[PATCH BlueZ 1/3] transport: Preserve Release on late BAP ready

[PATCH BlueZ 1/3] transport: Preserve Release on late BAP ready

[dt]

From: Derek Tern <1263187-dt@users.noreply.gitlab.freedesktop.org>

A late stream-ready event can reach bap_resume_complete() after Release
has queued Disable. It then replies to Release with an Acquire payload
and drops the Disable request ID. Client disconnection can subsequently
free the owner while the Disable callback still refers to it.

Only complete pending Acquire/TryAcquire requests from this path. Leave
Release and its request ID for the Disable callback or cancellation.
---
Based on master ebbb4ee31. The new resume test fails all three pause
variants on that base with malformed Release replies and a Disable
cleanup crash. With the series: 7 targeted functional tests and all 697
BAP unit tests pass. The tests check transport lifecycle, not audio data.

 profiles/audio/transport.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/profiles/audio/transport.c b/profiles/audio/transport.c
index e3f3df50e..02c5c7ac0 100644
--- a/profiles/audio/transport.c
+++ b/profiles/audio/transport.c
@@ -1952,8 +1952,16 @@ static void bap_resume_complete(struct media_transport *transport)
 	if (!owner)
 		return;
 
-	if (owner->pending)
+	if (owner->pending) {
+		const char *member;
+
+		member = dbus_message_get_member(owner->pending->msg);
+		/* A late ready event must not complete a pending Release. */
+		if (strcmp(member, "Acquire") && strcmp(member, "TryAcquire"))
+			return;
+
 		owner->pending->id = 0;
+	}
 
 	if (transport->fd < 0) {
 		media_transport_remove_owner(transport);

[PATCH BlueZ 2/3] bap: Recreate stream IO after an early Enable

[dt]

From: Derek Tern <1263187-dt@users.noreply.gitlab.freedesktop.org>

When reacquiring a transport, the stream can reach Enabling before its
previous CIS finishes disconnecting. Once teardown completes, IO
recreation accepts only QoS, while CIS enabling requires existing IO.
The pending Acquire consequently stalls.

Allow deferred IO recreation in Enabling too. Keep the existing CIG-busy
checks and recreate all IO before enabling CISes.
---
Additional local A/B: hold the userspace disconnect callback for one
active CIS for 500 ms, then reacquire about 118 ms after Release replies.
With patch 1 in both builds, the old predicate leaves both Acquires
unanswered until the client's 26-second timeout; this patch completes
both in about 374 ms, after deferred cleanup.

The delay fixture is not included here. It delays userspace cleanup,
not the HCI event; the regular regression does not force this ordering.

 profiles/audio/bap.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/profiles/audio/bap.c b/profiles/audio/bap.c
index 5771c9ae0..308e0fd05 100644
--- a/profiles/audio/bap.c
+++ b/profiles/audio/bap.c
@@ -2576,12 +2576,17 @@ static void update_cig_setup_io(void *data, void *match_data)
 	struct update_cig_data *info = match_data;
 	struct bt_bap_stream *stream = setup->stream;
 	struct bt_bap_qos *qos = bt_bap_stream_get_qos(stream);
+	uint8_t state;
 
 	if (qos && qos->ucast.cig_id != info->cig)
 		return;
 	if (!setup->want_io || !stream || setup->io || setup->closing)
 		return;
-	if (bt_bap_stream_get_state(stream) != BT_BAP_STREAM_STATE_QOS)
+
+	/* Enable may complete while the previous IO is still disconnecting. */
+	state = bt_bap_stream_get_state(stream);
+	if (state != BT_BAP_STREAM_STATE_QOS &&
+					state != BT_BAP_STREAM_STATE_ENABLING)
 		return;
 
 	DBG("%p", setup);

[PATCH BlueZ 3/3] test: Cover BAP transport release and reacquire

[dt]

From: Derek Tern <1263187-dt@users.noreply.gitlab.freedesktop.org>

Acquire both unicast transports, close their sockets and release them
through the same D-Bus owner. Require an empty Release reply so a late
ready callback cannot pass unnoticed by returning an Acquire payload.

Repeat three times with immediate, 100 ms and one-second reacquisition.
Check Acquire reply types and active transport states. Close returned
FDs even when a reply is malformed.
---
 doc/functional-bap.rst      |  20 +++++++
 test/functional/test_bap.py | 102 ++++++++++++++++++++++++++++++++++++
 2 files changed, 122 insertions(+)

diff --git a/doc/functional-bap.rst b/doc/functional-bap.rst
index 60c38c5ed..96e398a43 100644
--- a/doc/functional-bap.rst
+++ b/doc/functional-bap.rst
@@ -105,6 +105,26 @@ test_bap_unicast_transport_acquire
 	be established, as `bluetoothd` sets up the ISO listener on its own
 	when the stream is enabled.
 
+test_bap_unicast_transport_resume[0|0.1|1.0]
+------------------------------------------
+
+:Setup: As above, with both transports already created.
+
+:Steps:
+	1. Acquire both transports through one D-Bus connection.
+	2. Close both acquired sockets and call ``MediaTransport1.Release``
+	   for both transports without waiting between requests.
+	3. After both replies, reacquire immediately or after 0.1 or 1 second.
+	4. Repeat the release/reacquire cycle three times.
+
+:Expected: Each ``Release`` succeeds with an empty reply. Every ``Acquire``
+	returns an FD and MTUs, and both transports become active again.
+
+:Notes: D-Bus is used directly to check the Release reply signature and
+	close the client sockets before releasing the transports. A late ready
+	callback must not answer a pending Release with an Acquire payload.
+	These tests do not force ISO disconnection to overlap the next Enable.
+
 test_bap_unicast_reconfigure_metadata[empty|media]
 ------------------------------------------------
 
diff --git a/test/functional/test_bap.py b/test/functional/test_bap.py
index 7bd59777b..76b2c9f6e 100644
--- a/test/functional/test_bap.py
+++ b/test/functional/test_bap.py
@@ -4,7 +4,9 @@
 Tests for BAP (LE Audio) using bluetoothctl in VM instances
 """
 
+import os
 import threading
+import time
 import warnings
 
 import dbus
@@ -276,6 +278,106 @@ def test_bap_unicast_transport_acquire(unicast_hosts):
     )
 
 
+def resume_transports(paths, delay):
+    """Release and reacquire all CIS in a CIG through the same D-Bus owner."""
+    bus = None
+    interfaces = []
+    fds = {}
+
+    @mainloop_wrap
+    def setup():
+        nonlocal bus, interfaces
+        bus = get_dbus(private=True)
+        interfaces = [
+            dbus.Interface(
+                bus.get_object("org.bluez", path, introspect=False),
+                "org.bluez.MediaTransport1",
+            )
+            for path in paths
+        ]
+
+    def operation(method):
+        done = threading.Event()
+        replies = []
+        errors = []
+
+        def finished(index, error=None, values=()):
+            replies.append(index)
+            if error is not None:
+                errors.append((paths[index], str(error)))
+            elif method == "Acquire" and tuple(type(value) for value in values) == (
+                dbus.types.UnixFd,
+                dbus.UInt16,
+                dbus.UInt16,
+            ):
+                fds[index] = values[0].take()
+            elif method == "Acquire" or values:
+                # Release has an empty reply: a late ready callback must not
+                # answer it with an Acquire payload. Dispose of any stray FDs.
+                for value in values:
+                    if isinstance(value, dbus.types.UnixFd):
+                        os.close(value.take())
+                errors.append((paths[index], f"invalid {method} reply"))
+            if len(replies) == len(paths):
+                done.set()
+
+        @mainloop_wrap
+        def submit():
+            for index, interface in enumerate(interfaces):
+                if method == "Release":
+                    os.close(fds.pop(index))
+                getattr(interface, method)(
+                    reply_handler=lambda *values, i=index: finished(i, values=values),
+                    error_handler=lambda error, i=index: finished(i, error=error),
+                    timeout=DEFAULT_TIMEOUT,
+                )
+
+        submit()
+        assert done.wait(DEFAULT_TIMEOUT + 1), f"{method} did not complete"
+        assert not errors, (method, errors)
+
+    @mainloop_wrap
+    def check_active():
+        objects = dbus.Interface(
+            bus.get_object("org.bluez", "/"),
+            "org.freedesktop.DBus.ObjectManager",
+        ).GetManagedObjects()
+        for path in paths:
+            assert objects[path]["org.bluez.MediaTransport1"]["State"] == "active"
+
+    @mainloop_wrap
+    def cleanup():
+        for fd in fds.values():
+            os.close(fd)
+        fds.clear()
+        if bus is not None:
+            bus.close()
+
+    try:
+        setup()
+        operation("Acquire")
+        check_active()
+        for _ in range(3):
+            # Close the client sockets before Release, then reacquire as soon
+            # as both replies arrive (or after a short playback pause).
+            operation("Release")
+            if delay:
+                time.sleep(delay)
+            operation("Acquire")
+            check_active()
+    finally:
+        cleanup()
+
+
+@unicast_host_config
+@pytest.mark.parametrize("delay", [0, 0.1, 1.0])
+def test_bap_unicast_transport_resume(unicast_hosts, delay):
+    host0, host1, initiator, acceptor = unicast_hosts
+    transports = expect_transports(initiator)
+    expect_transports(acceptor)
+    host0.call(resume_transports, transports, delay)
+
+
 def clear_remote_transports(remote):
     """Release the peer ASEs while retaining the connected GATT session."""
     done = threading.Event()

Re: [PATCH BlueZ 3/3] test: Cover BAP transport release and reacquire

[Luiz Augusto von Dentz]

Hi,

On Fri, Sep 18, 2026 at 4:24 PM dt <derektern@proton.me> wrote:
>
> From: Derek Tern <1263187-dt@users.noreply.gitlab.freedesktop.org>
>
> Acquire both unicast transports, close their sockets and release them
> through the same D-Bus owner. Require an empty Release reply so a late
> ready callback cannot pass unnoticed by returning an Acquire payload.
>
> Repeat three times with immediate, 100 ms and one-second reacquisition.
> Check Acquire reply types and active transport states. Close returned
> FDs even when a reply is malformed.

I don't think this is valid behavior, though; successive
Release/Acquire calls should wait for the reply not just enqueue.
Applications have the state to track if the transport is ready to be
called again.

> ---
>  doc/functional-bap.rst      |  20 +++++++
>  test/functional/test_bap.py | 102 ++++++++++++++++++++++++++++++++++++
>  2 files changed, 122 insertions(+)
>
> diff --git a/doc/functional-bap.rst b/doc/functional-bap.rst
> index 60c38c5ed..96e398a43 100644
> --- a/doc/functional-bap.rst
> +++ b/doc/functional-bap.rst
> @@ -105,6 +105,26 @@ test_bap_unicast_transport_acquire
>         be established, as `bluetoothd` sets up the ISO listener on its own
>         when the stream is enabled.
>
> +test_bap_unicast_transport_resume[0|0.1|1.0]
> +------------------------------------------
> +
> +:Setup: As above, with both transports already created.
> +
> +:Steps:
> +       1. Acquire both transports through one D-Bus connection.
> +       2. Close both acquired sockets and call ``MediaTransport1.Release``
> +          for both transports without waiting between requests.
> +       3. After both replies, reacquire immediately or after 0.1 or 1 second.
> +       4. Repeat the release/reacquire cycle three times.
> +
> +:Expected: Each ``Release`` succeeds with an empty reply. Every ``Acquire``
> +       returns an FD and MTUs, and both transports become active again.
> +
> +:Notes: D-Bus is used directly to check the Release reply signature and
> +       close the client sockets before releasing the transports. A late ready
> +       callback must not answer a pending Release with an Acquire payload.
> +       These tests do not force ISO disconnection to overlap the next Enable.
> +
>  test_bap_unicast_reconfigure_metadata[empty|media]
>  ------------------------------------------------
>
> diff --git a/test/functional/test_bap.py b/test/functional/test_bap.py
> index 7bd59777b..76b2c9f6e 100644
> --- a/test/functional/test_bap.py
> +++ b/test/functional/test_bap.py
> @@ -4,7 +4,9 @@
>  Tests for BAP (LE Audio) using bluetoothctl in VM instances
>  """
>
> +import os
>  import threading
> +import time
>  import warnings
>
>  import dbus
> @@ -276,6 +278,106 @@ def test_bap_unicast_transport_acquire(unicast_hosts):
>      )
>
>
> +def resume_transports(paths, delay):
> +    """Release and reacquire all CIS in a CIG through the same D-Bus owner."""
> +    bus = None
> +    interfaces = []
> +    fds = {}
> +
> +    @mainloop_wrap
> +    def setup():
> +        nonlocal bus, interfaces
> +        bus = get_dbus(private=True)
> +        interfaces = [
> +            dbus.Interface(
> +                bus.get_object("org.bluez", path, introspect=False),
> +                "org.bluez.MediaTransport1",
> +            )
> +            for path in paths
> +        ]
> +
> +    def operation(method):
> +        done = threading.Event()
> +        replies = []
> +        errors = []
> +
> +        def finished(index, error=None, values=()):
> +            replies.append(index)
> +            if error is not None:
> +                errors.append((paths[index], str(error)))
> +            elif method == "Acquire" and tuple(type(value) for value in values) == (
> +                dbus.types.UnixFd,
> +                dbus.UInt16,
> +                dbus.UInt16,
> +            ):
> +                fds[index] = values[0].take()
> +            elif method == "Acquire" or values:
> +                # Release has an empty reply: a late ready callback must not
> +                # answer it with an Acquire payload. Dispose of any stray FDs.
> +                for value in values:
> +                    if isinstance(value, dbus.types.UnixFd):
> +                        os.close(value.take())
> +                errors.append((paths[index], f"invalid {method} reply"))
> +            if len(replies) == len(paths):
> +                done.set()
> +
> +        @mainloop_wrap
> +        def submit():
> +            for index, interface in enumerate(interfaces):
> +                if method == "Release":
> +                    os.close(fds.pop(index))
> +                getattr(interface, method)(
> +                    reply_handler=lambda *values, i=index: finished(i, values=values),
> +                    error_handler=lambda error, i=index: finished(i, error=error),
> +                    timeout=DEFAULT_TIMEOUT,
> +                )
> +
> +        submit()
> +        assert done.wait(DEFAULT_TIMEOUT + 1), f"{method} did not complete"
> +        assert not errors, (method, errors)
> +
> +    @mainloop_wrap
> +    def check_active():
> +        objects = dbus.Interface(
> +            bus.get_object("org.bluez", "/"),
> +            "org.freedesktop.DBus.ObjectManager",
> +        ).GetManagedObjects()
> +        for path in paths:
> +            assert objects[path]["org.bluez.MediaTransport1"]["State"] == "active"
> +
> +    @mainloop_wrap
> +    def cleanup():
> +        for fd in fds.values():
> +            os.close(fd)
> +        fds.clear()
> +        if bus is not None:
> +            bus.close()
> +
> +    try:
> +        setup()
> +        operation("Acquire")
> +        check_active()
> +        for _ in range(3):
> +            # Close the client sockets before Release, then reacquire as soon
> +            # as both replies arrive (or after a short playback pause).
> +            operation("Release")
> +            if delay:
> +                time.sleep(delay)
> +            operation("Acquire")
> +            check_active()
> +    finally:
> +        cleanup()
> +
> +
> +@unicast_host_config
> +@pytest.mark.parametrize("delay", [0, 0.1, 1.0])
> +def test_bap_unicast_transport_resume(unicast_hosts, delay):
> +    host0, host1, initiator, acceptor = unicast_hosts
> +    transports = expect_transports(initiator)
> +    expect_transports(acceptor)
> +    host0.call(resume_transports, transports, delay)
> +
> +
>  def clear_remote_transports(remote):
>      """Release the peer ASEs while retaining the connected GATT session."""
>      done = threading.Event()
>


-- 
Luiz Augusto von Dentz

Re: [PATCH BlueZ 3/3] test: Cover BAP transport release and reacquire

[dt]

The test waits for both Acquire replies before Release, and both Release replies before reacquiring (done.wait() in operation()). Only requests for the two distinct CIS paths run concurrently, matching the existing acquisition test.

