[PATCH BlueZ 0/2] Avoid local metadata Config notifications

[PATCH BlueZ 0/2] Avoid local metadata Config notifications

[dt]

When a client reuses a Codec Configured ASE, caching local metadata
emits a CONFIG-to-CONFIG callback before the peer reports the new
codec configuration. The profile treats that callback as completion.
If the control point response arrives before the peer ASE notification,
QoS setup can run while the stream still needs reconfiguration.

The first patch caches metadata without emitting a client CONFIG
notification. Peer notifications, server metadata handling, and initial
IDLE metadata remain unchanged. The second patch adds regressions for
both remote Sink and Source ASEs: reuse a real configured stream,
verify metadata retention, reject QoS before the peer notification,
and require successful QoS request and wire exchange afterward.

Validation on canonical and GitHub master
 e2ec6827f7bed94912c23288a34f868e7002e847:

- make -j4 check: all 35 configured unit-test programs passed,
  including all 699 BAP cases.
- Both new regressions fail at the premature QoS assertion with only
  the source fix removed, and pass with it restored.
- git diff --check and checkpatch with the documented BlueZ options
  passed without diagnostics.

Two stock BlueZ 5.87 profile-switch captures showed local QoS failure
about 0.2 ms after Codec CP success and before fresh CONFIG arrived
about 2 ms after that response. Internal flags are a source-backed
inference, not directly observable in those captures.

The equivalent fix in a private BlueZ 5.87 build passed initial duplex
and three playback/duplex round trips. Control captures showed fresh
CONFIG before each QoS request and no extra Release during new
configuration. It was subsequently retained in the reporter's local
stack; the reporter now considers ordinary-use testing satisfactory.

Hardware testing used other local kernel and PipeWire changes. It was
not an isolated stock-stack A/B test, and the refreshed upstream daemon
has not been run on hardware. Earlier intermittent transport failures
and Receiver Stop Ready errors after Release are not claimed fixed by
this change. The regression tests cover the shared API and wire
fixtures, not the complete profile scheduler or four concurrent ASEs.

This differs from b3dd59987, which addressed initial metadata in IDLE.

Derek Tern (2):
  shared/bap: Skip local metadata Config callbacks
  unit: Test metadata during BAP client reconfig

 src/shared/bap.c |   5 ++
 unit/test-bap.c  | 134 +++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 139 insertions(+)


base-commit: e2ec6827f7bed94912c23288a34f868e7002e847
-- 
2.55.0

[PATCH BlueZ 1/2] shared/bap: Skip local metadata Config callbacks

[dt]

From: Derek Tern <1263187-dt@users.noreply.gitlab.freedesktop.org>

When reconfiguring a client stream that is already Codec Configured,
setup_config() queues Codec Configuration and then caches metadata.
stream_metadata() emits a same-state CONFIG notification for that local
update. The profile callback treats it as the peer's configuration
completion and clears config_pending before the peer has responded.

If the control point response precedes the ASE state notification, QoS
setup can run while need_reconfig is still set and fail locally.

Cache client metadata in CONFIG without emitting a state notification.
Keep genuine peer CONFIG notifications and server metadata handling
unchanged.
---
 src/shared/bap.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/shared/bap.c b/src/shared/bap.c
index 891a2f4fd..44cfd1ab4 100644
--- a/src/shared/bap.c
+++ b/src/shared/bap.c
@@ -2278,6 +2278,11 @@ static uint8_t stream_metadata(struct bt_bap_stream *stream, struct iovec *meta,
 	util_iov_free(stream->meta, 1);
 	stream->meta = util_iov_dup(meta, 1);
 
+	/* Local client metadata does not confirm the peer codec config. */
+	if (stream->client &&
+		bt_bap_stream_get_state(stream) == BT_BAP_STREAM_STATE_CONFIG)
+		return 0;
+
 	switch (bt_bap_stream_get_state(stream)) {
 	case BT_BAP_STREAM_STATE_IDLE:
 		/* Initial metadata */
-- 
2.55.0

RE: Avoid local metadata Config notifications

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 4343 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1166364/

---Test result---

Test Summary:
CheckPatch                    PASS      0.67 seconds
GitLint                       PASS      0.39 seconds
BuildEll                      PASS      20.14 seconds
BluezMake                     PASS      400.18 seconds
MakeCheck                     PASS      14.50 seconds
MakeDistcheck                 PASS      140.91 seconds
CheckValgrind                 PASS      234.50 seconds
CheckSmatch                   WARNING   292.56 seconds
bluezmakeextell               PASS      94.96 seconds
TestFunctional                FAIL      1127.01 seconds
IncrementalBuild              PASS      423.37 seconds
ScanBuild                     PASS      1131.12 seconds

