel, unlike the stereo unicast case
+where one acceptor takes both: registering exactly one location makes
+`bluetoothctl` add the channel count to the capabilities, so a member
+is only ever configured for its own channel.
+
+test_bap_unicast_set_transport_created
+--------------------------------------
+
+:Setup: As above.
+
+:Steps:
+	1. Start `bluetoothctl` with the scripts on the three hosts.
+	2. Pair the initiator with each acceptor over LE.
+	3. Initiator: ``endpoint.config <remote endpoint>
+	   /local/endpoint/ep0 16_2_1``, for the remote PAC Sink endpoint
+	   of each member.
+
+:Expected:
+	1. ``Endpoint /local/endpoint/ep0 registered`` on the three hosts.
+	2. ``Pairing successful`` for both, and the members are resolved
+	   into a single set, reported as
+	   ``[NEW] DeviceSet /org/bluez/hci0/set_<sirk>`` listing both
+	   devices.
+	3. A transport is created for each member, one per channel, i.e.
+	   one for the Front Left endpoint and one for the Front Right
+	   one.
+
+:Notes: Without the same SIRK, or without the RSI in the advertising,
+	the members are not resolved into a set and each is streamed to
+	on its own, which is not what this test covers.
+
+test_bap_unicast_set_transport_acquire
+--------------------------------------
+
+:Setup: As above, with the transports already created.
+
+:Steps: Initiator: ``transport.acquire <left> <right>``, for the
+	transports of both members.
+
+:Expected: ``Acquire successful: fd <fd> MTU <read>:<write>`` for each
+	transport, and both move to ``State: active``.
+
+:Notes: As for a stereo stream to a single acceptor, the CIS are only
+	created once every CIS of the CIG is ready, so the transports of
+	both members have to be acquired.
-- 
2.55.0

[PATCH BlueZ v1 06/11] emulator: use the handle of the receiving side

[Luiz Augusto von Dentz]

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

Every device assigns its own connection handles, so the two sides of a
link do not necessarily know it by the same handle: conn_link() picks
the lowest one free on each device, which differ as soon as a device
has more than one connection.

The events and the data delivered to the peer carried the handle of the
sender though, so the receiving side got a handle it knows nothing
about and dropped what it received: with three devices the second link
of the initiator is handle 2 on it and handle 1 on the peer, so neither
the ACL data nor the CIS requests reached their destination.

Give the receiving side its own handle, as the disconnection already
does, for the data as well as for the events reporting a connection, a
key request, a connection update and the CIS of a CIG.

This changes nothing for two devices, as both sides then assign the
same handles.

Assisted-by: opencode:claude-opus-5
---
 emulator/btdev.c | 84 ++++++++++++++++++++++++++++++++++++------------
 1 file changed, 64 insertions(+), 20 deletions(-)

diff --git a/emulator/btdev.c b/emulator/btdev.c
index fcc516f4947c..e29e050fad59 100644
--- a/emulator/btdev.c
+++ b/emulator/btdev.c
@@ -1589,9 +1589,14 @@ static int cmd_add_sco_conn(struct btdev *dev, const void *data, uint8_t len)
 done:
 	send_event(dev, BT_HCI_EVT_CONN_COMPLETE, &cc, sizeof(cc));
 
-	if (conn)
+	if (conn) {
+		/* Each device assigns its own handles, so the event of
+		 * the receiving side carries its handle.
+		 */
+		cc.handle = cpu_to_le16(conn->link->handle);
 		send_event(conn->link->dev, BT_HCI_EVT_CONN_COMPLETE,
 							&cc, sizeof(cc));
+	}
 
 	return 0;
 }
@@ -4196,12 +4201,17 @@ static void le_conn_complete(struct btdev *btdev,
 			memcpy(cc.peer_addr, btdev->bdaddr, 6);
 
 		cc.role = 0x01;
-		cc.handle = cpu_to_le16(conn->handle);
+		/* Each device assigns its own handles, so the event of
+		 * the receiving side carries its handle.
+		 */
+		cc.handle = cpu_to_le16(conn->link->handle);
 		cc.interval = lecc->max_interval;
 		cc.latency = lecc->latency;
 		cc.supv_timeout = lecc->supv_timeout;
 		le_meta_event(conn->link->dev, BT_HCI_EVT_LE_CONN_COMPLETE,
 					&cc, sizeof(cc));
+
+		cc.handle = cpu_to_le16(conn->handle);
 	}
 
 	cc.status = status;
@@ -4709,10 +4719,12 @@ static void le_conn_update(struct btdev *btdev, uint16_t handle,
 	le_meta_event(btdev, BT_HCI_EVT_LE_CONN_UPDATE_COMPLETE, &ev,
 					sizeof(ev));
 
-	if (conn)
+	if (conn) {
+		ev.handle = cpu_to_le16(conn->link->handle);
 		le_meta_event(conn->link->dev,
 					BT_HCI_EVT_LE_CONN_UPDATE_COMPLETE,
 					&ev, sizeof(ev));
+	}
 }
 
 static void le_conn_param_req(struct btdev *btdev, uint16_t handle,
@@ -4729,7 +4741,7 @@ static void le_conn_param_req(struct btdev *btdev, uint16_t handle,
 
 	memset(&ev, 0, sizeof(ev));
 