Did you mean Releases on different CIS paths should also be serialized?

All three new resume variants passed CI. The failures were in the existing coordinated-set setup/teardown cases; I am tracking those separately.

RE: [BlueZ,1/3] transport: Preserve Release on late BAP ready

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 102714 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1168994/

---Test result---

Test Summary:
CheckPatch                    PASS      1.52 seconds
GitLint                       PASS      1.05 seconds
BuildEll                      PASS      19.42 seconds
BluezMake                     PASS      378.51 seconds
MakeCheck                     PASS      14.42 seconds
MakeDistcheck                 PASS      139.73 seconds
CheckValgrind                 PASS      231.37 seconds
CheckSmatch                   PASS      291.87 seconds
bluezmakeextell               PASS      93.73 seconds
TestFunctional                FAIL      1160.90 seconds
IncrementalBuild              PASS      389.01 seconds
ScanBuild                     PASS      1123.01 seconds

Details
##############################
Test: TestFunctional - FAIL
Desc: Run test-functional
Output:
FAIL functional.test_bap::test_bap_unicast_set_transport_created[hosts8-vm3-sc]: failed on teardown with "pytest_bluezenv.plugin.CoredumpWarning: Core dump: test-bluezenv-hosts8.0-bluetoothd-1789772617-52.core
        /usr/bin/gdb: warning: Couldn't determine a path for the index cache directory.
        [New LWP 52]
        [Thread debugging using libthread_db enabled]
        Using host libthread_db library "/usr/lib/x86_64-linux-gnu/libthread_db.so.1".
        Core was generated by `/home/runner/work/bluez/bluez/src/src/src/bluetoothd --nodetach -f /run/bluetoo'.
        Program terminated with signal SIGABRT, Aborted.
        #0  __pthread_kill_implementation (threadid=<optimized out>, signo=6, no_tid=0) at ./nptl/pthread_kill.c:44