Details
##############################
Test: CheckSmatch - WARNING
Desc: Run smatch tool with source
Output:
src/shared/bap.c:318:25: warning: array of flexible structuressrc/shared/bap.c: note: in included file:./src/shared/ascs.h:88:25: warning: array of flexible structuressrc/shared/bap.c:318:25: warning: array of flexible structuressrc/shared/bap.c: note: in included file:./src/shared/ascs.h:88:25: warning: array of flexible structuressrc/shared/bap.c:318:25: warning: array of flexible structuressrc/shared/bap.c: note: in included file:./src/shared/ascs.h:88:25: warning: array of flexible structures
##############################
Test: TestFunctional - FAIL
Desc: Run test-functional
Output:
FAIL functional.test_bap::test_bass_past_transport_acquire[hosts6-vm2]: pytest_bluezenv.rpc.RemoteError: <pexpect.popen_spawn.PopenSpawn object at 0x7f01af24ea50>
    searcher: searcher_re:
        0: re.compile(b'Acquire successful: fd \\d+ MTU \\d+:\\d+')
        1: re.compile(b'Transport /org/bluez/hci0/dev_00_AA_01_00_00_42/bis1/fd0 State: active')
    <pexpect.popen_spawn.PopenSpawn object at 0x7f01af24ea50>
    searcher: searcher_re:
        0: re.compile(b'Acquire successful: fd \\d+ MTU \\d+:\\d+')
        1: re.compile(b'Transport /org/bluez/hci0/dev_00_AA_01_00_00_42/bis1/fd0 State: active')
    Remote traceback:
        Traceback (most recent call last):
          File "/usr/local/lib/python3.14/dist-packages/pytest_bluezenv/../pytest_bluezenv/rpc.py", line 102, in server_stream
            result = method(*msg["a"], **msg["kw"])
          File "/usr/local/lib/python3.14/dist-packages/pytest_bluezenv/../pytest_bluezenv/env.py", line 256, in call_plugin
            return getattr(self.plugins[name], method)(*a, **kw)
                   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^
          File "/usr/local/lib/python3.14/dist-packages/pytest_bluezenv/../pytest_bluezenv/host_plugins.py", line 441, in expect
            ret = ctl.expect(*a, **kw)
          File "/usr/lib/python3/dist-packages/pexpect/spawnbase.py", line 354, in expect
            return self.expect_list(compiled_pattern_list,
                   ~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^
                    timeout, searchwindowsize, async_)
                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
          File "/usr/lib/python3/dist-packages/pexpect/spawnbase.py", line 383, in expect_list
            return exp.expect_loop(timeout)
                   ~~~~~~~~~~~~~~~^^^^^^^^^
          File "/usr/lib/python3/dist-packages/pexpect/expect.py", line 181, in expect_loop
            return self.timeout(e)
                   ~~~~~~~~~~~~^^^
          File "/usr/lib/python3/dist-packages/pexpect/expect.py", line 144, in timeout
            raise exc
        pexpect.exceptions.TIMEOUT: <pexpect.popen_spawn.PopenSpawn object at 0x7f01af24ea50>
        searcher: searcher_re:
            0: re.compile(b'Acquire successful: fd \\d+ MTU \\d+:\\d+')
            1: re.compile(b'Transport /org/bluez/hci0/dev_00_AA_01_00_00_42/bis1/fd0 State: active')
        <pexpect.popen_spawn.PopenSpawn object at 0x7f01af24ea50>
        searcher: searcher_re:
            0: re.compile(b'Acquire successful: fd \\d+ MTU \\d+:\\d+')
            1: re.compile(b'Transport /org/bluez/hci0/dev_00_AA_01_00_00_42/bis1/fd0 State: active')


https://github.com/bluez/bluez/pull/2539

---
Regards,
Linux Bluetooth

Re: [PATCH BlueZ 1/2] shared/bap: Skip local metadata Config callbacks

[Luiz Augusto von Dentz]

Hi Derek,

On Wed, Sep 16, 2026 at 6:33 AM dt <derektern@proton.me> wrote:
>
> From: Derek Tern <1263187-dt@users.noreply.gitlab.freedesktop.org>
>
> When reconfiguring a client stream that is already Codec Configured,
> setup_config() queues Codec Configuration and then caches metadata.
> stream_metadata() emits a same-state CONFIG notification for that local
> update. The profile callback treats it as the peer's configuration
> completion and clears config_pending before the peer has responded.
>
> If the control point response precedes the ASE state notification, QoS
> setup can run while need_reconfig is still set and fail locally.