-	ev.handle = cpu_to_le16(handle);
+	ev.handle = cpu_to_le16(conn->link->handle);
 	ev.min_interval = cpu_to_le16(min_interval);
 	ev.max_interval = cpu_to_le16(max_interval);
 	ev.latency = cpu_to_le16(latency);
@@ -4845,7 +4857,7 @@ static int cmd_start_encrypt(struct btdev *dev, const void *data, uint8_t len)
 
 	memcpy(dev->le_ltk, cmd->ltk, 16);
 
-	ev.handle = cpu_to_le16(conn->handle);
+	ev.handle = cpu_to_le16(conn->link->handle);
 	ev.ediv = cmd->ediv;
 	ev.rand = cmd->rand;
 
@@ -5003,7 +5015,7 @@ static int cmd_conn_param_neg_reply_complete(struct btdev *dev,
 
 	memset(&ev, 0, sizeof(ev));
 
-	ev.handle = cpu_to_le16(cmd->handle);
+	ev.handle = cpu_to_le16(conn->link->handle);
 	ev.status = cpu_to_le16(cmd->reason);
 
 	le_meta_event(conn->link->dev, BT_HCI_EVT_LE_CONN_UPDATE_COMPLETE, &ev,
@@ -6190,7 +6202,10 @@ static void le_ext_conn_complete(struct btdev *btdev,
 			memcpy(ev.peer_addr, btdev->bdaddr, 6);
 
 		ev.role = 0x01;
-		ev.handle = cpu_to_le16(conn->handle);
+		/* Each device assigns its own handles, so the event of
+		 * the receiving side carries its handle.
+		 */
+		ev.handle = cpu_to_le16(conn->link->handle);
 		ev.interval = lecc->max_interval;
 		ev.latency = lecc->latency;
 		ev.supv_timeout = lecc->supv_timeout;
@@ -6205,7 +6220,10 @@ static void le_ext_conn_complete(struct btdev *btdev,
 				sizeof(ev));
 
 		/* Disable EXT ADV */
-		queue_foreach(conn->link->dev->le_ext_adv, ext_adv_term, conn);
+		queue_foreach(conn->link->dev->le_ext_adv, ext_adv_term,
+								conn->link);
+
+		ev.handle = cpu_to_le16(conn->handle);
 	}
 
 	ev.status = status;
@@ -7063,9 +7081,11 @@ static void le_cis_estabilished(struct btdev *dev, struct btdev_conn *conn,
 
 	le_meta_event(dev, BT_HCI_EVT_LE_CIS_ESTABLISHED, &evt, sizeof(evt));
 
-	if (conn)
+	if (conn) {
+		evt.conn_handle = cpu_to_le16(conn->link->handle);
 		le_meta_event(conn->link->dev, BT_HCI_EVT_LE_CIS_ESTABLISHED,
 						&evt, sizeof(evt));
+	}
 }
 
 static int cmd_create_cis_complete(struct btdev *dev, const void *data,
@@ -7110,8 +7130,11 @@ static int cmd_create_cis_complete(struct btdev *dev, const void *data,
 			}
 		}
 
-		evt.acl_handle = cpu_to_le16(acl->handle);
-		evt.cis_handle = cpu_to_le16(iso->handle);
+		/* Each device assigns its own handles, so the event of
+		 * the receiving side carries its handles.
+		 */
+		evt.acl_handle = cpu_to_le16(acl->link->handle);
+		evt.cis_handle = cpu_to_le16(iso->link->handle);
 		evt.cig_id = le_cig->params.cig_id;
 		evt.cis_id = le_cig->cis[cis_idx].cis_id;
 
@@ -8737,6 +8760,7 @@ static void send_acl(struct btdev *dev, const void *data, uint16_t len)
 	struct iovec iov[3];
 	struct btdev_conn *conn;
 	uint8_t pkt_type = BT_H4_ACL_PKT;
+	uint8_t flags;
 
 	/* Packet type */
 	iov[0].iov_base = &pkt_type;
@@ -8751,11 +8775,18 @@ static void send_acl(struct btdev *dev, const void *data, uint16_t len)
 
 	num_completed_packets(dev, conn);
 
+	flags = acl_flags(hdr.handle);
+
 	/* ACL_START_NO_FLUSH is only allowed from host to controller.
 	 * From controller to host this should be converted to ACL_START.
 	 */
-	if (acl_flags(hdr.handle) == ACL_START_NO_FLUSH)
-		hdr.handle = acl_handle_pack(conn->handle, ACL_START);
+	if (flags == ACL_START_NO_FLUSH)
+		flags = ACL_START;
+
+	/* Each device assigns its own handles, so the one of the
+	 * receiving side has to be used.
+	 */
+	hdr.handle = acl_handle_pack(conn->link->handle, flags);
 
 	iov[1].iov_base = &hdr;
 	iov[1].iov_len = sizeof(hdr);
@@ -8794,8 +8825,8 @@ static void send_sco(struct btdev *dev, const void *data, uint16_t len)
 
 static void send_iso(struct btdev *dev, const void *data, uint16_t len)
 {
-	struct bt_hci_acl_hdr *hdr;
-	struct iovec iov[2];
+	struct bt_hci_acl_hdr hdr;
+	struct iovec iov[3];
 	struct btdev_conn *conn;
 	uint8_t pkt_type = BT_H4_ISO_PKT;
 
@@ -8803,18 +8834,31 @@ static void send_iso(struct btdev *dev, const void *data, uint16_t len)
 	iov[0].iov_base = &pkt_type;
 	iov[0].iov_len = sizeof(pkt_type);
 