        warning: 44	./nptl/pthread_kill.c: No such file or directory

        Thread 1 (Thread 0x7ff3f90f6900 (LWP 52)):
        #0  __pthread_kill_implementation (threadid=<optimized out>, signo=6, no_tid=0) at ./nptl/pthread_kill.c:44
                tid = <optimized out>
                ret = 0
                pd = <optimized out>
                old_mask = {__val = {4412750543122677053}}
                ret = <optimized out>
        #1  __pthread_kill_internal (threadid=<optimized out>, signo=6) at ./nptl/pthread_kill.c:89
        No locals.
        #2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ./nptl/pthread_kill.c:100
        No locals.
        #3  0x00007ff3f9851b7e in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
                ret = <optimized out>
        #4  0x00007ff3f98348ec in __GI_abort () at ./stdlib/abort.c:77
                act = {__sigaction_handler = {sa_handler = 0x0, sa_sigaction = 0x0}, sa_mask = {__val = {0, 0, 0, 0, 0, 140732163359280, 22, 140685836934096, 0, 140732163359216, 140685853779478, 140685824090112, 4096, 0, 11967753019344251904, 140685828272152}}, sa_flags = -88616960, sa_restorer = 0x16}
        #5  0x00007ff3fa45ca0f in __sanitizer::Abort () at ../../../../src/libsanitizer/sanitizer_common/sanitizer_posix_libcdep.cpp:165
        No locals.
        #6  0x00007ff3fa582c2d in __sanitizer::Die () at ../../../../src/libsanitizer/sanitizer_common/sanitizer_termination.cpp:58
        No locals.
        #7  0x00007ff3fa55793c in __asan::ScopedInErrorReport::~ScopedInErrorReport (this=0x7ffec29b0366) at ../../../../src/libsanitizer/asan/asan_report.cpp:221
                buffer_copy = {buffer_ = {<__sanitizer::InternalMmapVectorNoCtor<char, false>> = {data_ = 0x7ff3f890e000 '=' <repeats 65 times>, "\n==52==ERROR: AddressSanitizer: heap-use-after-free on address 0x7d63f85e040b at pc 0x7ff3fa50c445 bp 0x7ffec29b1860 sp 0x7ffec29b1008\n"..., capacity_bytes_ = 4096, size_ = 3838}, <No data fields>}}
                buffer_copy = <optimized out>
                l = <optimized out>
        #8  0x00007ff3fa556e02 in __asan::ReportGenericError (pc=140685853377605, bp=140732163364960, sp=sp@entry=140732163362824, addr=addr@entry=137868322145291, is_write=is_write@entry=false, access_size=6, fatal=false, exp=<optimized out>) at ../../../../src/libsanitizer/asan/asan_report.cpp:536
                in_report = {error_report_lock_ = {<No data fields>}, static current_error_ = {kind = __asan::kErrorKindGeneric, {Base = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[5\000l\237\225\366\377\025\246nal] org0\016\233\302\376\177\000\000\340\003\233\302\376\177\000\000.L\223\371\363\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\f\233\302\376\177\000\000\211-\212\371\363\177\000\000\034\004\233\302\376\177\000\000\034\004\233\302\376\177\000\000\034\f\233\302\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\363\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, DeadlySignal = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[5\000l\237\225\366\377\025\246nal] org0\016\233\302\376\177\000\000\340\003\233\302\376\177\000\000.L\223\371\363\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\f\233\302\376\177\000\000\211-\212\371\363\177\000\000\034\004\233\302\376\177\000\000\034\004\233\302\376\177\000\000\034\f\233\302\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\363\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, signal = {siginfo = 0xffffffff00000002, context = 0x7d63f85e040b, addr = 0, pc = 0, sp = 11476152616506, bp = 137868322145291, is_memory_access = 11, write_flag = __sanitizer::SignalContext::Unknown, is_true_faulting_addr = false}}, DoubleFree = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[5\000l\237\225\366\377\025\246nal] org0\016\233\302\376\177\000\000\340\003\233\302\376\177\000\000.L\223\371\363\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\f\233\302\376\177\000\000\211-\212\371\363\177\000\000\034\004\233\302\376\177\000\000\034\004\233\302\376\177\000\000\034\f\233\302\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\363\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, second_free_stack = 0xffffffff00000002, addr_description = {addr = 137868322145291, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1594, free_stack_id = 2672, chunk_access = {bad_addr = 137868322145291, offset = 11, chunk_begin = 137868322145280, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}}, NewDeleteTypeMismatch = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[5\000l\237\225\366\377\025\246nal] org0\016\233\302\376\177\000\000\340\003\233\302\376\177\000\000.L\223\371\363\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\f\233\302\376\177\000\000\211-\212\371\363\177\000\000\034\004\233\302\376\177\000\000\034\004\233\302\376\177\000\000\034\f\233\302\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\363\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, free_stack = 0xffffffff00000002, addr_description = {addr = 137868322145291, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1594, free_stack_id = 2672, chunk_access = {bad_addr = 137868322145291, offset = 11, chunk_begin = 137868322145280, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, delete_size = 136287755599648, delete_alignment = 140732163360752}, FreeNotMalloced = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[5\000l\237\225\366\377\025\246nal] org0\016\233\302\376\177\000\000\340\003\233\302\376\177\000\000.L\223\371\363\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\f\233\302\376\177\000\000\211-\212\371\363\177\000\000\034\004\233\302\376\177\000\000\034\004\233\302\376\177\000\000\034\f\233\302\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\363\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, free_stack = 0xffffffff00000002, addr_description = {data = {kind = 4166910987, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11476152616506, alloc_stack_id = 4166910987, free_stack_id = 32099, chunk_access = {bad_addr = 11, offset = 137868322145280, chunk_begin = 752, chunk_size = 140732163383304, user_requested_alignment = 3872, access_type = 3, alloc_type = 1}}, stack = {addr = 0, tid = 0, offset = 11476152616506, frame_pc = 137868322145291, access_size = 11, frame_descr = 0x7d63f85e0400 "p\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11476152616506, size_with_redzone = 137868322145291, name = 0xb <error: Cannot access memory at address 0xb>, module_name = 0x7d63f85e0400 "p\n", has_dynamic_init = 752, gcc_location = 0x7ffec29b6008, odr_indicator = 136287755599648}, {beg = 140732163360752, size = 140685852674847, size_with_redzone = 1, name = 0x7bf3f7427f20 "\300me\370S|", module_name = 0x7ffec29b1040 "P\020\233\302\376\177", has_dynamic_init = 140685853631954, gcc_location = 0x7ff3f8d400d0, odr_indicator = 132113958992}, {beg = 140732163360800, size = 3, size_with_redzone = 140685853632016, name = 0x7ff3f98a2b8f <__vasprintf_internal+255> "I\211\004$H\205\300t(H\213\265\330\376\377\377L\211\352H\211\307\350\366\032\371\377H\211\301\353\212\350\254\346\n", module_name = 0x55e636be75cb <bt_log_vprintf+171> "\205\300\017\210=\001", has_dynamic_init = 140732163363584, gcc_location = 0x7ffec29b08e0, odr_indicator = 2}, {beg = 140685854347200, size = 136700091526384, size_with_redzone = 140732163360944, name = 0x7ff3fa466738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", module_name = 0x3e <error: Cannot access memory at address 0x3e>, has_dynamic_init = 136700091526384, gcc_location = 0x7ff3f8d400d0, odr_indicator = 140732163360976}}, reg_sites = {4167396608, 31827, 81, 0}, access_size = 140732163363136, size = 69 'E'}, wild = {addr = 0, access_size = 0}}}}}, AllocTypeMismatch = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[5\000l\237\225\366\377\025\246nal] org0\016\233\302\376\177\000\000\340\003\233\302\376\177\000\000.L\223\371\363\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\f\233\302\376\177\000\000\211-\212\371\363\177\000\000\034\004\233\302\376\177\000\000\034\004\233\302\376\177\000\000\034\f\233\302\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\363\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, dealloc_stack = 0xffffffff00000002, alloc_type = 4166910987, dealloc_type = 32099, addr_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 0, kind = (__asan::kShadowKindHigh | unknown: 0x38), shadow_byte = 6 '\006'}, heap = {addr = 0, alloc_tid = 11476152616506, free_tid = 137868322145291, alloc_stack_id = 11, free_stack_id = 0, chunk_access = {bad_addr = 137868322145280, offset = 752, chunk_begin = 140732163383304, chunk_size = 136287755599648, user_requested_alignment = 2032, access_type = 0, alloc_type = 0}}, stack = {addr = 0, tid = 11476152616506, offset = 137868322145291, frame_pc = 11, access_size = 137868322145280, frame_descr = 0x2f0 <error: Cannot access memory at address 0x2f0>}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 11476152616506, size = 137868322145291, size_with_redzone = 11, name = 0x7d63f85e0400 "p\n", module_name = 0x2f0 <error: Cannot access memory at address 0x2f0>, has_dynamic_init = 140732163383304, gcc_location = 0x7bf3f7427f20, odr_indicator = 140732163360752}, {beg = 140685852674847, size = 1, size_with_redzone = 136287755599648, name = 0x7ffec29b1040 "P\020\233\302\376\177", module_name = 0x7ff3fa54a5d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", has_dynamic_init = 140685828423888, gcc_location = 0x1ec29b0850, odr_indicator = 140732163360800}, {beg = 3, size = 140685853632016, size_with_redzone = 140685840362383, name = 0x55e636be75cb <bt_log_vprintf+171> "\205\300\017\210=\001", module_name = 0x7ffec29b1300 "\244\024\233\302\376\177", has_dynamic_init = 140732163360992, gcc_location = 0x2, odr_indicator = 140685854347200}, {beg = 136700091526384, size = 140732163360944, size_with_redzone = 140685852698424, name = 0x3e <error: Cannot access memory at address 0x3e>, module_name = 0x7c53f8656cf0 "\003\021", has_dynamic_init = 140685828423888, gcc_location = 0x7ffec29b08d0, odr_indicator = 136700091526400}}, reg_sites = {81, 0, 3264942400, 32766}, access_size = 140685853377605, size = 96 '`'}, wild = {addr = 0, access_size = 11476152616506}}}}}, MallocUsableSizeNotOwned = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[5\000l\237\225\366\377\025\246nal] org0\016\233\302\376\177\000\000\340\003\233\302\376\177\000\000.L\223\371\363\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\f\233\302\376\177\000\000\211-\212\371\363\177\000\000\034\004\233\302\376\177\000\000\034\004\233\302\376\177\000\000\034\f\233\302\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\363\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, addr_description = {data = {kind = 4166910987, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11476152616506, alloc_stack_id = 4166910987, free_stack_id = 32099, chunk_access = {bad_addr = 11, offset = 137868322145280, chunk_begin = 752, chunk_size = 140732163383304, user_requested_alignment = 3872, access_type = 3, alloc_type = 1}}, stack = {addr = 0, tid = 0, offset = 11476152616506, frame_pc = 137868322145291, access_size = 11, frame_descr = 0x7d63f85e0400 "p\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11476152616506, size_with_redzone = 137868322145291, name = 0xb <error: Cannot access memory at address 0xb>, module_name = 0x7d63f85e0400 "p\n", has_dynamic_init = 752, gcc_location = 0x7ffec29b6008, odr_indicator = 136287755599648}, {beg = 140732163360752, size = 140685852674847, size_with_redzone = 1, name = 0x7bf3f7427f20 "\300me\370S|", module_name = 0x7ffec29b1040 "P\020\233\302\376\177", has_dynamic_init = 140685853631954, gcc_location = 0x7ff3f8d400d0, odr_indicator = 132113958992}, {beg = 140732163360800, size = 3, size_with_redzone = 140685853632016, name = 0x7ff3f98a2b8f <__vasprintf_internal+255> "I\211\004$H\205\300t(H\213\265\330\376\377\377L\211\352H\211\307\350\366\032\371\377H\211\301\353\212\350\254\346\n", module_name = 0x55e636be75cb <bt_log_vprintf+171> "\205\300\017\210=\001", has_dynamic_init = 140732163363584, gcc_location = 0x7ffec29b08e0, odr_indicator = 2}, {beg = 140685854347200, size = 136700091526384, size_with_redzone = 140732163360944, name = 0x7ff3fa466738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", module_name = 0x3e <error: Cannot access memory at address 0x3e>, has_dynamic_init = 136700091526384, gcc_location = 0x7ff3f8d400d0, odr_indicator = 140732163360976}}, reg_sites = {4167396608, 31827, 81, 0}, access_size = 140732163363136, size = 69 'E'}, wild = {addr = 0, access_size = 0}}}}}, SanitizerGetAllocatedSizeNotOwned = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[5\000l\237\225\366\377\025\246nal] org0\016\233\302\376\177\000\000\340\003\233\302\376\177\000\000.L\223\371\363\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\f\233\302\376\177\000\000\211-\212\371\363\177\000\000\034\004\233\302\376\177\000\000\034\004\233\302\376\177\000\000\034\f\233\302\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\363\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, addr_description = {data = {kind = 4166910987, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11476152616506, alloc_stack_id = 4166910987, free_stack_id = 32099, chunk_access = {bad_addr = 11, offset = 137868322145280, chunk_begin = 752, chunk_size = 140732163383304, user_requested_alignment = 3872, access_type = 3, alloc_type = 1}}, stack = {addr = 0, tid = 0, offset = 11476152616506, frame_pc = 137868322145291, access_size = 11, frame_descr = 0x7d63f85e0400 "p\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11476152616506, size_with_redzone = 137868322145291, name = 0xb <error: Cannot access memory at address 0xb>, module_name = 0x7d63f85e0400 "p\n", has_dynamic_init = 752, gcc_location = 0x7ffec29b6008, odr_indicator = 136287755599648}, {beg = 140732163360752, size = 140685852674847, size_with_redzone = 1, name = 0x7bf3f7427f20 "\300me\370S|", module_name = 0x7ffec29b1040 "P\020\233\302\376\177", has_dynamic_init = 140685853631954, gcc_location = 0x7ff3f8d400d0, odr_indicator = 132113958992}, {beg = 140732163360800, size = 3, size_with_redzone = 140685853632016, name = 0x7ff3f98a2b8f <__vasprintf_internal+255> "I\211\004$H\205\300t(H\213\265\330\376\377\377L\211\352H\211\307\350\366\032\371\377H\211\301\353\212\350\254\346\n", module_name = 0x55e636be75cb <bt_log_vprintf+171> "\205\300\017\210=\001", has_dynamic_init = 140732163363584, gcc_location = 0x7ffec29b08e0, odr_indicator = 2}, {beg = 140685854347200, size = 136700091526384, size_with_redzone = 140732163360944, name = 0x7ff3fa466738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", module_name = 0x3e <error: Cannot access memory at address 0x3e>, has_dynamic_init = 136700091526384, gcc_location = 0x7ff3f8d400d0, odr_indicator = 140732163360976}}, reg_sites = {4167396608, 31827, 81, 0}, access_size = 140732163363136, size = 69 'E'}, wild = {addr = 0, access_size = 0}}}}}, CallocOverflow = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[5\000l\237\225\366\377\025\246nal] org0\016\233\302\376\177\000\000\340\003\233\302\376\177\000\000.L\223\371\363\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\f\233\302\376\177\000\000\211-\212\371\363\177\000\000\034\004\233\302\376\177\000\000\034\004\233\302\376\177\000\000\034\f\233\302\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\363\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, count = 137868322145291, size = 0}, ReallocArrayOverflow = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[5\000l\237\225\366\377\025\246nal] org0\016\233\302\376\177\000\000\340\003\233\302\376\177\000\000.L\223\371\363\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\f\233\302\376\177\000\000\211-\212\371\363\177\000\000\034\004\233\302\376\177\000\000\034\004\233\302\376\177\000\000\034\f\233\302\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\363\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, count = 137868322145291, size = 0}, PvallocOverflow = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[5\000l\237\225\366\377\025\246nal] org0\016\233\302\376\177\000\000\340\003\233\302\376\177\000\000.L\223\371\363\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\f\233\302\376\177\000\000\211-\212\371\363\177\000\000\034\004\233\302\376\177\000\000\034\004\233\302\376\177\000\000\034\f\233\302\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\363\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, size = 137868322145291}, InvalidAllocationAlignment = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[5\000l\237\225\366\377\025\246nal] org0\016\233\302\376\177\000\000\340\003\233\302\376\177\000\000.L\223\371\363\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\f\233\302\376\177\000\000\211-\212\371\363\177\000\000\034\004\233\302\376\177\000\000\034\004\233\302\376\177\000\000\034\f\233\302\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\363\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, alignment = 137868322145291}, InvalidAlignedAllocAlignment = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[5\000l\237\225\366\377\025\246nal] org0\016\233\302\376\177\000\000\340\003\233\302\376\177\000\000.L\223\371\363\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\f\233\302\376\177\000\000\211-\212\371\363\177\000\000\034\004\233\302\376\177\000\000\034\004\233\302\376\177\000\000\034\f\233\302\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\363\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, size = 137868322145291, alignment = 0}, InvalidPosixMemalignAlignment = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[5\000l\237\225\366\377\025\246nal] org0\016\233\302\376\177\000\000\340\003\233\302\376\177\000\000.L\223\371\363\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\f\233\302\376\177\000\000\211-\212\371\363\177\000\000\034\004\233\302\376\177\000\000\034\004\233\302\376\177\000\000\034\f\233\302\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\363\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, alignment = 137868322145291}, AllocationSizeTooBig = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[5\000l\237\225\366\377\025\246nal] org0\016\233\302\376\177\000\000\340\003\233\302\376\177\000\000.L\223\371\363\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\f\233\302\376\177\000\000\211-\212\371\363\177\000\000\034\004\233\302\376\177\000\000\034\004\233\302\376\177\000\000\034\f\233\302\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\363\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, user_size = 137868322145291, total_size = 0, max_size = 0}, RssLimitExceeded = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[5\000l\237\225\366\377\025\246nal] org0\016\233\302\376\177\000\000\340\003\233\302\376\177\000\000.L\223\371\363\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\f\233\302\376\177\000\000\211-\212\371\363\177\000\000\034\004\233\302\376\177\000\000\034\004\233\302\376\177\000\000\034\f\233\302\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\363\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002}, OutOfMemory = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[5\000l\237\225\366\377\025\246nal] org0\016\233\302\376\177\000\000\340\003\233\302\376\177\000\000.L\223\371\363\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\f\233\302\376\177\000\000\211-\212\371\363\177\000\000\034\004\233\302\376\177\000\000\034\004\233\302\376\177\000\000\034\f\233\302\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\363\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, requested_size = 137868322145291}, StringFunctionMemoryRangesOverlap = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[5\000l\237\225\366\377\025\246nal] org0\016\233\302\376\177\000\000\340\003\233\302\376\177\000\000.L\223\371\363\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\f\233\302\376\177\000\000\211-\212\371\363\177\000\000\034\004\233\302\376\177\000\000\034\004\233\302\376\177\000\000\034\f\233\302\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\363\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, length1 = 137868322145291, length2 = 0, addr1_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 11476152616506, kind = (__asan::kShadowKindGap | __asan::kShadowKindHigh | unknown: 0x8), shadow_byte = 4 '\004'}, heap = {addr = 11476152616506, alloc_tid = 137868322145291, free_tid = 11, alloc_stack_id = 4166910976, free_stack_id = 32099, chunk_access = {bad_addr = 752, offset = 140732163383304, chunk_begin = 136287755599648, chunk_size = 140732163360752, user_requested_alignment = 2847, access_type = 0, alloc_type = 0}}, stack = {addr = 11476152616506, tid = 137868322145291, offset = 11, frame_pc = 137868322145280, access_size = 752, frame_descr = 0x7ffec29b6008 <error: Cannot access memory at address 0x7ffec29b6008>}, global = {addr = 11476152616506, static kMaxGlobals = 4, globals = {{beg = 137868322145291, size = 11, size_with_redzone = 137868322145280, name = 0x2f0 <error: Cannot access memory at address 0x2f0>, module_name = 0x7ffec29b6008 <error: Cannot access memory at address 0x7ffec29b6008>, has_dynamic_init = 136287755599648, gcc_location = 0x7ffec29b07f0, odr_indicator = 140685852674847}, {beg = 1, size = 136287755599648, size_with_redzone = 140732163362880, name = 0x7ff3fa54a5d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", module_name = 0x7ff3f8d400d0 "", has_dynamic_init = 132113958992, gcc_location = 0x7ffec29b0820, odr_indicator = 3}, {beg = 140685853632016, size = 140685840362383, size_with_redzone = 94447249290699, name = 0x7ffec29b1300 "\244\024\233\302\376\177", module_name = 0x7ffec29b08e0 "\030", has_dynamic_init = 2, gcc_location = 0x7ff3fa5f8fc0 <__asan::instance>, odr_indicator = 136700091526384}, {beg = 140732163360944, size = 140685852698424, size_with_redzone = 62, name = 0x7c53f8656cf0 "\003\021", module_name = 0x7ff3f8d400d0 "", has_dynamic_init = 140732163360976, gcc_location = 0x7c53f8656d00, odr_indicator = 81}}, reg_sites = {3264942400, 32766, 4199597125, 32755}, access_size = 140732163364960, size = 8 '\b'}, wild = {addr = 11476152616506, access_size = 137868322145291}}}}, addr2_description = {data = {kind = 6, {shadow = {addr = 140685854058391, kind = __asan::kShadowKindLow, shadow_byte = 253 '\375'}, heap = {addr = 140685854058391, alloc_tid = 140685854375168, free_tid = 140732163364512, alloc_stack_id = 4199851474, free_stack_id = 32755, chunk_access = {bad_addr = 8315162673665959470, offset = 130735371371, chunk_begin = 140732163362432, chunk_size = 3, user_requested_alignment = 1552, access_type = 2, alloc_type = 2}}, stack = {addr = 140685854058391, tid = 140685854375168, offset = 140732163364512, frame_pc = 140685853631954, access_size = 8315162673665959470, frame_descr = 0x1e706f746b <error: Cannot access memory at address 0x1e706f746b>}, global = {addr = 140685854058391, static kMaxGlobals = 4, globals = {{beg = 140685854375168, size = 140732163364512, size_with_redzone = 140685853631954, name = 0x736564656572662e <error: Cannot access memory at address 0x736564656572662e>, module_name = 0x1e706f746b <error: Cannot access memory at address 0x1e706f746b>, has_dynamic_init = 140732163362432, gcc_location = 0x3, odr_indicator = 140685853632016}, {beg = 140685840362383, size = 94447249290699, size_with_redzone = 140732163365216, name = 0x7ffec29b0f00 " \017\233\302\376\177", module_name = 0x7ff3fa5f2f78 "\001", has_dynamic_init = 140732163362624, gcc_location = 0x55e636d285a0, odr_indicator = 140685832317112}, {beg = 65535, size = 140732163362544, size_with_redzone = 140685853463385, name = 0x40 <error: Cannot access memory at address 0x40>, module_name = 0x7bf3f764d200 "\0166\340E", has_dynamic_init = 140732163362592, gcc_location = 0x7ff3fa46d74a <__asan_stack_malloc_0(__sanitizer::uptr)+234>, odr_indicator = 140732163362592}, {beg = 140685853888381, size = 140732163362624, size_with_redzone = 140685853732198, name = 0x7ffec29b0fc0 "", module_name = 0x2 <error: Cannot access memory at address 0x2>, has_dynamic_init = 140685854347200, gcc_location = 0x7c33f86498c0, odr_indicator = 140732163362704}}, reg_sites = {4198917944, 32755, 40, 0}, access_size = 140685853837853, size = 208 '\320'}, wild = {addr = 140685854058391, access_size = 140685854375168}}}}, function = 0x7ffec29b0fb0 "`\030\233\302\376\177"}, StringFunctionSizeOverflow = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[5\000l\237\225\366\377\025\246nal] org0\016\233\302\376\177\000\000\340\003\233\302\376\177\000\000.L\223\371\363\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\f\233\302\376\177\000\000\211-\212\371\363\177\000\000\034\004\233\302\376\177\000\000\034\004\233\302\376\177\000\000\034\f\233\302\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\363\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, addr_description = {data = {kind = 4166910987, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11476152616506, alloc_stack_id = 4166910987, free_stack_id = 32099, chunk_access = {bad_addr = 11, offset = 137868322145280, chunk_begin = 752, chunk_size = 140732163383304, user_requested_alignment = 3872, access_type = 3, alloc_type = 1}}, stack = {addr = 0, tid = 0, offset = 11476152616506, frame_pc = 137868322145291, access_size = 11, frame_descr = 0x7d63f85e0400 "p\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11476152616506, size_with_redzone = 137868322145291, name = 0xb <error: Cannot access memory at address 0xb>, module_name = 0x7d63f85e0400 "p\n", has_dynamic_init = 752, gcc_location = 0x7ffec29b6008, odr_indicator = 136287755599648}, {beg = 140732163360752, size = 140685852674847, size_with_redzone = 1, name = 0x7bf3f7427f20 "\300me\370S|", module_name = 0x7ffec29b1040 "P\020\233\302\376\177", has_dynamic_init = 140685853631954, gcc_location = 0x7ff3f8d400d0, odr_indicator = 132113958992}, {beg = 140732163360800, size = 3, size_with_redzone = 140685853632016, name = 0x7ff3f98a2b8f <__vasprintf_internal+255> "I\211\004$H\205\300t(H\213\265\330\376\377\377L\211\352H\211\307\350\366\032\371\377H\211\301\353\212\350\254\346\n", module_name = 0x55e636be75cb <bt_log_vprintf+171> "\205\300\017\210=\001", has_dynamic_init = 140732163363584, gcc_location = 0x7ffec29b08e0, odr_indicator = 2}, {beg = 140685854347200, size = 136700091526384, size_with_redzone = 140732163360944, name = 0x7ff3fa466738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", module_name = 0x3e <error: Cannot access memory at address 0x3e>, has_dynamic_init = 136700091526384, gcc_location = 0x7ff3f8d400d0, odr_indicator = 140732163360976}}, reg_sites = {4167396608, 31827, 81, 0}, access_size = 140732163363136, size = 69 'E'}, wild = {addr = 0, access_size = 0}}}}, size = 140732163364960}, BadParamsToAnnotateContiguousContainer = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[5\000l\237\225\366\377\025\246nal] org0\016\233\302\376\177\000\000\340\003\233\302\376\177\000\000.L\223\371\363\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\f\233\302\376\177\000\000\211-\212\371\363\177\000\000\034\004\233\302\376\177\000\000\034\004\233\302\376\177\000\000\034\f\233\302\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\363\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, beg = 137868322145291, end = 0, old_mid = 0, new_mid = 11476152616506}, BadParamsToAnnotateDoubleEndedContiguousContainer = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[5\000l\237\225\366\377\025\246nal] org0\016\233\302\376\177\000\000\340\003\233\302\376\177\000\000.L\223\371\363\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\f\233\302\376\177\000\000\211-\212\371\363\177\000\000\034\004\233\302\376\177\000\000\034\004\233\302\376\177\000\000\034\f\233\302\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\363\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, storage_beg = 137868322145291, storage_end = 0, old_container_beg = 0, old_container_end = 11476152616506, new_container_beg = 137868322145291, new_container_end = 11}, BadParamsToCopyContiguousContainerAnnotations = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[5\000l\237\225\366\377\025\246nal] org0\016\233\302\376\177\000\000\340\003\233\302\376\177\000\000.L\223\371\363\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\f\233\302\376\177\000\000\211-\212\371\363\177\000\000\034\004\233\302\376\177\000\000\034\004\233\302\376\177\000\000\034\f\233\302\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\363\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, old_storage_beg = 137868322145291, old_storage_end = 0, new_storage_beg = 0, new_storage_end = 11476152616506}, ODRViolation = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[5\000l\237\225\366\377\025\246nal] org0\016\233\302\376\177\000\000\340\003\233\302\376\177\000\000.L\223\371\363\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\f\233\302\376\177\000\000\211-\212\371\363\177\000\000\034\004\233\302\376\177\000\000\034\004\233\302\376\177\000\000\034\f\233\302\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\363\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, global1 = {beg = 18446744069414584322, size = 137868322145291, size_with_redzone = 0, name = 0x0, module_name = 0xa700000063a <error: Cannot access memory at address 0xa700000063a>, has_dynamic_init = 137868322145291, gcc_location = 0xb, odr_indicator = 137868322145280}, global2 = {beg = 752, size = 140732163383304, size_with_redzone = 136287755599648, name = 0x7ffec29b07f0 "@\020\233\302\376\177", module_name = 0x7ff3fa460b1f <__asan::asan_malloc(unsigned long, __sanitizer::BufferedStackTrace*)+47> "H\205\300t\f\311\303f.\017\037\204", has_dynamic_init = 1, gcc_location = 0x7bf3f7427f20, odr_indicator = 140732163362880}, stack_id1 = 4199851474, stack_id2 = 32755}, InvalidPointerPair = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[5\000l\237\225\366\377\025\246nal] org0\016\233\302\376\177\000\000\340\003\233\302\376\177\000\000.L\223\371\363\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\f\233\302\376\177\000\000\211-\212\371\363\177\000\000\034\004\233\302\376\177\000\000\034\004\233\302\376\177\000\000\034\f\233\302\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\363\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, pc = 18446744069414584322, bp = 137868322145291, sp = 0, addr1_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 11476152616506, kind = (__asan::kShadowKindGap | __asan::kShadowKindHigh | unknown: 0x8), shadow_byte = 4 '\004'}, heap = {addr = 11476152616506, alloc_tid = 137868322145291, free_tid = 11, alloc_stack_id = 4166910976, free_stack_id = 32099, chunk_access = {bad_addr = 752, offset = 140732163383304, chunk_begin = 136287755599648, chunk_size = 140732163360752, user_requested_alignment = 2847, access_type = 0, alloc_type = 0}}, stack = {addr = 11476152616506, tid = 137868322145291, offset = 11, frame_pc = 137868322145280, access_size = 752, frame_descr = 0x7ffec29b6008 <error: Cannot access memory at address 0x7ffec29b6008>}, global = {addr = 11476152616506, static kMaxGlobals = 4, globals = {{beg = 137868322145291, size = 11, size_with_redzone = 137868322145280, name = 0x2f0 <error: Cannot access memory at address 0x2f0>, module_name = 0x7ffec29b6008 <error: Cannot access memory at address 0x7ffec29b6008>, has_dynamic_init = 136287755599648, gcc_location = 0x7ffec29b07f0, odr_indicator = 140685852674847}, {beg = 1, size = 136287755599648, size_with_redzone = 140732163362880, name = 0x7ff3fa54a5d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", module_name = 0x7ff3f8d400d0 "", has_dynamic_init = 132113958992, gcc_location = 0x7ffec29b0820, odr_indicator = 3}, {beg = 140685853632016, size = 140685840362383, size_with_redzone = 94447249290699, name = 0x7ffec29b1300 "\244\024\233\302\376\177", module_name = 0x7ffec29b08e0 "\030", has_dynamic_init = 2, gcc_location = 0x7ff3fa5f8fc0 <__asan::instance>, odr_indicator = 136700091526384}, {beg = 140732163360944, size = 140685852698424, size_with_redzone = 62, name = 0x7c53f8656cf0 "\003\021", module_name = 0x7ff3f8d400d0 "", has_dynamic_init = 140732163360976, gcc_location = 0x7c53f8656d00, odr_indicator = 81}}, reg_sites = {3264942400, 32766, 4199597125, 32755}, access_size = 140732163364960, size = 8 '\b'}, wild = {addr = 11476152616506, access_size = 137868322145291}}}}, addr2_description = {data = {kind = 6, {shadow = {addr = 140685854058391, kind = __asan::kShadowKindLow, shadow_byte = 253 '\375'}, heap = {addr = 140685854058391, alloc_tid = 140685854375168, free_tid = 140732163364512, alloc_stack_id = 4199851474, free_stack_id = 32755, chunk_access = {bad_addr = 8315162673665959470, offset = 130735371371, chunk_begin = 140732163362432, chunk_size = 3, user_requested_alignment = 1552, access_type = 2, alloc_type = 2}}, stack = {addr = 140685854058391, tid = 140685854375168, offset = 140732163364512, frame_pc = 140685853631954, access_size = 8315162673665959470, frame_descr = 0x1e706f746b <error: Cannot access memory at address 0x1e706f746b>}, global = {addr = 140685854058391, static kMaxGlobals = 4, globals = {{beg = 140685854375168, size = 140732163364512, size_with_redzone = 140685853631954, name = 0x736564656572662e <error: Cannot access memory at address 0x736564656572662e>, module_name = 0x1e706f746b <error: Cannot access memory at address 0x1e706f746b>, has_dynamic_init = 140732163362432, gcc_location = 0x3, odr_indicator = 140685853632016}, {beg = 140685840362383, size = 94447249290699, size_with_redzone = 140732163365216, name = 0x7ffec29b0f00 " \017\233\302\376\177", module_name = 0x7ff3fa5f2f78 "\001", has_dynamic_init = 140732163362624, gcc_location = 0x55e636d285a0, odr_indicator = 140685832317112}, {beg = 65535, size = 140732163362544, size_with_redzone = 140685853463385, name = 0x40 <error: Cannot access memory at address 0x40>, module_name = 0x7bf3f764d200 "\0166\340E", has_dynamic_init = 140732163362592, gcc_location = 0x7ff3fa46d74a <__asan_stack_malloc_0(__sanitizer::uptr)+234>, odr_indicator = 140732163362592}, {beg = 140685853888381, size = 140732163362624, size_with_redzone = 140685853732198, name = 0x7ffec29b0fc0 "", module_name = 0x2 <error: Cannot access memory at address 0x2>, has_dynamic_init = 140685854347200, gcc_location = 0x7c33f86498c0, odr_indicator = 140732163362704}}, reg_sites = {4198917944, 32755, 40, 0}, access_size = 140685853837853, size = 208 '\320'}, wild = {addr = 140685854058391, access_size = 140685854375168}}}}}, Generic = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[5\000l\237\225\366\377\025\246nal] org0\016\233\302\376\177\000\000\340\003\233\302\376\177\000\000.L\223\371\363\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\f\233\302\376\177\000\000\211-\212\371\363\177\000\000\034\004\233\302\376\177\000\000\034\004\233\302\376\177\000\000\034\f\233\302\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\363\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, addr_description = {data = {kind = __asan::kAddressKindHeap, {shadow = {addr = 137868322145291, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 137868322145291, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1594, free_stack_id = 2672, chunk_access = {bad_addr = 137868322145291, offset = 11, chunk_begin = 137868322145280, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, stack = {addr = 137868322145291, tid = 0, offset = 0, frame_pc = 11476152616506, access_size = 137868322145291, frame_descr = 0xb <error: Cannot access memory at address 0xb>}, global = {addr = 137868322145291, static kMaxGlobals = 4, globals = {{beg = 0, size = 0, size_with_redzone = 11476152616506, name = 0x7d63f85e040b "B", module_name = 0xb <error: Cannot access memory at address 0xb>, has_dynamic_init = 137868322145280, gcc_location = 0x2f0, odr_indicator = 140732163383304}, {beg = 136287755599648, size = 140732163360752, size_with_redzone = 140685852674847, name = 0x1 <error: Cannot access memory at address 0x1>, module_name = 0x7bf3f7427f20 "\300me\370S|", has_dynamic_init = 140732163362880, gcc_location = 0x7ff3fa54a5d2 <___interceptor_malloc(__sanitizer::uptr)+130>, odr_indicator = 140685828423888}, {beg = 132113958992, size = 140732163360800, size_with_redzone = 3, name = 0x7ff3fa54a610 <___interceptor_malloc(__sanitizer::uptr)+192> "D\213\215\314\367\377\377E\205\311tTH\211m\330A\203\371\001t*E\017\276\3061\311H\211\352H\211\306H\215\275\320\367\377\377\350\"\004\001", module_name = 0x7ff3f98a2b8f <__vasprintf_internal+255> "I\211\004$H\205\300t(H\213\265\330\376\377\377L\211\352H\211\307\350\366\032\371\377H\211\301\353\212\350\254\346\n", has_dynamic_init = 94447249290699, gcc_location = 0x7ffec29b1300, odr_indicator = 140732163360992}, {beg = 2, size = 140685854347200, size_with_redzone = 136700091526384, name = 0x7ffec29b08b0 "`\030\233\302\376\177", module_name = 0x7ff3fa466738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", has_dynamic_init = 62, gcc_location = 0x7c53f8656cf0, odr_indicator = 140685828423888}}, reg_sites = {3264940240, 32766, 4167396608, 31827}, access_size = 81, size = 64 '@'}, wild = {addr = 137868322145291, access_size = 0}}}}, pc = 140685853377605, bp = 140732163364960, sp = 140732163362824, access_size = 6, bug_descr = 0x7ff3fa5b2797 "heap-use-after-free", is_write = false, shadow_val = 253 '\375'}}}, halt_on_error_ = true}
                error = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[5\000l\237\225\366\377\025\246nal] org0\016\233\302\376\177\000\000\340\003\233\302\376\177\000\000.L\223\371\363\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\f\233\302\376\177\000\000\211-\212\371\363\177\000\000\034\004\233\302\376\177\000\000\034\004\233\302\376\177\000\000\034\f\233\302\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\363\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, addr_description = {data = {kind = __asan::kAddressKindHeap, {shadow = {addr = 137868322145291, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 137868322145291, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1594, free_stack_id = 2672, chunk_access = {bad_addr = 137868322145291, offset = 11, chunk_begin = 137868322145280, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, stack = {addr = 137868322145291, tid = 0, offset = 0, frame_pc = 11476152616506, access_size = 137868322145291, frame_descr = 0xb <error: Cannot access memory at address 0xb>}, global = {addr = 137868322145291, static kMaxGlobals = 4, globals = {{beg = 0, size = 0, size_with_redzone = 11476152616506, name = 0x7d63f85e040b "B", module_name = 0xb <error: Cannot access memory at address 0xb>, has_dynamic_init = 137868322145280, gcc_location = 0x2f0, odr_indicator = 140732163383304}, {beg = 136287755599648, size = 140732163360752, size_with_redzone = 140685852674847, name = 0x1 <error: Cannot access memory at address 0x1>, module_name = 0x7bf3f7427f20 "\300me\370S|", has_dynamic_init = 140732163362880, gcc_location = 0x7ff3fa54a5d2 <___interceptor_malloc(__sanitizer::uptr)+130>, odr_indicator = 140685828423888}, {beg = 132113958992, size = 140732163360800, size_with_redzone = 3, name = 0x7ff3fa54a610 <___interceptor_malloc(__sanitizer::uptr)+192> "D\213\215\314\367\377\377E\205\311tTH\211m\330A\203\371\001t*E\017\276\3061\311H\211\352H\211\306H\215\275\320\367\377\377\350\"\004\001", module_name = 0x7ff3f98a2b8f <__vasprintf_internal+255> "I\211\004$H\205\300t(H\213\265\330\376\377\377L\211\352H\211\307\350\366\032\371\377H\211\301\353\212\350\254\346\n", has_dynamic_init = 94447249290699, gcc_location = 0x7ffec29b1300, odr_indicator = 140732163360992}, {beg = 2, size = 140685854347200, size_with_redzone = 136700091526384, name = 0x7ffec29b08b0 "`\030\233\302\376\177", module_name = 0x7ff3fa466738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", has_dynamic_init = 62, gcc_location = 0x7c53f8656cf0, odr_indicator = 140685828423888}}, reg_sites = {3264940240, 32766, 4167396608, 31827}, access_size = 81, size = 64 '@'}, wild = {addr = 137868322145291, access_size = 0}}}}, pc = 140685853377605, bp = 140732163364960, sp = 140732163362824, access_size = 6, bug_descr = 0x7ff3fa5b2797 "heap-use-after-free", is_write = false, shadow_val = 253 '\375'}
        #9  0x00007ff3fa556f8d in __asan::ReportGenericError (pc=<optimized out>, bp=bp@entry=140732163364960, sp=sp@entry=140732163362824, addr=addr@entry=137868322145291, is_write=is_write@entry=false, access_size=access_size@entry=6, exp=<optimized out>, fatal=false) at ../../../../src/libsanitizer/asan/asan_report.cpp:536
                in_report = <optimized out>
                error = <optimized out>
                enable_fp = <optimized out>
        #10 0x00007ff3fa50c468 in MemcmpInterceptorCommon (ctx=ctx@entry=0x7ffec29b1870, real_fn=<optimized out>, a1=a1@entry=0x7d63f85e040b, a2=a2@entry=0x7bf3f738a3a0, size=size@entry=6) at ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:848
                bp = 140732163364960
                pc = <optimized out>
                local_stack = 137524724760640
                sp = 140732163362824
                _ctx = 0x7ffec29b1870
                suppressed = <optimized out>
                __offset = 137868322145291
                __size = 6
                __bad = <optimized out>
                result = <optimized out>
        #11 0x00007ff3fa50c835 in ___interceptor_memcmp (a1=0x7d63f85e040b, a2=0x7bf3f738a3a0, size=6) at ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:880
                ctx = 0x7ffec29b1870
                _ctx = {interceptor_name = 0x7ff3fa5b66b6 "memcmp"}
        #12 ___interceptor_memcmp (a1=0x7d63f85e040b, a2=0x7bf3f738a3a0, size=6) at ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:875
                ctx = <optimized out>
                _ctx = <optimized out>
        #13 0x000055e636acb098 in bacmp (ba1=0x7d63f85e040b, ba2=0x7bf3f738a3a0) at ./lib/bluetooth/bluetooth.h:438
        No locals.
        #14 device_addr_type_cmp (a=0x7d63f85e0400, b=0x7bf3f738a3a0) at src/device.c:5657
                dev = 0x7d63f85e0400
                addr = 0x7bf3f738a3a0
                cmp = <optimized out>
        #15 0x00007ff3fa2864c2 in g_slist_find_custom () from /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
        No symbol table info available.
        #16 0x000055e636a4a754 in btd_adapter_find_device (adapter=<optimized out>, dst=dst@entry=0x7c33f8623cd8, bdaddr_type=1 '\001') at src/adapter.c:1055
                addr = <optimized out>
                device = <optimized out>
                list = <optimized out>
        #17 0x000055e6369ecc67 in att_disconnected (err=<optimized out>, user_data=0x7c33f8623cd0) at src/gatt-database.c:335
                state = 0x7c33f8623cd0
                device = <optimized out>
                __func__ = "att_disconnected"
        #18 0x000055e636a03b94 in btd_gatt_database_att_disconnected (database=<optimized out>, device=<optimized out>) at src/gatt-database.c:4238
                server = <optimized out>
                att = <optimized out>
                state = <optimized out>
                addr = <optimized out>
                type = <optimized out>
                __func__ = "btd_gatt_database_att_disconnected"
        #19 0x000055e636aad146 in gatt_server_cleanup (device=device@entry=0x7d63f85e0080) at src/device.c:842
        No locals.
        #20 0x000055e636ac183c in attio_cleanup (device=0x7d63f85e0080) at src/device.c:862
        No locals.
        #21 0x000055e636ac1e87 in device_free (user_data=0x7d63f85e0080) at src/device.c:918
                device = 0x7d63f85e0080
                __func__ = "device_free"
        #22 0x000055e636b3fa9a in remove_interface (data=0x7c63f85eb000, name=name@entry=0x55e636d4ca60 "org.bluez.Device1") at gdbus/object.c:742
                iface = 0x7c53f85fe380
        #23 0x000055e636b4265c in g_dbus_unregister_interface (connection=<optimized out>, path=<optimized out>, name=<optimized out>) at gdbus/object.c:1499
                data = <optimized out>
        #24 0x000055e636a7d213 in adapter_remove (adapter=adapter@entry=0x7d23f85e0200) at src/adapter.c:7307
                l = 0x7c13f860b410 = {0x7d63f85e0080}
                db = <optimized out>
                ranging_manager = <optimized out>
                __func__ = "adapter_remove"
        #25 0x000055e636a7dda8 in adapter_cleanup () at src/adapter.c:11263
                adapter = 0x7d23f85e0200
        #26 0x000055e63682f320 in main (argc=<optimized out>, argv=<optimized out>) at src/main.c:1723
                context = <optimized out>
                err = <optimized out>
                sdp_mtu = 0
                sdp_flags = <optimized out>
                gdbus_flags = <optimized out>
                __func__ = "main""
FAIL functional.test_bap::test_bap_unicast_set_transport_created[hosts8-vm3-legacy]: failed on setup with "pytest_bluezenv.rpc.RemoteTimeoutError: Connection recv timed out"
FAIL functional.test_bap::test_bap_unicast_set_transport_created[hosts8-vm3-legacy]: failed on teardown with "pytest_bluezenv.plugin.CoredumpWarning: Core dump: test-bluezenv-hosts8.0-bluetoothd-1789772636-72.core
        /usr/bin/gdb: warning: Couldn't determine a path for the index cache directory.
        [New LWP 72]
        [Thread debugging using libthread_db enabled]
        Using host libthread_db library "/usr/lib/x86_64-linux-gnu/libthread_db.so.1".
        Core was generated by `/home/runner/work/bluez/bluez/src/src/src/bluetoothd --nodetach -f /run/bluetoo'.
        Program terminated with signal SIGABRT, Aborted.
        #0  __pthread_kill_implementation (threadid=<optimized out>, signo=6, no_tid=0) at ./nptl/pthread_kill.c:44