Do you have a btmon trace that captures this scenario?

> Cache client metadata in CONFIG without emitting a state notification.
> Keep genuine peer CONFIG notifications and server metadata handling
> unchanged.
> ---
>  src/shared/bap.c | 5 +++++
>  1 file changed, 5 insertions(+)
>
> diff --git a/src/shared/bap.c b/src/shared/bap.c
> index 891a2f4fd..44cfd1ab4 100644
> --- a/src/shared/bap.c
> +++ b/src/shared/bap.c
> @@ -2278,6 +2278,11 @@ static uint8_t stream_metadata(struct bt_bap_stream *stream, struct iovec *meta,
>         util_iov_free(stream->meta, 1);
>         stream->meta = util_iov_dup(meta, 1);
>
> +       /* Local client metadata does not confirm the peer codec config. */
> +       if (stream->client &&
> +               bt_bap_stream_get_state(stream) == BT_BAP_STREAM_STATE_CONFIG)
> +               return 0;
> +
>         switch (bt_bap_stream_get_state(stream)) {
>         case BT_BAP_STREAM_STATE_IDLE:
>                 /* Initial metadata */
> --
> 2.55.0
>
>
>


-- 
Luiz Augusto von Dentz

Re: [PATCH BlueZ 1/2] shared/bap: Skip local metadata Config callbacks

[Luiz Augusto von Dentz]

Hi,

On Wed, Sep 16, 2026 at 6:33 AM dt <derektern@proton.me> wrote:
>
> From: Derek Tern <1263187-dt@users.noreply.gitlab.freedesktop.org>
>
> When reconfiguring a client stream that is already Codec Configured,
> setup_config() queues Codec Configuration and then caches metadata.
> stream_metadata() emits a same-state CONFIG notification for that local
> update. The profile callback treats it as the peer's configuration
> completion and clears config_pending before the peer has responded.
>
> If the control point response precedes the ASE state notification, QoS
> setup can run while need_reconfig is still set and fail locally.
>
> Cache client metadata in CONFIG without emitting a state notification.
> Keep genuine peer CONFIG notifications and server metadata handling
> unchanged.
> ---
>  src/shared/bap.c | 5 +++++
>  1 file changed, 5 insertions(+)
>
> diff --git a/src/shared/bap.c b/src/shared/bap.c
> index 891a2f4fd..44cfd1ab4 100644
> --- a/src/shared/bap.c
> +++ b/src/shared/bap.c
> @@ -2278,6 +2278,11 @@ static uint8_t stream_metadata(struct bt_bap_stream *stream, struct iovec *meta,
>         util_iov_free(stream->meta, 1);
>         stream->meta = util_iov_dup(meta, 1);
>
> +       /* Local client metadata does not confirm the peer codec config. */
> +       if (stream->client &&
> +               bt_bap_stream_get_state(stream) == BT_BAP_STREAM_STATE_CONFIG)
> +               return 0;

I'm not sure why this is not handled in the switch statement below.

>         switch (bt_bap_stream_get_state(stream)) {
>         case BT_BAP_STREAM_STATE_IDLE:
>                 /* Initial metadata */

Also after this there is:

default:
/* Force state change to the same state to update metadata */
stream_set_state(stream, bt_bap_stream_get_state(stream));

So according to your findings the above doesn't apply to
BT_BAP_STREAM_STATE_CONFIG? Afaik this is done so that
profiles/audio/transport.c:bap_state_changed to update the Metadata
property, but only takes effect on enabling and streaming, so it
probably fine to skip during config, or perhaps we limit to
BT_BAP_STREAM_STATE_ENABLING/BT_BAP_STREAM_STATE_STREAMING which is
where the metadata does apply.

> --
> 2.55.0
>
>
>


-- 
Luiz Augusto von Dentz

Re: [PATCH BlueZ 1/2] shared/bap: Skip local metadata Config callbacks

[dt]

[-- Attachment #1: Type: text/plain, Size: 782 bytes --]

V2 moves the client CONFIG exception into the existing switch. I kept the change limited to client CONFIG; ENABLING/STREAMING notifications and server handling are unchanged.

Attached is a control-only excerpt from the BlueZ 5.87 capture, plus an offline decode with the two local QoS errors. They occur before fresh playback CONFIG status. The PCAP retains 13 original ATT packets; timestamps and link identifiers are normalized, and audio/address/key traffic is excluded. It is an excerpt, not a complete capture.