-	iov[1].iov_base = hdr = (void *) (data);
-	iov[1].iov_len = len;
+	memcpy(&hdr, data, sizeof(hdr));
 
 	conn = queue_find(dev->conns, match_handle,
-					UINT_TO_PTR(acl_handle(hdr->handle)));
+					UINT_TO_PTR(acl_handle(hdr.handle)));
 	if (!conn)
 		return;
 
 	num_completed_packets(dev, conn);
 
-	if (conn->link)
-		send_packet(conn->link->dev, iov, 2);
+	if (!conn->link)
+		return;
+
+	/* Each device assigns its own handles, so the one of the
+	 * receiving side has to be used.
+	 */
+	hdr.handle = acl_handle_pack(conn->link->handle,
+						acl_flags(hdr.handle));
+
+	iov[1].iov_base = &hdr;
+	iov[1].iov_len = sizeof(hdr);
+
+	iov[2].iov_base = (void *) (data + sizeof(hdr));
+	iov[2].iov_len = len - sizeof(hdr);
+
+	send_packet(conn->link->dev, iov, 3);
 }
 
 void btdev_receive_h4(struct btdev *btdev, const void *data, uint16_t len)
-- 
2.55.0

[PATCH BlueZ v1 07/11] emulator: allow the maximum number of CIS of a CIG

[Luiz Augusto von Dentz]

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

The Num_CIS of LE Set CIG Parameters ranges from 0x00 to 0x1f, but only
three CIS were accepted, so setting up a CIG with more of them failed
with Memory Capacity Exceeded.

A CIG has one CIS per direction of every member of a coordinated set,
so four of them are needed for a stereo stream to a set of two.

Take the maximum the command allows, which the handles of a CIG have
room for: they start at CIS_HANDLE and the ones of a BIG only start at
BIS_HANDLE, 256 handles later.

Assisted-by: opencode:claude-opus-5
---
 emulator/btdev.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/emulator/btdev.c b/emulator/btdev.c
index e29e050fad59..26a8aff62d85 100644
--- a/emulator/btdev.c
+++ b/emulator/btdev.c
@@ -40,7 +40,10 @@
 
 #define AL_SIZE			16
 #define RL_SIZE			16
-#define CIS_SIZE		3
+/* Maximum number of CIS of a CIG, as the Num_CIS of LE Set CIG
+ * Parameters ranges from 0x00 to 0x1f
+ */
+#define CIS_SIZE		31
 #define BIS_SIZE		3
 #define CIG_SIZE		3
 
-- 
2.55.0

[PATCH BlueZ v1 08/11] device: keep the long term key of both roles

[Luiz Augusto von Dentz]

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

LE legacy pairing distributes one long term key per role: each side
generates its own and gives it to the peer, which uses it to encrypt
the link when that side is the peripheral. Secure Connections derives a
single key instead, so there is only one to keep.

Only one key was kept though, whichever arrived last, so the key ending
up on each side of a legacy bond was not necessarily the same one.

Encrypting the SIRK of a coordinated set then gave a value the other
side was unable to decrypt, as sef() is only symmetric when both sides
use the same key, and the set was resolved under a SIRK that is not the
one the members were configured with.

Keep the key of each role and select the one matching the role of the
link, so both sides use the key the peripheral distributed.

Assisted-by: opencode:claude-opus-5
---
 src/device.c | 45 +++++++++++++++++++++++++++++++++++----------
 1 file changed, 35 insertions(+), 10 deletions(-)

diff --git a/src/device.c b/src/device.c
index 8da576ec5932..c63cc80856bb 100644
--- a/src/device.c
+++ b/src/device.c
@@ -282,7 +282,10 @@ struct btd_device {
 
 	struct csrk_info *local_csrk;
 	struct csrk_info *remote_csrk;
-	struct ltk_info *ltk;
+	struct ltk_info *ltk;		/* Used when acting as central */
+	struct ltk_info *peripheral_ltk;	/* Used when acting as
+						 * peripheral
+						 */
 	struct queue	*sirks;
 
 	sdp_list_t	*tmp_records;
@@ -957,6 +960,7 @@ static void device_free(gpointer user_data)
 	g_free(device->local_csrk);
 	g_free(device->remote_csrk);
 	free(device->ltk);
+	free(device->peripheral_ltk);
 	g_free(device->path);
 	g_free(device->alias);
 	free(device->modalias);
@@ -2132,12 +2136,19 @@ static void add_set(void *data, void *user_data)
 void device_set_ltk(struct btd_device *device, const uint8_t val[16],
 				bool central, uint8_t enc_size)
 {
-	if (!device->ltk)
-		device->ltk = new0(struct ltk_info, 1);
+	struct ltk_info **ltk;
 
-	memcpy(device->ltk->key, val, sizeof(device->ltk->key));
-	device->ltk->central = central;
-	device->ltk->enc_size = enc_size;
+	/* Legacy pairing distributes one key per role, so both are kept
+	 * to let each of them be selected by the role of the link.
+	 */
+	ltk = central ? &device->ltk : &device->peripheral_ltk;
+
+	if (!*ltk)
+		*ltk = new0(struct ltk_info, 1);
+
+	memcpy((*ltk)->key, val, sizeof((*ltk)->key));
+	(*ltk)->central = central;
+	(*ltk)->enc_size = enc_size;
 	bt_att_set_enc_key_size(device->att, enc_size);
 