        warning: 44	./nptl/pthread_kill.c: No such file or directory

        Thread 1 (Thread 0x7fc5b7756900 (LWP 72)):
        #0  __pthread_kill_implementation (threadid=<optimized out>, signo=6, no_tid=0) at ./nptl/pthread_kill.c:44
                tid = <optimized out>
                ret = 0
                pd = <optimized out>
                old_mask = {__val = {4412750543122677053}}
                ret = <optimized out>
        #1  __pthread_kill_internal (threadid=<optimized out>, signo=6) at ./nptl/pthread_kill.c:89
        No locals.
        #2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ./nptl/pthread_kill.c:100
        No locals.
        #3  0x00007fc5b7eb1b7e in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
                ret = <optimized out>
        #4  0x00007fc5b7e948ec in __GI_abort () at ./stdlib/abort.c:77
                act = {__sigaction_handler = {sa_handler = 0x0, sa_sigaction = 0x0}, sa_mask = {__val = {0, 0, 0, 140730930043632, 140730930043920, 140730930043776, 22, 140487167826896, 0, 140730930043712, 140487184672278, 140487154982912, 4096, 0, 16872763790977827072, 140487159164952}}, sa_flags = -1189228544, sa_restorer = 0x16}
        #5  0x00007fc5b8abca0f in __sanitizer::Abort () at ../../../../src/libsanitizer/sanitizer_common/sanitizer_posix_libcdep.cpp:165
        No locals.
        #6  0x00007fc5b8be2c2d in __sanitizer::Die () at ../../../../src/libsanitizer/sanitizer_common/sanitizer_termination.cpp:58
        No locals.
        #7  0x00007fc5b8bb793c in __asan::ScopedInErrorReport::~ScopedInErrorReport (this=0x7ffe79181cb6) at ../../../../src/libsanitizer/asan/asan_report.cpp:221
                buffer_copy = {buffer_ = {<__sanitizer::InternalMmapVectorNoCtor<char, false>> = {data_ = 0x7fc5b6f6e000 '=' <repeats 65 times>, "\n==72==ERROR: AddressSanitizer: heap-use-after-free on address 0x7d35b6be0208 at pc 0x562fd2ac7efc bp 0x7ffe79182930 sp 0x7ffe79182920\n"..., capacity_bytes_ = 4096, size_ = 3419}, <No data fields>}}
                buffer_copy = <optimized out>
                l = <optimized out>
        #8  0x00007fc5b8bb6e02 in __asan::ReportGenericError (pc=94763397971708, bp=140730930047280, sp=sp@entry=140730930047264, addr=137669652644360, is_write=is_write@entry=false, access_size=8, fatal=true, exp=<optimized out>) at ../../../../src/libsanitizer/asan/asan_report.cpp:536
                in_report = {error_report_lock_ = {<No data fields>}, static current_error_ = {kind = __asan::kErrorKindGeneric, {Base = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\305{\000\000\377\000\000\000\000\000\000\000\240\367\331\322/V\000\000f-\274\270\305\177\000\000\240\035\030y\376\177\000\000\002\000\000\000\000\000\000\000\300\217\305\270\305\177\000\000\020\n\277\266E|\000\000p\035\030y\376\177\000\0008g\254\270\305\177\000\000^\000\000\000\000\000\000\000\020\n\277\266E|\000\000\320\000:\267\305\177\000\000\220\035\030y\376\177\000\000 \n\277\266E|\000\000q\000\000\000\000\000\000\000\000&\030y\376\177\000\000^\000\000\000\000\000\000\000\300%\030y\376\177\000\000\301\223\272\270\305\177\000\000\"\032\323\322/V\000\000\270\377\377\377"...}, tid = 0}, DeadlySignal = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\305{\000\000\377\000\000\000\000\000\000\000\240\367\331\322/V\000\000f-\274\270\305\177\000\000\240\035\030y\376\177\000\000\002\000\000\000\000\000\000\000\300\217\305\270\305\177\000\000\020\n\277\266E|\000\000p\035\030y\376\177\000\0008g\254\270\305\177\000\000^\000\000\000\000\000\000\000\020\n\277\266E|\000\000\320\000:\267\305\177\000\000\220\035\030y\376\177\000\000 \n\277\266E|\000\000q\000\000\000\000\000\000\000\000&\030y\376\177\000\000^\000\000\000\000\000\000\000\300%\030y\376\177\000\000\301\223\272\270\305\177\000\000\"\032\323\322/V\000\000\270\377\377\377"...}, tid = 0}, signal = {siginfo = 0x7ffe00000002, context = 0x7d35b6be0208, addr = 0, pc = 0, sp = 11016591115764, bp = 137669652644360, is_memory_access = 136, write_flag = __sanitizer::SignalContext::Unknown, is_true_faulting_addr = 128}}, DoubleFree = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\305{\000\000\377\000\000\000\000\000\000\000\240\367\331\322/V\000\000f-\274\270\305\177\000\000\240\035\030y\376\177\000\000\002\000\000\000\000\000\000\000\300\217\305\270\305\177\000\000\020\n\277\266E|\000\000p\035\030y\376\177\000\0008g\254\270\305\177\000\000^\000\000\000\000\000\000\000\020\n\277\266E|\000\000\320\000:\267\305\177\000\000\220\035\030y\376\177\000\000 \n\277\266E|\000\000q\000\000\000\000\000\000\000\000&\030y\376\177\000\000^\000\000\000\000\000\000\000\300%\030y\376\177\000\000\301\223\272\270\305\177\000\000\"\032\323\322/V\000\000\270\377\377\377"...}, tid = 0}, second_free_stack = 0x7ffe00000002, addr_description = {addr = 137669652644360, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1524, free_stack_id = 2565, chunk_access = {bad_addr = 137669652644360, offset = 392, chunk_begin = 137669652643968, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}}, NewDeleteTypeMismatch = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\305{\000\000\377\000\000\000\000\000\000\000\240\367\331\322/V\000\000f-\274\270\305\177\000\000\240\035\030y\376\177\000\000\002\000\000\000\000\000\000\000\300\217\305\270\305\177\000\000\020\n\277\266E|\000\000p\035\030y\376\177\000\0008g\254\270\305\177\000\000^\000\000\000\000\000\000\000\020\n\277\266E|\000\000\320\000:\267\305\177\000\000\220\035\030y\376\177\000\000 \n\277\266E|\000\000q\000\000\000\000\000\000\000\000&\030y\376\177\000\000^\000\000\000\000\000\000\000\300%\030y\376\177\000\000\301\223\272\270\305\177\000\000\"\032\323\322/V\000\000\270\377\377\377"...}, tid = 0}, free_stack = 0x7ffe00000002, addr_description = {addr = 137669652644360, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1524, free_stack_id = 2565, chunk_access = {bad_addr = 137669652644360, offset = 392, chunk_begin = 137669652643968, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, delete_size = 140487183567647, delete_alignment = 1}, FreeNotMalloced = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\305{\000\000\377\000\000\000\000\000\000\000\240\367\331\322/V\000\000f-\274\270\305\177\000\000\240\035\030y\376\177\000\000\002\000\000\000\000\000\000\000\300\217\305\270\305\177\000\000\020\n\277\266E|\000\000p\035\030y\376\177\000\0008g\254\270\305\177\000\000^\000\000\000\000\000\000\000\020\n\277\266E|\000\000\320\000:\267\305\177\000\000\220\035\030y\376\177\000\000 \n\277\266E|\000\000q\000\000\000\000\000\000\000\000&\030y\376\177\000\000^\000\000\000\000\000\000\000\300%\030y\376\177\000\000\301\223\272\270\305\177\000\000\"\032\323\322/V\000\000\270\377\377\377"...}, tid = 0}, free_stack = 0x7ffe00000002, addr_description = {data = {kind = 3065905672, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11016591115764, alloc_stack_id = 3065905672, free_stack_id = 32053, chunk_access = {bad_addr = 392, offset = 137669652643968, chunk_begin = 752, chunk_size = 140730930061320, user_requested_alignment = 2847, access_type = 0, alloc_type = 0}}, stack = {addr = 0, tid = 0, offset = 11016591115764, frame_pc = 137669652644360, access_size = 392, frame_descr = 0x7d35b6be0080 "\005\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11016591115764, size_with_redzone = 137669652644360, name = 0x188 <error: Cannot access memory at address 0x188>, module_name = 0x7d35b6be0080 "\005\n", has_dynamic_init = 752, gcc_location = 0x7ffe79186008, odr_indicator = 140487183567647}, {beg = 1, size = 136913738547648, size_with_redzone = 140730930047360, name = 0x7fc5b8baa5d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", module_name = 0x3 <error: Cannot access memory at address 0x3>, has_dynamic_init = 131923050496, gcc_location = 0x7ffe79182160, odr_indicator = 2}, {beg = 140487184524816, size = 94763398530806, size_with_redzone = 140730930045456, name = 0x7 <error: Cannot access memory at address 0x7>, module_name = 0x7fc5b8c58fc0 <__asan::instance> "", has_dynamic_init = 136226544714016, gcc_location = 0x7ffe791821e0, odr_indicator = 140487184624998}, {beg = 140730930045504, size = 6, size_with_redzone = 140487185240000, name = 0x7c85b6c17530 "\003\021", module_name = 0x7ffe79182210 "\b", has_dynamic_init = 140487183591224, gcc_location = 0x78, odr_indicator = 136913738626352}}, reg_sites = {2031624704, 32766, 3086565742, 32709}, access_size = 0, size = 252 '\374'}, wild = {addr = 0, access_size = 0}}}}}, AllocTypeMismatch = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\305{\000\000\377\000\000\000\000\000\000\000\240\367\331\322/V\000\000f-\274\270\305\177\000\000\240\035\030y\376\177\000\000\002\000\000\000\000\000\000\000\300\217\305\270\305\177\000\000\020\n\277\266E|\000\000p\035\030y\376\177\000\0008g\254\270\305\177\000\000^\000\000\000\000\000\000\000\020\n\277\266E|\000\000\320\000:\267\305\177\000\000\220\035\030y\376\177\000\000 \n\277\266E|\000\000q\000\000\000\000\000\000\000\000&\030y\376\177\000\000^\000\000\000\000\000\000\000\300%\030y\376\177\000\000\301\223\272\270\305\177\000\000\"\032\323\322/V\000\000\270\377\377\377"...}, tid = 0}, dealloc_stack = 0x7ffe00000002, alloc_type = 3065905672, dealloc_type = 32053, addr_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 0, kind = (unknown: 0xf4), shadow_byte = 5 '\005'}, heap = {addr = 0, alloc_tid = 11016591115764, free_tid = 137669652644360, alloc_stack_id = 392, free_stack_id = 0, chunk_access = {bad_addr = 137669652643968, offset = 752, chunk_begin = 140730930061320, chunk_size = 140487183567647, user_requested_alignment = 1, access_type = 0, alloc_type = 0}}, stack = {addr = 0, tid = 11016591115764, offset = 137669652644360, frame_pc = 392, access_size = 137669652643968, frame_descr = 0x2f0 <error: Cannot access memory at address 0x2f0>}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 11016591115764, size = 137669652644360, size_with_redzone = 392, name = 0x7d35b6be0080 "\005\n", module_name = 0x2f0 <error: Cannot access memory at address 0x2f0>, has_dynamic_init = 140730930061320, gcc_location = 0x7fc5b8ac0b1f <__asan::asan_malloc(unsigned long, __sanitizer::BufferedStackTrace*)+47>, odr_indicator = 1}, {beg = 136913738547648, size = 140730930047360, size_with_redzone = 140487184524754, name = 0x3 <error: Cannot access memory at address 0x3>, module_name = 0x1eb73a0000 <error: Cannot access memory at address 0x1eb73a0000>, has_dynamic_init = 140730930045280, gcc_location = 0x2, odr_indicator = 140487184524816}, {beg = 94763398530806, size = 140730930045456, size_with_redzone = 7, name = 0x7fc5b8c58fc0 <__asan::instance> "", module_name = 0x7be5b6ce8120 "\003\021", has_dynamic_init = 140730930045408, gcc_location = 0x7fc5b8bc2d66 <__sanitizer::RunFreeHooks(void*)+86>, odr_indicator = 140730930045504}, {beg = 6, size = 140487185240000, size_with_redzone = 136913738626352, name = 0x7ffe79182210 "\b", module_name = 0x7fc5b8ac6738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", has_dynamic_init = 120, gcc_location = 0x7c85b6c17530, odr_indicator = 140730930045440}}, reg_sites = {3086565742, 32709, 0, 0}, access_size = 94763397971708, size = 48 '0'}, wild = {addr = 0, access_size = 11016591115764}}}}}, MallocUsableSizeNotOwned = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\305{\000\000\377\000\000\000\000\000\000\000\240\367\331\322/V\000\000f-\274\270\305\177\000\000\240\035\030y\376\177\000\000\002\000\000\000\000\000\000\000\300\217\305\270\305\177\000\000\020\n\277\266E|\000\000p\035\030y\376\177\000\0008g\254\270\305\177\000\000^\000\000\000\000\000\000\000\020\n\277\266E|\000\000\320\000:\267\305\177\000\000\220\035\030y\376\177\000\000 \n\277\266E|\000\000q\000\000\000\000\000\000\000\000&\030y\376\177\000\000^\000\000\000\000\000\000\000\300%\030y\376\177\000\000\301\223\272\270\305\177\000\000\"\032\323\322/V\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffe00000002, addr_description = {data = {kind = 3065905672, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11016591115764, alloc_stack_id = 3065905672, free_stack_id = 32053, chunk_access = {bad_addr = 392, offset = 137669652643968, chunk_begin = 752, chunk_size = 140730930061320, user_requested_alignment = 2847, access_type = 0, alloc_type = 0}}, stack = {addr = 0, tid = 0, offset = 11016591115764, frame_pc = 137669652644360, access_size = 392, frame_descr = 0x7d35b6be0080 "\005\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11016591115764, size_with_redzone = 137669652644360, name = 0x188 <error: Cannot access memory at address 0x188>, module_name = 0x7d35b6be0080 "\005\n", has_dynamic_init = 752, gcc_location = 0x7ffe79186008, odr_indicator = 140487183567647}, {beg = 1, size = 136913738547648, size_with_redzone = 140730930047360, name = 0x7fc5b8baa5d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", module_name = 0x3 <error: Cannot access memory at address 0x3>, has_dynamic_init = 131923050496, gcc_location = 0x7ffe79182160, odr_indicator = 2}, {beg = 140487184524816, size = 94763398530806, size_with_redzone = 140730930045456, name = 0x7 <error: Cannot access memory at address 0x7>, module_name = 0x7fc5b8c58fc0 <__asan::instance> "", has_dynamic_init = 136226544714016, gcc_location = 0x7ffe791821e0, odr_indicator = 140487184624998}, {beg = 140730930045504, size = 6, size_with_redzone = 140487185240000, name = 0x7c85b6c17530 "\003\021", module_name = 0x7ffe79182210 "\b", has_dynamic_init = 140487183591224, gcc_location = 0x78, odr_indicator = 136913738626352}}, reg_sites = {2031624704, 32766, 3086565742, 32709}, access_size = 0, size = 252 '\374'}, wild = {addr = 0, access_size = 0}}}}}, SanitizerGetAllocatedSizeNotOwned = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\305{\000\000\377\000\000\000\000\000\000\000\240\367\331\322/V\000\000f-\274\270\305\177\000\000\240\035\030y\376\177\000\000\002\000\000\000\000\000\000\000\300\217\305\270\305\177\000\000\020\n\277\266E|\000\000p\035\030y\376\177\000\0008g\254\270\305\177\000\000^\000\000\000\000\000\000\000\020\n\277\266E|\000\000\320\000:\267\305\177\000\000\220\035\030y\376\177\000\000 \n\277\266E|\000\000q\000\000\000\000\000\000\000\000&\030y\376\177\000\000^\000\000\000\000\000\000\000\300%\030y\376\177\000\000\301\223\272\270\305\177\000\000\"\032\323\322/V\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffe00000002, addr_description = {data = {kind = 3065905672, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11016591115764, alloc_stack_id = 3065905672, free_stack_id = 32053, chunk_access = {bad_addr = 392, offset = 137669652643968, chunk_begin = 752, chunk_size = 140730930061320, user_requested_alignment = 2847, access_type = 0, alloc_type = 0}}, stack = {addr = 0, tid = 0, offset = 11016591115764, frame_pc = 137669652644360, access_size = 392, frame_descr = 0x7d35b6be0080 "\005\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11016591115764, size_with_redzone = 137669652644360, name = 0x188 <error: Cannot access memory at address 0x188>, module_name = 0x7d35b6be0080 "\005\n", has_dynamic_init = 752, gcc_location = 0x7ffe79186008, odr_indicator = 140487183567647}, {beg = 1, size = 136913738547648, size_with_redzone = 140730930047360, name = 0x7fc5b8baa5d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", module_name = 0x3 <error: Cannot access memory at address 0x3>, has_dynamic_init = 131923050496, gcc_location = 0x7ffe79182160, odr_indicator = 2}, {beg = 140487184524816, size = 94763398530806, size_with_redzone = 140730930045456, name = 0x7 <error: Cannot access memory at address 0x7>, module_name = 0x7fc5b8c58fc0 <__asan::instance> "", has_dynamic_init = 136226544714016, gcc_location = 0x7ffe791821e0, odr_indicator = 140487184624998}, {beg = 