Both new regression tests fail without the fix. With it, 699 BAP tests and all 35 make-check programs pass.

The CI BASS/PAST timeout also occurred on the earlier documentation-only PR 2532:
https://github.com/bluez/bluez/pull/2532#issuecomment-5688971480

[-- Attachment #2: ascs-control-only.pcap --]
[-- Type: application/vnd.tcpdump.pcap, Size: 839 bytes --]

[-- Attachment #3: ascs-control-excerpt.txt --]
[-- Type: text/plain, Size: 1853 bytes --]

BlueZ 5.87, BAP sink -> duplex transition
Offline decoded ASCS capture + local BlueZ journal; this is not btmon text.
TX = host to peer; RX = peer to host. ASEs 1/2 = playback (remote Sink),
ASEs 5/6 = capture (remote Source). Times in milliseconds relative to the
successful new Codec control-point response for ASEs 5,6,1,2.

  -476.569 ms  TX  Release request, ASEs 1,2
  -196.003 ms  RX  Release response, ASEs 1,2: success (code 0, reason 0)
  -146.999 ms  RX  ASE 1: Releasing
  -146.998 ms  RX  ASE 2: Releasing
  -146.998 ms  RX  ASE 1: CodecConfigured; LC3 48 kHz, 155 octets, 10 ms
  -145.003 ms  RX  ASE 2: CodecConfigured; LC3 48 kHz, 155 octets, 10 ms
  -124.148 ms  TX  Codec request, ASEs 5,6,1,2; ASEs 5/6: LC3 16 kHz, 40 octets; ASEs 1/2: LC3 48 kHz, 155 octets; 10 ms frames
    +0.000 ms  RX  Codec response, ASEs 5,6,1,2: success (code 0, reason 0)
    +0.003 ms  RX  ASE 5: CodecConfigured; LC3 16 kHz, 40 octets, 10 ms
    +0.003 ms  RX  ASE 6: CodecConfigured; LC3 16 kHz, 40 octets, 10 ms
    +0.182 ms  LOG profiles/audio/bap.c:setup_qos() Failed to Configure QoS
    +0.220 ms  LOG profiles/audio/bap.c:setup_qos() Failed to Configure QoS
    +2.004 ms  RX  ASE 1: CodecConfigured; LC3 48 kHz, 155 octets, 10 ms
    +2.008 ms  RX  ASE 2: CodecConfigured; LC3 48 kHz, 155 octets, 10 ms
   +10.318 ms  TX  Release request, ASEs 1,2

The two local QoS failures precede fresh playback CodecConfigured status.
Later QoS requests succeeded and all four ASEs eventually reached Streaming.
The excerpt establishes ordering, not the internal flag transitions.
Capture times are final-ACL-fragment host timestamps; LOG times are journal
userspace timestamps. ATT handles were identified from verified cached GATT
metadata; discovery was not present in this capture. No addresses, names,
absolute timestamps, keys, or audio are included.

[-- Attachment #4: ascs-control-only-readme.txt --]
[-- Type: text/plain, Size: 982 bytes --]

Sanitized ASCS-only PCAP, 13 original fixed-ATT PDUs, 839 bytes.
Linux Bluetooth monitor link type 254. Original ASCS ATT bytes are unchanged;
only capture timestamps and the local ACL identifier are normalized.

PCAP time zero is the initial Release request. The successful four-ASE Codec
response is at +0.476569 seconds (zero in ascs-control-excerpt.txt).
Adapter index is 0; ACL handle is normalized to 1. ATT value handles:
0x008a/0x008d: playback Sink ASEs 1/2
0x0096/0x0099: capture Source ASEs 5/6
0x009c: ASCS control point

Only Codec/Release control-point requests/responses and CodecConfigured/
Releasing ASE notifications are retained. One intervening QoSConfigured
notification is omitted. The two local QoS failures are journal entries in
the text excerpt, not packets. No HCI events, addresses, names, absolute
capture times, keys, vendor data, ISO/SCO audio, or other ATT attributes are
included. Identification uses cached GATT metadata, not in-capture discovery.

[PATCH BlueZ v2 1/2] shared/bap: Skip local metadata Config callbacks

[dt]

From: Derek Tern <1263187-dt@users.noreply.gitlab.freedesktop.org>

When reconfiguring a client stream that is already Codec Configured,
setup_config() queues Codec Configuration and then caches metadata.
stream_metadata() emits a same-state CONFIG notification for that local
update. The profile callback treats it as the peer's configuration
completion and clears config_pending before the peer has responded.