 	/* Check if there is any set/sirk that needs decryption */
@@ -2147,16 +2158,27 @@ void device_set_ltk(struct btd_device *device, const uint8_t val[16],
 bool btd_device_get_ltk(struct btd_device *device, uint8_t key[16],
 				bool *central, uint8_t *enc_size)
 {
-	if (!device || !device->ltk || !key)
+	struct ltk_info *ltk;
+
+	if (!device || !key)
 		return false;
 
-	memcpy(key, device->ltk->key, sizeof(device->ltk->key));
+	/* The key securing the link is the one distributed by the
+	 * peripheral, so each side has to select the one matching its
+	 * role for both to use the same key.
+	 */
+	ltk = btd_device_is_initiator(device) ? device->ltk :
+						device->peripheral_ltk;
+	if (!ltk)
+		return false;
+
+	memcpy(key, ltk->key, sizeof(ltk->key));
 
 	if (central)
-		*central = device->ltk->central;
+		*central = ltk->central;
 
 	if (enc_size)
-		*enc_size = device->ltk->enc_size;
+		*enc_size = ltk->enc_size;
 
 	return true;
 }
@@ -6426,6 +6448,9 @@ static void gatt_server_init(struct btd_device *device,
 
 	if (device->ltk)
 		bt_att_set_enc_key_size(device->att, device->ltk->enc_size);
+	else if (device->peripheral_ltk)
+		bt_att_set_enc_key_size(device->att,
+					device->peripheral_ltk->enc_size);
 
 	if (btd_opts.gatt_seclevel == BT_ATT_SECURITY_LOW)
 		bt_gatt_server_set_permissions(device->server, false);
-- 
2.55.0

[PATCH BlueZ v1 09/11] client: allow a capability with the auto agent

[Luiz Augusto von Dentz]

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

The auto agent registers with no capability, which is KeyboardDisplay,
so a peer pairing with it may well choose the entry of a passkey. That
is a method the auto agent cannot answer: it only replies by itself to
the confirmation and the authorization requests, and the passkey entry
is left to the user, who is not there to answer it in a test.

The pairing then only completes once the request times out, 30 seconds
later, and it completes as a failure.

Accept a capability after the name, e.g. auto:NoInputNoOutput, to let
the capability be the one pairing Just Works, which requires no answer
at all. Plain auto keeps registering as before.

Assisted-by: opencode:claude-opus-5
---
 client/agent.c       | 14 ++++++++++++--
 client/main.c        | 14 +++++++++++---
 doc/bluetoothctl.rst |  6 +++++-
 3 files changed, 28 insertions(+), 6 deletions(-)

diff --git a/client/agent.c b/client/agent.c
index ff5e57ff27a5..a678d5f785a9 100644
--- a/client/agent.c
+++ b/client/agent.c
@@ -403,11 +403,21 @@ void agent_register(DBusConnection *conn, GDBusProxy *manager,
 
 	agent_capability = capability;
 
-	if (!strcasecmp(agent_capability, "auto")) {
+	if (!strncasecmp(agent_capability, "auto", 4) &&
+			(!agent_capability[4] || agent_capability[4] == ':')) {
 		bt_shell_printf("Warning: setting auto response is not secure, "
 				"it bypass user confirmation/authorization, it "
 				"shall only be used for test automation.\n");
-		agent_capability = "";
+		/* The capability to register with can be given after a
+		 * colon, e.g. auto:NoInputNoOutput, so the pairing does
+		 * not choose a method the auto response cannot answer,
+		 * like the entry of a passkey.
+		 */
+		if (agent_capability[4])
+			agent_capability += 5;
+		else
+			agent_capability = "";
+
 		methods = auto_methods;
 	}
 
diff --git a/client/main.c b/client/main.c
index d8d2e32d9556..4d13fa1b1e1a 100644
--- a/client/main.c
+++ b/client/main.c
@@ -1416,9 +1416,17 @@ static void cmd_agent(int argc, char *argv[])
 	dbus_bool_t enable;
 	const char *capability;
 
-	if (!parse_argument(argc, argv, agent_arguments, "capability",
-						&enable, &capability))
+	/* The capability of the auto response is given after a colon,
+	 * e.g. auto:NoInputNoOutput, so it cannot be looked up in the
+	 * list of arguments.
+	 */
+	if (argc > 1 && !strncasecmp(argv[1], "auto:", 5)) {
+		enable = TRUE;
+		capability = argv[1];
+	} else if (!parse_argument(argc, argv, agent_arguments, "capability",
+						&enable, &capability)) {
 		return bt_shell_noninteractive_quit(EXIT_FAILURE);
+	}
 
 	if (enable == TRUE) {
 		g_free(auto_register_agent);
@@ -4034,7 +4042,7 @@ static const struct bt_shell_menu main_menu = {
 							NULL },
 	{ "discoverable-timeout", "[value]", cmd_discoverable_timeout,
 					"Set discoverable timeout", NULL },
-	{ "agent",        "<on/off/auto/capability>", cmd_agent,
+	{ "agent",        "<on/off/auto[:capability]/capability>", cmd_agent,
 				"Enable/disable agent with given capability",
 							capability_generator},
 	{ "default-agent",NULL,       cmd_default_agent,
diff --git a/doc/bluetoothctl.rst b/doc/bluetoothctl.rst
index ed4cd0703281..cc58e1f5be19 100644
--- a/doc/bluetoothctl.rst
+++ b/doc/bluetoothctl.rst
@@ -301,11 +301,15 @@ for pairing and allows you to choose the IO capabilities of the controller.
 The valid agent capabilities are: DisplayOnly, DisplayYesNo, KeyboardDisplay,
 KeyboardOnly, NoInputNoOutput.
 