140730930045504, size = 6, size_with_redzone = 140487185240000, name = 0x7c85b6c17530 "\003\021", module_name = 0x7ffe79182210 "\b", has_dynamic_init = 140487183591224, gcc_location = 0x78, odr_indicator = 136913738626352}}, reg_sites = {2031624704, 32766, 3086565742, 32709}, access_size = 0, size = 252 '\374'}, wild = {addr = 0, access_size = 0}}}}}, CallocOverflow = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\305{\000\000\377\000\000\000\000\000\000\000\240\367\331\322/V\000\000f-\274\270\305\177\000\000\240\035\030y\376\177\000\000\002\000\000\000\000\000\000\000\300\217\305\270\305\177\000\000\020\n\277\266E|\000\000p\035\030y\376\177\000\0008g\254\270\305\177\000\000^\000\000\000\000\000\000\000\020\n\277\266E|\000\000\320\000:\267\305\177\000\000\220\035\030y\376\177\000\000 \n\277\266E|\000\000q\000\000\000\000\000\000\000\000&\030y\376\177\000\000^\000\000\000\000\000\000\000\300%\030y\376\177\000\000\301\223\272\270\305\177\000\000\"\032\323\322/V\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffe00000002, count = 137669652644360, size = 0}, ReallocArrayOverflow = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\305{\000\000\377\000\000\000\000\000\000\000\240\367\331\322/V\000\000f-\274\270\305\177\000\000\240\035\030y\376\177\000\000\002\000\000\000\000\000\000\000\300\217\305\270\305\177\000\000\020\n\277\266E|\000\000p\035\030y\376\177\000\0008g\254\270\305\177\000\000^\000\000\000\000\000\000\000\020\n\277\266E|\000\000\320\000:\267\305\177\000\000\220\035\030y\376\177\000\000 \n\277\266E|\000\000q\000\000\000\000\000\000\000\000&\030y\376\177\000\000^\000\000\000\000\000\000\000\300%\030y\376\177\000\000\301\223\272\270\305\177\000\000\"\032\323\322/V\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffe00000002, count = 137669652644360, size = 0}, PvallocOverflow = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\305{\000\000\377\000\000\000\000\000\000\000\240\367\331\322/V\000\000f-\274\270\305\177\000\000\240\035\030y\376\177\000\000\002\000\000\000\000\000\000\000\300\217\305\270\305\177\000\000\020\n\277\266E|\000\000p\035\030y\376\177\000\0008g\254\270\305\177\000\000^\000\000\000\000\000\000\000\020\n\277\266E|\000\000\320\000:\267\305\177\000\000\220\035\030y\376\177\000\000 \n\277\266E|\000\000q\000\000\000\000\000\000\000\000&\030y\376\177\000\000^\000\000\000\000\000\000\000\300%\030y\376\177\000\000\301\223\272\270\305\177\000\000\"\032\323\322/V\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffe00000002, size = 137669652644360}, InvalidAllocationAlignment = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\305{\000\000\377\000\000\000\000\000\000\000\240\367\331\322/V\000\000f-\274\270\305\177\000\000\240\035\030y\376\177\000\000\002\000\000\000\000\000\000\000\300\217\305\270\305\177\000\000\020\n\277\266E|\000\000p\035\030y\376\177\000\0008g\254\270\305\177\000\000^\000\000\000\000\000\000\000\020\n\277\266E|\000\000\320\000:\267\305\177\000\000\220\035\030y\376\177\000\000 \n\277\266E|\000\000q\000\000\000\000\000\000\000\000&\030y\376\177\000\000^\000\000\000\000\000\000\000\300%\030y\376\177\000\000\301\223\272\270\305\177\000\000\"\032\323\322/V\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffe00000002, alignment = 137669652644360}, InvalidAlignedAllocAlignment = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\305{\000\000\377\000\000\000\000\000\000\000\240\367\331\322/V\000\000f-\274\270\305\177\000\000\240\035\030y\376\177\000\000\002\000\000\000\000\000\000\000\300\217\305\270\305\177\000\000\020\n\277\266E|\000\000p\035\030y\376\177\000\0008g\254\270\305\177\000\000^\000\000\000\000\000\000\000\020\n\277\266E|\000\000\320\000:\267\305\177\000\000\220\035\030y\376\177\000\000 \n\277\266E|\000\000q\000\000\000\000\000\000\000\000&\030y\376\177\000\000^\000\000\000\000\000\000\000\300%\030y\376\177\000\000\301\223\272\270\305\177\000\000\"\032\323\322/V\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffe00000002, size = 137669652644360, alignment = 0}, InvalidPosixMemalignAlignment = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\305{\000\000\377\000\000\000\000\000\000\000\240\367\331\322/V\000\000f-\274\270\305\177\000\000\240\035\030y\376\177\000\000\002\000\000\000\000\000\000\000\300\217\305\270\305\177\000\000\020\n\277\266E|\000\000p\035\030y\376\177\000\0008g\254\270\305\177\000\000^\000\000\000\000\000\000\000\020\n\277\266E|\000\000\320\000:\267\305\177\000\000\220\035\030y\376\177\000\000 \n\277\266E|\000\000q\000\000\000\000\000\000\000\000&\030y\376\177\000\000^\000\000\000\000\000\000\000\300%\030y\376\177\000\000\301\223\272\270\305\177\000\000\"\032\323\322/V\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffe00000002, alignment = 137669652644360}, AllocationSizeTooBig = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\305{\000\000\377\000\000\000\000\000\000\000\240\367\331\322/V\000\000f-\274\270\305\177\000\000\240\035\030y\376\177\000\000\002\000\000\000\000\000\000\000\300\217\305\270\305\177\000\000\020\n\277\266E|\000\000p\035\030y\376\177\000\0008g\254\270\305\177\000\000^\000\000\000\000\000\000\000\020\n\277\266E|\000\000\320\000:\267\305\177\000\000\220\035\030y\376\177\000\000 \n\277\266E|\000\000q\000\000\000\000\000\000\000\000&\030y\376\177\000\000^\000\000\000\000\000\000\000\300%\030y\376\177\000\000\301\223\272\270\305\177\000\000\"\032\323\322/V\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffe00000002, user_size = 137669652644360, total_size = 0, max_size = 0}, RssLimitExceeded = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\305{\000\000\377\000\000\000\000\000\000\000\240\367\331\322/V\000\000f-\274\270\305\177\000\000\240\035\030y\376\177\000\000\002\000\000\000\000\000\000\000\300\217\305\270\305\177\000\000\020\n\277\266E|\000\000p\035\030y\376\177\000\0008g\254\270\305\177\000\000^\000\000\000\000\000\000\000\020\n\277\266E|\000\000\320\000:\267\305\177\000\000\220\035\030y\376\177\000\000 \n\277\266E|\000\000q\000\000\000\000\000\000\000\000&\030y\376\177\000\000^\000\000\000\000\000\000\000\300%\030y\376\177\000\000\301\223\272\270\305\177\000\000\"\032\323\322/V\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffe00000002}, OutOfMemory = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\305{\000\000\377\000\000\000\000\000\000\000\240\367\331\322/V\000\000f-\274\270\305\177\000\000\240\035\030y\376\177\000\000\002\000\000\000\000\000\000\000\300\217\305\270\305\177\000\000\020\n\277\266E|\000\000p\035\030y\376\177\000\0008g\254\270\305\177\000\000^\000\000\000\000\000\000\000\020\n\277\266E|\000\000\320\000:\267\305\177\000\000\220\035\030y\376\177\000\000 \n\277\266E|\000\000q\000\000\000\000\000\000\000\000&\030y\376\177\000\000^\000\000\000\000\000\000\000\300%\030y\376\177\000\000\301\223\272\270\305\177\000\000\"\032\323\322/V\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffe00000002, requested_size = 137669652644360}, StringFunctionMemoryRangesOverlap = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\305{\000\000\377\000\000\000\000\000\000\000\240\367\331\322/V\000\000f-\274\270\305\177\000\000\240\035\030y\376\177\000\000\002\000\000\000\000\000\000\000\300\217\305\270\305\177\000\000\020\n\277\266E|\000\000p\035\030y\376\177\000\0008g\254\270\305\177\000\000^\000\000\000\000\000\000\000\020\n\277\266E|\000\000\320\000:\267\305\177\000\000\220\035\030y\376\177\000\000 \n\277\266E|\000\000q\000\000\000\000\000\000\000\000&\030y\376\177\000\000^\000\000\000\000\000\000\000\300%\030y\376\177\000\000\301\223\272\270\305\177\000\000\"\032\323\322/V\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffe00000002, length1 = 137669652644360, length2 = 0, addr1_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 11016591115764, kind = (unknown: 0x8), shadow_byte = 2 '\002'}, heap = {addr = 11016591115764, alloc_tid = 137669652644360, free_tid = 392, alloc_stack_id = 3065905280, free_stack_id = 32053, chunk_access = {bad_addr = 752, offset = 140730930061320, chunk_begin = 140487183567647, chunk_size = 1, user_requested_alignment = 448, access_type = 0, alloc_type = 1}}, stack = {addr = 11016591115764, tid = 137669652644360, offset = 392, frame_pc = 137669652643968, access_size = 752, frame_descr = 0x7ffe79186008 <error: Cannot access memory at address 0x7ffe79186008>}, global = {addr = 11016591115764, static kMaxGlobals = 4, globals = {{beg = 137669652644360, size = 392, size_with_redzone = 137669652643968, name = 0x2f0 <error: Cannot access memory at address 0x2f0>, module_name = 0x7ffe79186008 <error: Cannot access memory at address 0x7ffe79186008>, has_dynamic_init = 140487183567647, gcc_location = 0x1, odr_indicator = 136913738547648}, {beg = 140730930047360, size = 140487184524754, size_with_redzone = 3, name = 0x1eb73a0000 <error: Cannot access memory at address 0x1eb73a0000>, module_name = 0x7ffe79182160 "\020\246\272\270\305\177", has_dynamic_init = 2, gcc_location = 0x7fc5b8baa610 <___interceptor_malloc(__sanitizer::uptr)+192>, odr_indicator = 94763398530806}, {beg = 140730930045456, size = 7, size_with_redzone = 140487185240000, name = 0x7be5b6ce8120 "\003\021", module_name = 0x7ffe791821e0 "", has_dynamic_init = 140487184624998, gcc_location = 0x7ffe79182240, odr_indicator = 6}, {beg = 140487185240000, size = 136913738626352, size_with_redzone = 140730930045456, name = 0x7fc5b8ac6738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", module_name = 0x78 <error: Cannot access memory at address 0x78>, has_dynamic_init = 136913738626352, gcc_location = 0x7ffe79182200, odr_indicator = 140487171850606}}, reg_sites = {0, 0, 3534520060, 22063}, access_size = 140730930047280, size = 32 ' '}, wild = {addr = 11016591115764, access_size = 137669652644360}}}}, addr2_description = {data = {kind = 8, {shadow = {addr = 140487184951191, kind = __asan::kShadowKindLow, shadow_byte = 253 '\375'}, heap = {addr = 140487184951191, alloc_tid = 140487181532416, free_tid = 140730930046928, alloc_stack_id = 3099027667, free_stack_id = 32709, chunk_access = {bad_addr = 140730930046928, offset = 3096402488, chunk_begin = 140730930047024, chunk_size = 140487181467222, user_requested_alignment = 384, access_type = 0, alloc_type = 0}}, stack = {addr = 140487184951191, tid = 140487181532416, offset = 140730930046928, frame_pc = 140487184312531, access_size = 140730930046928, frame_descr = 0xb88f5a38 <error: Cannot access memory at address 0xb88f5a38>}, global = {addr = 140487184951191, static kMaxGlobals = 4, globals = {{beg = 140487181532416, size = 140730930046928, size_with_redzone = 140487184312531, name = 0x7ffe791827d0 "\200\001\276\266\325|", module_name = 0xb88f5a38 <error: Cannot access memory at address 0xb88f5a38>, has_dynamic_init = 140730930047024, gcc_location = 0x7fc5b88bfe56, odr_indicator = 137257335783808}, {beg = 140487181467172, size = 140730930046976, size_with_redzone = 6866423646880, name = 0x21 <error: Cannot access memory at address 0x21>, module_name = 0x2ee7c224 <error: Cannot access memory at address 0x2ee7c224>, has_dynamic_init = 140730930047008, gcc_location = 0x7c25b6be0aa0, odr_indicator = 140730930047040}, {beg = 136913738626368, size = 137257335783808, size_with_redzone = 136363983054992, name = 0x562fd2ca87c0 <watch_destroy> "\363\017\036\372SH\211\373H\203\354\020H\205\377\017\2049\002", module_name = 0x7fc5b8924dce "I\211\305L9\360tJH\205\300tUH\213E\310dH+\004%(", has_dynamic_init = 136913738626368, gcc_location = 0x7fc5b8924dce, odr_indicator = 94763399940032}, {beg = 0, size = 140730930047136, size_with_redzone = 140487181880782, name = 0x7cc5b6be0c40 "\001", module_name = 0x7c05b6bf84d0 "\002", has_dynamic_init = 44, gcc_location = 0x0, odr_indicator = 136363982685400}}, reg_sites = {3066374312, 31749, 3066004720, 31749}, access_size = 94763399941902, size = 144 '\220'}, wild = {addr = 140487184951191, access_size = 140487181532416}}}}, function = 0xea281945ac4e8100 <error: Cannot access memory at address 0xea281945ac4e8100>}, StringFunctionSizeOverflow = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\305{\000\000\377\000\000\000\000\000\000\000\240\367\331\322/V\000\000f-\274\270\305\177\000\000\240\035\030y\376\177\000\000\002\000\000\000\000\000\000\000\300\217\305\270\305\177\000\000\020\n\277\266E|\000\000p\035\030y\376\177\000\0008g\254\270\305\177\000\000^\000\000\000\000\000\000\000\020\n\277\266E|\000\000\320\000:\267\305\177\000\000\220\035\030y\376\177\000\000 \n\277\266E|\000\000q\000\000\000\000\000\000\000\000&\030y\376\177\000\000^\000\000\000\000\000\000\000\300%\030y\376\177\000\000\301\223\272\270\305\177\000\000\"\032\323\322/V\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffe00000002, addr_description = {data = {kind = 3065905672, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11016591115764, alloc_stack_id = 3065905672, free_stack_id = 32053, chunk_access = {bad_addr = 392, offset = 137669652643968, chunk_begin = 752, chunk_size = 140730930061320, user_requested_alignment = 2847, access_type = 0, alloc_type = 0}}, stack = {addr = 0, tid = 0, offset = 11016591115764, frame_pc = 137669652644360, access_size = 392, frame_descr = 0x7d35b6be0080 "\005\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11016591115764, size_with_redzone = 137669652644360, name = 0x188 <error: Cannot access memory at address 0x188>, module_name = 0x7d35b6be0080 "\005\n", has_dynamic_init = 752, gcc_location = 0x7ffe79186008, odr_indicator = 140487183567647}, {beg = 1, size = 136913738547648, size_with_redzone = 140730930047360, name = 0x7fc5b8baa5d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", module_name = 0x3 <error: Cannot access memory at address 0x3>, has_dynamic_init = 131923050496, gcc_location = 0x7ffe79182160, odr_indicator = 2}, {beg = 140487184524816, size = 94763398530806, size_with_redzone = 140730930045456, name = 0x7 <error: Cannot access memory at address 0x7>, module_name = 0x7fc5b8c58fc0 <__asan::instance> "", has_dynamic_init = 136226544714016, gcc_location = 0x7ffe791821e0, odr_indicator = 140487184624998}, {beg = 140730930045504, size = 6, size_with_redzone = 140487185240000, name = 0x7c85b6c17530 "\003\021", module_name = 0x7ffe79182210 "\b", has_dynamic_init = 140487183591224, gcc_location = 0x78, odr_indicator = 136913738626352}}, reg_sites = {2031624704, 32766, 3086565742, 32709}, access_size = 0, size = 252 '\374'}, wild = {addr = 0, access_size = 0}}}}, size = 140730930047280}, BadParamsToAnnotateContiguousContainer = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\305{\000\000\377\000\000\000\000\000\000\000\240\367\331\322/V\000\000f-\274\270\305\177\000\000\240\035\030y\376\177\000\000\002\000\000\000\000\000\000\000\300\217\305\270\305\177\000\000\020\n\277\266E|\000\000p\035\030y\376\177\000\0008g\254\270\305\177\000\000^\000\000\000\000\000\000\000\020\n\277\266E|\000\000\320\000:\267\305\177\000\000\220\035\030y\376\177\000\000 \n\277\266E|\000\000q\000\000\000\000\000\000\000\000&\030y\376\177\000\000^\000\000\000\000\000\000\000\300%\030y\376\177\000\000\301\223\272\270\305\177\000\000\"\032\323\322/V\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffe00000002, beg = 137669652644360, end = 0, old_mid = 0, new_mid = 11016591115764}, BadParamsToAnnotateDoubleEndedContiguousContainer = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\305{\000\000\377\000\000\000\000\000\000\000\240\367\331\322/V\000\000f-\274\270\305\177\000\000\240\035\030y\376\177\000\000\002\000\000\000\000\000\000\000\300\217\305\270\305\177\000\000\020\n\277\266E|\000\000p\035\030y\376\177\000\0008g\254\270\305\177\000\000^\000\000\000\000\000\000\000\020\n\277\266E|\000\000\320\000:\267\305\177\000\000\220\035\030y\376\177\000\000 \n\277\266E|\000\000q\000\000\000\000\000\000\000\000&\030y\376\177\000\000^\000\000\000\000\000\000\000\300%\030y\376\177\000\000\301\223\272\270\305\177\000\000\"\032\323\322/V\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffe00000002, storage_beg = 137669652644360, storage_end = 0, old_container_beg = 0, old_container_end = 11016591115764, new_container_beg = 137669652644360, new_container_end = 392}, BadParamsToCopyContiguousContainerAnnotations = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\305{\000\000\377\000\000\000\000\000\000\000\240\367\331\322/V\000\000f-\274\270\305\177\000\000\240\035\030y\376\177\000\000\002\000\000\000\000\000\000\000\300\217\305\270\305\177\000\000\020\n\277\266E|\000\000p\035\030y\376\177\000\0008g\254\270\305\177\000\000^\000\000\000\000\000\000\000\020\n\277\266E|\000\000\320\000:\267\305\177\000\000\220\035\030y\376\177\000\000 \n\277\266E|\000\000q\000\000\000\000\000\000\000\000&\030y\376\177\000\000^\000\000\000\000\000\000\000\300%\030y\376\177\000\000\301\223\272\270\305\177\000\000\"\032\323\322/V\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffe00000002, old_storage_beg = 137669652644360, old_storage_end = 0, new_storage_beg = 0, new_storage_end = 11016591115764}, ODRViolation = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\305{\000\000\377\000\000\000\000\000\000\000\240\367\331\322/V\000\000f-\274\270\305\177\000\000\240\035\030y\376\177\000\000\002\000\000\000\000\000\000\000\300\217\305\270\305\177\000\000\020\n\277\266E|\000\000p\035\030y\376\177\000\0008g\254\270\305\177\000\000^\000\000\000\000\000\000\000\020\n\277\266E|\000\000\320\000:\267\305\177\000\000\220\035\030y\376\177\000\000 \n\277\266E|\000\000q\000\000\000\000\000\000\000\000&\030y\376\177\000\000^\000\000\000\000\000\000\000\300%\030y\376\177\000\000\301\223\272\270\305\177\000\000\"\032\323\322/V\000\000\270\377\377\377"...