-:Usage: **> agent <on/off/auto/capability>**
+:Usage: **> agent <on/off/auto[:capability]/capability>**
 :Uses: **org.bluez.AgentManager(5)** method **RegisterAgent**
 :<on/off/auto/capability>: Agent mode - "on", "off", "auto", or capability type (DisplayOnly, DisplayYesNo, KeyboardDisplay, KeyboardOnly, NoInputNoOutput) (required)
 :Example Enable agent with default capability:
 	| **> agent on**
+:Example Enable agent answering automatically, only for test automation:
+	| **> agent auto**
+:Example Enable agent answering automatically with the given capability:
+	| **> agent auto:NoInputNoOutput**
 :Example Disable agent:
 	| **> agent off**
 :Example Enable agent that can only display pairing codes:
-- 
2.55.0

[PATCH BlueZ v1 10/11] test: functional: fail as soon as an operation fails

[Luiz Augusto von Dentz]

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

A test waiting for what an operation reports on success only learns
that it failed when the wait times out, 20 seconds later, and what it
reports then is the pattern it was waiting for, not the error.

Watch for the failures alongside it, so a test fails right away and
tells what went wrong, e.g. "Failed to pair:
org.bluez.Error.AlreadyExists".

Assisted-by: opencode:claude-opus-5
---
 test/functional/test_bap.py | 27 ++++++++++++++++++++++++---
 1 file changed, 24 insertions(+), 3 deletions(-)

diff --git a/test/functional/test_bap.py b/test/functional/test_bap.py
index bc9bcfb83ad8..6ffbf0371e0e 100644
--- a/test/functional/test_bap.py
+++ b/test/functional/test_bap.py
@@ -32,16 +32,32 @@ def dev_addr(host):
     return host.bdaddr.upper().replace(":", "_")
 
 
-def expect_all(ctl, patterns):
+# Reported when an operation cannot complete, so a test does not have to
+# wait for its timeout to know it is not going to
+FAILURES = [
+    r"(Failed to \w+[^\r\n]*)",
+    r"(Device \S+ not available)",
+]
+
+
+def expect_all(ctl, patterns, failures=FAILURES):
     """
     Expect all the given patterns, in any order, returning the groups
     each of them matched.
+
+    Fail as soon as one of the failures shows up, e.g. a request that
+    was rejected, instead of waiting for the timeout.
     """
     pending = list(enumerate(patterns))
     groups = [None] * len(patterns)
 
     while pending:
-        idx, m = ctl.expect([pattern for _, pattern in pending])
+        idx, m = ctl.expect(list(failures) + [pattern for _, pattern in pending])
+
+        if idx < len(failures):
+            raise AssertionError(m[0].decode("utf-8") if m else "failed")
+
+        idx -= len(failures)
         groups[pending[idx][0]] = m
         pending.pop(idx)
 
@@ -88,7 +104,12 @@ def pair_le(host0, ctl0, host1, ctl1, advertise=True, services=False):
     legacy = r"\[agent\].*Passkey:.*m(\d+)"
 
     while pending:
-        idx, m = ctl0.expect([legacy] + pending)
+        idx, m = ctl0.expect(FAILURES + [legacy] + pending)
+
+        if idx < len(FAILURES):
+            raise AssertionError(m[0].decode("utf-8") if m else "failed")
+
+        idx -= len(FAILURES)
 
         if idx == 0:
             warnings.warn(
-- 
2.55.0

[PATCH BlueZ v1 11/11] test: functional: add the BAP coordinated set tests

[Luiz Augusto von Dentz]

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

Cover a stereo unicast stream to a coordinated set of two acceptors,
one taking the left channel and one the right, which is what a pair of
earbuds does.

The acceptors advertise the RSI of the set and are configured with the
same SIRK, so the initiator resolves them into a single DeviceSet and
connects the second one on its own once the first is paired.

The endpoints are not configured by the test, as the daemon configures
a stream for them by itself, and the transports of both members are
acquired, as the CIS of a CIG are only created once every one of them
is active.

Assisted-by: opencode:claude-opus-5
---
 client/scripts/bap-sink-lc3-left.bt  |  30 ++++
 client/scripts/bap-sink-lc3-right.bt |  30 ++++
 doc/functional-bap.rst               |  38 +++--
 test/functional/test_bap.py          | 229 ++++++++++++++++++++++++++-
 4 files changed, 309 insertions(+), 18 deletions(-)
 create mode 100644 client/scripts/bap-sink-lc3-left.bt
 create mode 100644 client/scripts/bap-sink-lc3-right.bt