}, tid = 0}, global1 = {beg = 140728898420738, size = 137669652644360, size_with_redzone = 0, name = 0x0, module_name = 0xa05000005f4 <error: Cannot access memory at address 0xa05000005f4>, has_dynamic_init = 137669652644360, gcc_location = 0x188, odr_indicator = 137669652643968}, global2 = {beg = 752, size = 140730930061320, size_with_redzone = 140487183567647, name = 0x1 <error: Cannot access memory at address 0x1>, module_name = 0x7c85b6c041c0 "\200\a\276\2665}", has_dynamic_init = 140730930047360, gcc_location = 0x7fc5b8baa5d2 <___interceptor_malloc(__sanitizer::uptr)+130>, odr_indicator = 3}, stack_id1 = 3074031616, stack_id2 = 30}, InvalidPointerPair = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\305{\000\000\377\000\000\000\000\000\000\000\240\367\331\322/V\000\000f-\274\270\305\177\000\000\240\035\030y\376\177\000\000\002\000\000\000\000\000\000\000\300\217\305\270\305\177\000\000\020\n\277\266E|\000\000p\035\030y\376\177\000\0008g\254\270\305\177\000\000^\000\000\000\000\000\000\000\020\n\277\266E|\000\000\320\000:\267\305\177\000\000\220\035\030y\376\177\000\000 \n\277\266E|\000\000q\000\000\000\000\000\000\000\000&\030y\376\177\000\000^\000\000\000\000\000\000\000\300%\030y\376\177\000\000\301\223\272\270\305\177\000\000\"\032\323\322/V\000\000\270\377\377\377"...}, tid = 0}, pc = 140728898420738, bp = 137669652644360, sp = 0, addr1_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 11016591115764, kind = (unknown: 0x8), shadow_byte = 2 '\002'}, heap = {addr = 11016591115764, alloc_tid = 137669652644360, free_tid = 392, alloc_stack_id = 3065905280, free_stack_id = 32053, chunk_access = {bad_addr = 752, offset = 140730930061320, chunk_begin = 140487183567647, chunk_size = 1, user_requested_alignment = 448, access_type = 0, alloc_type = 1}}, stack = {addr = 11016591115764, tid = 137669652644360, offset = 392, frame_pc = 137669652643968, access_size = 752, frame_descr = 0x7ffe79186008 <error: Cannot access memory at address 0x7ffe79186008>}, global = {addr = 11016591115764, static kMaxGlobals = 4, globals = {{beg = 137669652644360, size = 392, size_with_redzone = 137669652643968, name = 0x2f0 <error: Cannot access memory at address 0x2f0>, module_name = 0x7ffe79186008 <error: Cannot access memory at address 0x7ffe79186008>, has_dynamic_init = 140487183567647, gcc_location = 0x1, odr_indicator = 136913738547648}, {beg = 140730930047360, size = 140487184524754, size_with_redzone = 3, name = 0x1eb73a0000 <error: Cannot access memory at address 0x1eb73a0000>, module_name = 0x7ffe79182160 "\020\246\272\270\305\177", has_dynamic_init = 2, gcc_location = 0x7fc5b8baa610 <___interceptor_malloc(__sanitizer::uptr)+192>, odr_indicator = 94763398530806}, {beg = 140730930045456, size = 7, size_with_redzone = 140487185240000, name = 0x7be5b6ce8120 "\003\021", module_name = 0x7ffe791821e0 "", has_dynamic_init = 140487184624998, gcc_location = 0x7ffe79182240, odr_indicator = 6}, {beg = 140487185240000, size = 136913738626352, size_with_redzone = 140730930045456, name = 0x7fc5b8ac6738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", module_name = 0x78 <error: Cannot access memory at address 0x78>, has_dynamic_init = 136913738626352, gcc_location = 0x7ffe79182200, odr_indicator = 140487171850606}}, reg_sites = {0, 0, 3534520060, 22063}, access_size = 140730930047280, size = 32 ' '}, wild = {addr = 11016591115764, access_size = 137669652644360}}}}, addr2_description = {data = {kind = 8, {shadow = {addr = 140487184951191, kind = __asan::kShadowKindLow, shadow_byte = 253 '\375'}, heap = {addr = 140487184951191, alloc_tid = 140487181532416, free_tid = 140730930046928, alloc_stack_id = 3099027667, free_stack_id = 32709, chunk_access = {bad_addr = 140730930046928, offset = 3096402488, chunk_begin = 140730930047024, chunk_size = 140487181467222, user_requested_alignment = 384, access_type = 0, alloc_type = 0}}, stack = {addr = 140487184951191, tid = 140487181532416, offset = 140730930046928, frame_pc = 140487184312531, access_size = 140730930046928, frame_descr = 0xb88f5a38 <error: Cannot access memory at address 0xb88f5a38>}, global = {addr = 140487184951191, static kMaxGlobals = 4, globals = {{beg = 140487181532416, size = 140730930046928, size_with_redzone = 140487184312531, name = 0x7ffe791827d0 "\200\001\276\266\325|", module_name = 0xb88f5a38 <error: Cannot access memory at address 0xb88f5a38>, has_dynamic_init = 140730930047024, gcc_location = 0x7fc5b88bfe56, odr_indicator = 137257335783808}, {beg = 140487181467172, size = 140730930046976, size_with_redzone = 6866423646880, name = 0x21 <error: Cannot access memory at address 0x21>, module_name = 0x2ee7c224 <error: Cannot access memory at address 0x2ee7c224>, has_dynamic_init = 140730930047008, gcc_location = 0x7c25b6be0aa0, odr_indicator = 140730930047040}, {beg = 136913738626368, size = 137257335783808, size_with_redzone = 136363983054992, name = 0x562fd2ca87c0 <watch_destroy> "\363\017\036\372SH\211\373H\203\354\020H\205\377\017\2049\002", module_name = 0x7fc5b8924dce "I\211\305L9\360tJH\205\300tUH\213E\310dH+\004%(", has_dynamic_init = 136913738626368, gcc_location = 0x7fc5b8924dce, odr_indicator = 94763399940032}, {beg = 0, size = 140730930047136, size_with_redzone = 140487181880782, name = 0x7cc5b6be0c40 "\001", module_name = 0x7c05b6bf84d0 "\002", has_dynamic_init = 44, gcc_location = 0x0, odr_indicator = 136363982685400}}, reg_sites = {3066374312, 31749, 3066004720, 31749}, access_size = 94763399941902, size = 144 '\220'}, wild = {addr = 140487184951191, access_size = 140487181532416}}}}}, Generic = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\305{\000\000\377\000\000\000\000\000\000\000\240\367\331\322/V\000\000f-\274\270\305\177\000\000\240\035\030y\376\177\000\000\002\000\000\000\000\000\000\000\300\217\305\270\305\177\000\000\020\n\277\266E|\000\000p\035\030y\376\177\000\0008g\254\270\305\177\000\000^\000\000\000\000\000\000\000\020\n\277\266E|\000\000\320\000:\267\305\177\000\000\220\035\030y\376\177\000\000 \n\277\266E|\000\000q\000\000\000\000\000\000\000\000&\030y\376\177\000\000^\000\000\000\000\000\000\000\300%\030y\376\177\000\000\301\223\272\270\305\177\000\000\"\032\323\322/V\000\000\270\377\377\377"...}, tid = 0}, addr_description = {data = {kind = __asan::kAddressKindHeap, {shadow = {addr = 137669652644360, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 137669652644360, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1524, free_stack_id = 2565, chunk_access = {bad_addr = 137669652644360, offset = 392, chunk_begin = 137669652643968, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, stack = {addr = 137669652644360, tid = 0, offset = 0, frame_pc = 11016591115764, access_size = 137669652644360, frame_descr = 0x188 <error: Cannot access memory at address 0x188>}, global = {addr = 137669652644360, static kMaxGlobals = 4, globals = {{beg = 0, size = 0, size_with_redzone = 11016591115764, name = 0x7d35b6be0208 "", module_name = 0x188 <error: Cannot access memory at address 0x188>, has_dynamic_init = 137669652643968, gcc_location = 0x2f0, odr_indicator = 140730930061320}, {beg = 140487183567647, size = 1, size_with_redzone = 136913738547648, name = 0x7ffe79182980 "0\002\227\322/V", module_name = 0x7fc5b8baa5d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", has_dynamic_init = 3, gcc_location = 0x1eb73a0000, odr_indicator = 140730930045280}, {beg = 2, size = 140487184524816, size_with_redzone = 94763398530806, name = 0x7ffe79182210 "\b", module_name = 0x7 <error: Cannot access memory at address 0x7>, has_dynamic_init = 140487185240000, gcc_location = 0x7be5b6ce8120, odr_indicator = 140730930045408}, {beg = 140487184624998, size = 140730930045504, size_with_redzone = 6, name = 0x7fc5b8c58fc0 <__asan::instance> "", module_name = 0x7c85b6c17530 "\003\021", has_dynamic_init = 140730930045456, gcc_location = 0x7fc5b8ac6738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248>, odr_indicator = 120}}, reg_sites = {3066131760, 31877, 2031624704, 32766}, access_size = 140487171850606, size = 0 '\000'}, wild = {addr = 137669652644360, access_size = 0}}}}, pc = 94763397971708, bp = 140730930047280, sp = 140730930047264, access_size = 8, bug_descr = 0x7fc5b8c12797 "heap-use-after-free", is_write = false, shadow_val = 253 '\375'}}}, halt_on_error_ = true}
                error = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\305{\000\000\377\000\000\000\000\000\000\000\240\367\331\322/V\000\000f-\274\270\305\177\000\000\240\035\030y\376\177\000\000\002\000\000\000\000\000\000\000\300\217\305\270\305\177\000\000\020\n\277\266E|\000\000p\035\030y\376\177\000\0008g\254\270\305\177\000\000^\000\000\000\000\000\000\000\020\n\277\266E|\000\000\320\000:\267\305\177\000\000\220\035\030y\376\177\000\000 \n\277\266E|\000\000q\000\000\000\000\000\000\000\000&\030y\376\177\000\000^\000\000\000\000\000\000\000\300%\030y\376\177\000\000\301\223\272\270\305\177\000\000\"\032\323\322/V\000\000\270\377\377\377"...}, tid = 0}, addr_description = {data = {kind = __asan::kAddressKindHeap, {shadow = {addr = 137669652644360, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 137669652644360, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1524, free_stack_id = 2565, chunk_access = {bad_addr = 137669652644360, offset = 392, chunk_begin = 137669652643968, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, stack = {addr = 137669652644360, tid = 0, offset = 0, frame_pc = 11016591115764, access_size = 137669652644360, frame_descr = 0x188 <error: Cannot access memory at address 0x188>}, global = {addr = 137669652644360, static kMaxGlobals = 4, globals = {{beg = 0, size = 0, size_with_redzone = 11016591115764, name = 0x7d35b6be0208 "", module_name = 0x188 <error: Cannot access memory at address 0x188>, has_dynamic_init = 137669652643968, gcc_location = 0x2f0, odr_indicator = 140730930061320}, {beg = 140487183567647, size = 1, size_with_redzone = 136913738547648, name = 0x7ffe79182980 "0\002\227\322/V", module_name = 0x7fc5b8baa5d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", has_dynamic_init = 3, gcc_location = 0x1eb73a0000, odr_indicator = 140730930045280}, {beg = 2, size = 140487184524816, size_with_redzone = 94763398530806, name = 0x7ffe79182210 "\b", module_name = 0x7 <error: Cannot access memory at address 0x7>, has_dynamic_init = 140487185240000, gcc_location = 0x7be5b6ce8120, odr_indicator = 140730930045408}, {beg = 140487184624998, size = 140730930045504, size_with_redzone = 6, name = 0x7fc5b8c58fc0 <__asan::instance> "", module_name = 0x7c85b6c17530 "\003\021", has_dynamic_init = 140730930045456, gcc_location = 0x7fc5b8ac6738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248>, odr_indicator = 120}}, reg_sites = {3066131760, 31877, 2031624704, 32766}, access_size = 140487171850606, size = 0 '\000'}, wild = {addr = 137669652644360, access_size = 0}}}}, pc = 94763397971708, bp = 140730930047280, sp = 140730930047264, access_size = 8, bug_descr = 0x7fc5b8c12797 "heap-use-after-free", is_write = false, shadow_val = 253 '\375'}
        #9  0x00007fc5b8bb6f8d in __asan::ReportGenericError (pc=<optimized out>, bp=bp@entry=140730930047280, sp=sp@entry=140730930047264, addr=<optimized out>, is_write=is_write@entry=false, access_size=access_size@entry=8, exp=<optimized out>, fatal=true) at ../../../../src/libsanitizer/asan/asan_report.cpp:536
                in_report = <optimized out>
                error = <optimized out>
                enable_fp = <optimized out>
        #10 0x00007fc5b8bb83f9 in __asan::__asan_report_load8 (addr=<optimized out>) at ../../../../src/libsanitizer/asan/asan_rtl.cpp:131
                bp = 140730930047280
                pc = <optimized out>
                local_stack = 140730930047392
                sp = 140730930047264
        #11 0x0000562fd2ac7efc in device_get_adapter (device=<optimized out>) at src/device.c:6917
        No locals.
        #12 0x0000562fd297026f in find_cig_session (data=0x7c85b6c0b9c0, match_data=0x7bc5b5a83fb0) at profiles/audio/bap.c:2500
                session = 0x7c85b6c0b9c0
                info = 0x7bc5b5a83fb0
        #13 0x0000562fd2b4f0d1 in queue_find (queue=<optimized out>, function=function@entry=0x562fd2970230 <find_cig_session>, match_data=match_data@entry=0x7bc5b5a83fb0) at src/shared/queue.c:230
                entry = 0x7be5b6c9ccf0
        #14 0x0000562fd2976d34 in find_cig_enumerate (data=0x7c85b6c041c0) at profiles/audio/bap.c:2539
                info = <optimized out>
        #15 bap_update_cigs_cb (user_data=0x7c85b6c041c0) at profiles/audio/bap.c:2693
                data = 0x7c85b6c041c0
                cigs = <optimized out>
                unset = <optimized out>
        #16 0x00007fc5b88c2b9b in ?? () from /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
        No symbol table info available.
        #17 0x00007fc5b88c41d7 in ?? () from /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
        No symbol table info available.
        #18 0x00007fc5b88c4577 in g_main_loop_run () from /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
        No symbol table info available.
        #19 0x0000562fd2caafe9 in mainloop_run () at src/shared/mainloop-glib.c:65
        No locals.
        #20 0x0000562fd2cab91b in mainloop_run_with_signal (func=func@entry=0x562fd2b10a30 <signal_callback>, user_data=user_data@entry=0x0) at src/shared/mainloop-notify.c:196
                data = 0x7bf5b6be3490
                io = 0x7c05b6bf9b10
                ret = <optimized out>
        #21 0x0000562fd28292fb in main (argc=<optimized out>, argv=<optimized out>) at src/main.c:1713
                context = <optimized out>
                err = <optimized out>
                sdp_mtu = 0
                sdp_flags = <optimized out>
                gdbus_flags = <optimized out>
                __func__ = "main""