diff --git a/client/scripts/bap-sink-lc3-left.bt b/client/scripts/bap-sink-lc3-left.bt
new file mode 100644
index 000000000000..9ad8aad97f7a
--- /dev/null
+++ b/client/scripts/bap-sink-lc3-left.bt
@@ -0,0 +1,30 @@
+power on
+#
+#
+# Register a PAC Sink endpoint with LC3 taking a single channel, to act
+# as the left member of a coordinated set. The members of the set are
+# programmed with the same SIRK, see [CSIS] in main.conf.
+#
+endpoint.register 00002bc9-0000-1000-8000-00805f9b34fb 0x06
+# Auto Accept: accept the configuration chosen by the peer
+y
+# Max Transports: no limit
+a
+# Locations: Front Left, so only its own channel is configured
+1
+# Supported Context: same as the contexts bluetoothctl registers with
+0x0fff
+# Context
+0x0fff
+# CIG: assigned automatically
+a
+# CIS: assigned automatically
+a
+#
+#
+# Advertise the Resolvable Set Identifier, so the initiator is able to
+# resolve this device as a member of the set, otherwise it is streamed
+# to on its own.
+#
+advertise.rsi on
+advertise on
diff --git a/client/scripts/bap-sink-lc3-right.bt b/client/scripts/bap-sink-lc3-right.bt
new file mode 100644
index 000000000000..a6107383adf2
--- /dev/null
+++ b/client/scripts/bap-sink-lc3-right.bt
@@ -0,0 +1,30 @@
+power on
+#
+#
+# Register a PAC Sink endpoint with LC3 taking a single channel, to act
+# as the right member of a coordinated set. The members of the set are
+# programmed with the same SIRK, see [CSIS] in main.conf.
+#
+endpoint.register 00002bc9-0000-1000-8000-00805f9b34fb 0x06
+# Auto Accept: accept the configuration chosen by the peer
+y
+# Max Transports: no limit
+a
+# Locations: Front Right, so only its own channel is configured
+2
+# Supported Context: same as the contexts bluetoothctl registers with
+0x0fff
+# Context
+0x0fff
+# CIG: assigned automatically
+a
+# CIS: assigned automatically
+a
+#
+#
+# Advertise the Resolvable Set Identifier, so the initiator is able to
+# resolve this device as a member of the set, otherwise it is streamed
+# to on its own.
+#
+advertise.rsi on
+advertise on
diff --git a/doc/functional-bap.rst b/doc/functional-bap.rst
index 78411f4dd47d..3fc3439c118e 100644
--- a/doc/functional-bap.rst
+++ b/doc/functional-bap.rst
@@ -316,6 +316,9 @@ each side, so the initiator has to discover both before it can stream:
 	both acceptors share the same SIRK, so they are resolved into a
 	single set, and one CIS per member carries its channel
 
+	connecting one member connects the rest of the set, so the
+	initiator only connects once
+
 	--> connection is initiated by      ==> audio flows towards
 
 The acceptors run `bluetoothd` with the same SIRK, so the initiator
@@ -356,24 +359,30 @@ test_bap_unicast_set_transport_created
 
 :Steps:
 	1. Start `bluetoothctl` with the scripts on the three hosts.
-	2. Pair the initiator with each acceptor over LE.
-	3. Initiator: ``endpoint.config <remote endpoint>
-	   /local/endpoint/ep0 16_2_1``, for the remote PAC Sink endpoint
-	   of each member.
+	2. Pair the initiator with one of the acceptors over LE.
 
 :Expected:
 	1. ``Endpoint /local/endpoint/ep0 registered`` on the three hosts.
-	2. ``Pairing successful`` for both, and the members are resolved
-	   into a single set, reported as
-	   ``[NEW] DeviceSet /org/bluez/hci0/set_<sirk>`` listing both
-	   devices.
+	2. ``Pairing successful``, the members are resolved into a single
+	   set, reported as
+	   ``[NEW] DeviceSet /org/bluez/hci0/set_<sirk>``, and the other
+	   member is bonded on its own, without the initiator connecting
+	   or pairing it.
 	3. A transport is created for each member, one per channel, i.e.
 	   one for the Front Left endpoint and one for the Front Right
 	   one.
 
-:Notes: Without the same SIRK, or without the RSI in the advertising,
-	the members are not resolved into a set and each is streamed to
-	on its own, which is not what this test covers.
+	The endpoints are not configured by the test: the daemon
+	configures a stream for them on its own, and configuring them
+	again would add a CIS to the CIG for every extra configuration.
+
+:Notes: Only one member is connected: finding a member of a set
+	triggers connecting the remaining ones, so a single
+	**org.bluez.Device(5)** ``Connect`` covers the whole set.
+
+	Without the same SIRK, or without the RSI in the advertising, the
+	members are not resolved into a set, each is connected on its own
+	and the set behaviour this test covers does not happen.
 
 test_bap_unicast_set_transport_acquire
 --------------------------------------
@@ -386,6 +395,7 @@ test_bap_unicast_set_transport_acquire
 :Expected: ``Acquire successful: fd <fd> MTU <read>:<write>`` for each
 	transport, and both move to ``State: active``.
 