https://github.com/bluez/bluez/pull/2550

---
Regards,
Linux Bluetooth

RE: [BlueZ,1/3] transport: Preserve Release on late BAP ready

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 697 bytes --]

This is an automated email and please do not reply to this email.

Dear Submitter,

This series was picked up by the CI more than 2 weeks ago and the pull
request created for it is still open, which means the series was never
applied to the tree.

   Series:       [BlueZ,1/3] transport: Preserve Release on late BAP ready
   Pull Request: https://github.com/bluez/bluez/pull/2550
   Created:      2026-09-18 22:25:01+00:00

The pull request has been closed and no further action is taken on this
series.

If the change should still be considered, it must be resent to the Linux
Bluetooth mailing list (linux-bluetooth@vger.kernel.org) so that it is
picked up again.

---
Regards,
Linux Bluetooth

Re: [PATCH BlueZ 1/3] transport: Preserve Release on late BAP ready

[patchwork-bot+bluetooth]

Hello:

This series was applied to bluetooth/bluez.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Fri, 18 Sep 2026 20:21:51 +0000 you wrote:
> From: Derek Tern <1263187-dt@users.noreply.gitlab.freedesktop.org>
> 
> A late stream-ready event can reach bap_resume_complete() after Release
> has queued Disable. It then replies to Release with an Acquire payload
> and drops the Disable request ID. Client disconnection can subsequently
> free the owner while the Disable callback still refers to it.
> 
> [...]

Here is the summary with links:
  - [BlueZ,1/3] transport: Preserve Release on late BAP ready
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=d852faf0b1d1
  - [BlueZ,2/3] bap: Recreate stream IO after an early Enable
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=47f783ff5ba4
  - [BlueZ,3/3] test: Cover BAP transport release and reacquire
    (no matching commit)

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html