-:Notes: As for a stereo stream to a single acceptor, the CIS are only
-	created once every CIS of the CIG is ready, so the transports of
-	both members have to be acquired.
+:Notes: As for a stereo stream to a single acceptor, the CIS of a CIG
+	are only created once every one of them is active, so the
+	transports of both members have to be acquired: acquiring only
+	one leaves the group incomplete and no CIS is created at all.
diff --git a/test/functional/test_bap.py b/test/functional/test_bap.py
index 6ffbf0371e0e..ce11dc38dc32 100644
--- a/test/functional/test_bap.py
+++ b/test/functional/test_bap.py
@@ -4,6 +4,7 @@
 Tests for BAP (LE Audio) using bluetoothctl in VM instances
 """
 
+import re
 import warnings
 
 import pytest
@@ -78,8 +79,18 @@ def script(name):
 
 def start_bluetoothctl(host, init_script):
     exe = find_exe("client", "bluetoothctl")
-    # -a auto: accept pairing and authorize services without prompting
-    ctl = host.pexpect.spawn([exe, "-a", "auto", "--init-script", script(init_script)])
+    # Accept pairing and authorize services without prompting, with a
+    # capability pairing Just Works, as there is no one to answer the
+    # entry of a passkey
+    ctl = host.pexpect.spawn(
+        [
+            exe,
+            "-a",
+            "auto:NoInputNoOutput",
+            "--init-script",
+            script(init_script),
+        ]
+    )
     ctl.expect("Endpoint /local/endpoint/ep0 registered")
     return ctl
 
@@ -99,10 +110,69 @@ def pair_le(host0, ctl0, host1, ctl1, advertise=True, services=False):
     if services:
         pending.append(f"Device {host1.bdaddr.upper()} ServicesResolved: yes")
 
+    pair_wait(ctl0, ctl1, pending)
+
+    ctl0.send("scan off\n")
+
+
+# Transport of the remote PAC Sink endpoint of a device
+TRANSPORT = r"Transport (/org/bluez/hci0/dev_{}/pac_sink\d+/fd\d+)"
+
+# What a command reports is printed as it runs, unlike what the peers
+# report over the air, so waiting the default timeout for it only makes
+# a failure slower
+REPLY_TIMEOUT = 5
+
+
+def list_transports(ctl0, hosts):
+    """
+    List the transports already available for the given hosts, giving
+    None for those that are not.
+
+    The listing has no end of its own, so a command with a known output
+    is issued after it to tell when everything has been listed.
+    """
+    patterns = [TRANSPORT.format(dev_addr(host)) for host in hosts]
+
+    ctl0.send("transport.list\nversion\n")
+
+    transports = [None] * len(patterns)
+
+    while True:
+        idx, m = ctl0.expect([r"Version \d"] + patterns, timeout=REPLY_TIMEOUT)
+        if not idx:
+            return transports
+
+        transports[idx - 1] = m[0].decode("utf-8")
+
+
+def remove_device(ctl0, host):
+    """
+    Remove the given host, so the test starts from a state where it is
+    neither paired nor connected.
+    """
+    addr = host.bdaddr.upper()
+
+    ctl0.send(f"remove {addr}\n")
+
+    # Not matched with expect_all: a device that is not available is
+    # simply one with nothing to remove, not a failure
+    ctl0.expect(
+        rf"Device has been removed|Device {addr} not available",
+        timeout=REPLY_TIMEOUT,
+    )
+
+
+def pair_wait(ctl0, ctl1, pending):
+    """
+    Wait for the given events while answering the pairing requests.
+    """
     # See test_bluetoothctl_pair_le: passkey confirmation is handled by
     # the auto agent, but legacy passkey entry still needs an answer
     legacy = r"\[agent\].*Passkey:.*m(\d+)"
 
+    pending = list(pending)
+
     while pending:
         idx, m = ctl0.expect(FAILURES + [legacy] + pending)
 
@@ -123,8 +193,6 @@ def pair_le(host0, ctl0, host1, ctl1, advertise=True, services=False):
 
         pending.pop(idx - 1)
 
-    ctl0.send("scan off\n")
-
 
 unicast_host_config = host_config(
     [Bluetoothd(conf=BAP_CONF), Pexpect()],
@@ -337,3 +405,156 @@ def test_bass_past_transport_acquire(hosts):
             f"Transport {transport} State: active",
         ],
     )
+
+
+# Key shared by the members of the set, see [CSIS] in main.conf
+SIRK = "861FAE703ED681F0C50B34155B6434FB"
+
+# A set is exposed under the SIRK of its members, in reverse byte order
+SET_PATH = "set_" + bytes.fromhex(SIRK)[::-1].hex()
+
+
+def csip_conf(rank):
+    """
+    Configuration of a member of a coordinated set: the key and the size
+    describe the set, so they are the same for every member, while the
+    rank identifies the member within it.
+    """
+    return BAP_CONF + f"""
+[CSIS]
+SIRK = {SIRK}
+Encryption = true
+Size = 2
+Rank = {rank}
+"""
+
+
+set_host_config = host_config(
+    [Bluetoothd(conf=BAP_CONF), Pexpect()],
+    [Bluetoothd(conf=csip_conf(1)), Pexpect()],
+    [Bluetoothd(conf=csip_conf(2)), Pexpect()],
+)
+
+
+@pytest.fixture
+def set_hosts(hosts):
+    """
+    Initiator (host0) and two acceptors forming a coordinated set, one
+    taking the left channel (host1) and one the right (host2), paired
+    over LE.
+    """
+    host0, host1, host2 = hosts
+
+    initiator = start_bluetoothctl(host0, "bap-source-lc3.bt")
+    left = start_bluetoothctl(host1, "bap-sink-lc3-left.bt")
+    right = start_bluetoothctl(host2, "bap-sink-lc3-right.bt")
+
+    # Every member has to be advertising before connecting, so the set
+    # can be resolved and the remaining members found. The acceptors
+    # advertise themselves, as they have to include the RSI.
+    #
+    # Matched before anything else is read from them, as an expect
+    # discards everything before what it matches.
+    left.expect("Advertising object registered", timeout=REPLY_TIMEOUT)
+    right.expect("Advertising object registered", timeout=REPLY_TIMEOUT)
+
+    # A previous test may have left everything in place, in which case
+    # there is nothing to set up and the transports are used as they
+    # are
+    transports = list_transports(initiator, (host1, host2))
+
+    if all(transports):
+        yield host0, host1, host2, initiator, left, right, transports
+        return
+
+    # Otherwise the setup starts from a clean state: a device kept from
+    # a previous test would already be paired, connected and part of
+    # the set, so none of the events waited for below would be
+    # reported again
+    remove_device(initiator, host1)
+    remove_device(initiator, host2)
+    remove_device(left, host0)
+    remove_device(right, host0)
+
+    initiator.send("scan on\n")
+    initiator.expect(
+        f"Controller {host0.bdaddr.upper()} Discovering: yes",
+        timeout=REPLY_TIMEOUT,
+    )
+
+    # Connect only once every member has been found: the set is resolved
+    # from the RSI of the members that are already known, so a member
+    # found later would not be part of it
+    expect_all(
+        initiator,
+        [
+            f"Device {host1.bdaddr.upper()}",
+            f"Device {host2.bdaddr.upper()}",
+        ],
+    )
+
+    # Stop scanning before connecting, so the discovery does not
+    # interfere with the connections to the members
+    initiator.send("scan off\n")
+    initiator.expect(
+        f"Controller {host0.bdaddr.upper()} Discovering: no",
+        timeout=REPLY_TIMEOUT,
+    )
+
+    initiator.send(f"pair {host1.bdaddr.upper()}\n")
+
+    # Finding a member of a set connects the remaining ones, so the
+    # other member is neither connected nor paired by the test: it is
+    # bonded as reading its services requires an encrypted link, which
+    # is what is waited for. Its connection is not, as the link of a
+    # previous test may still be up, in which case the device is
+    # reported as connected from the start and never changes.
+    #
+    # The streams are configured by the daemon, so the transports are
+    # created without the test configuring the endpoints.
+    #
+    # The two members report independently, so their events interleave
+    # and have to be matched in any order, in a single pass including
+    # the pairing: an expect only reports what it matches and discards
+    # everything before it, so waiting for one event at a time drops
+    # the ones that happen meanwhile, e.g. a transport created while
+    # the pairing is still being waited for.
+    groups = expect_all(
+        initiator,
+        [
+            "Pairing successful",
+            f"DeviceSet /org/bluez/hci0/{SET_PATH}",
+            f"Device {host2.bdaddr.upper()} Bonded: yes",
+            TRANSPORT.format(dev_addr(host1)),
+            TRANSPORT.format(dev_addr(host2)),
+        ],
+    )
+
+    transports = [m[0].decode("utf-8") for m in groups[-2:]]
+
+    yield host0, host1, host2, initiator, left, right, transports
+
+
+@set_host_config
+def test_bap_unicast_set_transport_created(set_hosts):
+    host0, host1, host2, initiator, left, right, transports = set_hosts
+
+    # One transport per member, each taking a single channel
+    left.expect(TRANSPORT_RE)
+    right.expect(TRANSPORT_RE)
+
+
+@set_host_config
+def test_bap_unicast_set_transport_acquire(set_hosts):
+    host0, host1, host2, initiator, left, right, transports = set_hosts
+
+    # The CIS of a CIG are only created once every one of them is
+    # active, so the transports of both members have to be acquired
+    initiator.send("transport.acquire {} {}\n".format(*transports))
+
+    acquired = r"Acquire successful: fd \d+ MTU \d+:\d+"
+    expect_all(
+        initiator,
+        [acquired, acquired]
+        + [f"Transport {transport} State: active" for transport in transports],
+    )
-- 
2.55.0

Re: [PATCH BlueZ v1 00/11] Cover a BAP stream to a coordinated set

[patchwork-bot+bluetooth]

Hello:

This series was applied to bluetooth/bluez.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Tue, 15 Sep 2026 17:15:17 -0400 you wrote:
> From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> 
> These add the functional test cases for a BAP unicast stereo stream to
> a coordinated set of two acceptors, one taking the left channel and one
> the right, which is what a pair of earbuds does, together with the
> fixes they turned out to need.
> 
> [...]

Here is the summary with links:
  - [BlueZ,v1,01/11] shared/bass: add a ready callback
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=825c98da2a69
  - [BlueZ,v1,02/11] bass: wait for the session to be ready before pushing a source
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=6eb23703b473
  - [BlueZ,v1,03/11] test: functional: report what a test is waiting for
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=915926f516bc
  - [BlueZ,v1,04/11] test: functional: answer the notification registered by the victim
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=d1130406008a
  - [BlueZ,v1,05/11] doc: describe the BAP coordinated set test cases
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=8da79557195a
  - [BlueZ,v1,06/11] emulator: use the handle of the receiving side
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=4ff7deaf8c90
  - [BlueZ,v1,07/11] emulator: allow the maximum number of CIS of a CIG
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=526befeb949c
  - [BlueZ,v1,08/11] device: keep the long term key of both roles
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=9251e630efdd
  - [BlueZ,v1,09/11] client: allow a capability with the auto agent
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=2f9cb900d471
  - [BlueZ,v1,10/11] test: functional: fail as soon as an operation fails
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=12b85dddb26e
  - [BlueZ,v1,11/11] test: functional: add the BAP coordinated set tests
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=e1566fd5568b

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html