If the control point response precedes the ASE state notification, QoS
setup can run while need_reconfig is still set and fail locally.

Cache client metadata in CONFIG without emitting a state notification.
Keep genuine peer CONFIG notifications and server metadata handling
unchanged.
---
v2: Handle client CONFIG in the existing switch. Other states unchanged.
Rebased on f87a79667. The second patch contains the unchanged regressions.

 src/shared/bap.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/shared/bap.c b/src/shared/bap.c
index 891a2f4fd..6d351d010 100644
--- a/src/shared/bap.c
+++ b/src/shared/bap.c
@@ -2282,6 +2282,11 @@ static uint8_t stream_metadata(struct bt_bap_stream *stream, struct iovec *meta,
 	case BT_BAP_STREAM_STATE_IDLE:
 		/* Initial metadata */
 		break;
+	case BT_BAP_STREAM_STATE_CONFIG:
+		/* Local client metadata does not confirm the peer config. */
+		if (stream->client)
+			break;
+		/* Fallthrough */
 	default:
 		/* Force state change to the same state to update metadata */
 		stream_set_state(stream, bt_bap_stream_get_state(stream));
-- 
2.55.0

[PATCH BlueZ v2 2/2] unit: Test metadata during BAP client reconfig

[dt]

From: Derek Tern <1263187-dt@users.noreply.gitlab.freedesktop.org>

Add client tests for both remote Sink and Source ASEs. Reuse an actual
configured stream, start a second Codec Configuration, and cache local
metadata before the peer responds.

Check metadata retention and absence of an extra local CONFIG callback.
Require QoS to remain blocked after reuse and after the successful
control point response. Only the fresh peer CONFIG notification may
make the stream ready for a nonzero QoS request and the subsequent
exchange.

Without the shared/bap fix, the premature local CONFIG callback attempts
QoS before the stream is ready and both tests fail at that assertion.
---
 unit/test-bap.c | 134 ++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 134 insertions(+)

diff --git a/unit/test-bap.c b/unit/test-bap.c
index 4e89ba6af..5fcf0262d 100644
--- a/unit/test-bap.c
+++ b/unit/test-bap.c
@@ -82,6 +82,11 @@ struct test_data {
 	size_t iovcnt;
 	struct iovec *iov;
 	int fds[8][2];
+	unsigned int metadata_config_count;
+	struct bt_bap_stream *metadata_stream;
+	bool metadata_reused;
+	bool metadata_config_replied;
+	unsigned int metadata_qos_id;
 };
 
 struct notify {
@@ -4215,6 +4220,129 @@ static void test_scc_release(void)
 	test_usr_scc_release();
 }
 
+static bool metadata_reuse_pac(struct bt_bap_pac *lpac,
+				struct bt_bap_pac *rpac, void *user_data)
+{
+	struct test_data *data = user_data;
+	struct bt_bap_stream *stream;
+
+	stream = bt_bap_stream_new(data->bap, lpac, rpac, &data->cfg->qos,
+							&data->cfg->cc);
+	g_assert(stream == data->metadata_stream);
+	data->metadata_reused = true;
+
+	return false;
+}
+
+static void metadata_config_response(struct bt_bap_stream *stream,
+					uint8_t code, uint8_t reason,
+					void *user_data)
+{
+	struct test_data *data = user_data;
+	unsigned int id;
+
+	g_assert_cmpuint(code, ==, 0);
+	g_assert_cmpuint(reason, ==, 0);
+	g_assert_cmpuint(data->metadata_config_count, ==, 1);
+
+	/* A successful CP response has not confirmed the new ASE status. */
+	id = bt_bap_stream_qos(stream, &data->cfg->qos, bap_qos, data);
+	g_assert_cmpuint(id, ==, 0);
+	data->metadata_config_replied = true;
+}
+
+/* Local metadata must not replace the peer's Codec Configured notification. */
+static void state_cc_metadata(struct bt_bap_stream *stream,
+					uint8_t old_state, uint8_t new_state,
+					void *user_data)
+{
+	struct test_data *data = user_data;
+	uint8_t value[] = { 0x03, 0x02, 0x02, 0x00 };
+	struct iovec metadata = {
+		.iov_base = value,
+		.iov_len = sizeof(value),
+	};
+	struct iovec *cached;
+	unsigned int id;
+
+	if (new_state == BT_BAP_STREAM_STATE_QOS) {
+		g_assert_cmpuint(data->metadata_config_count, ==, 2);
+		g_assert(data->metadata_config_replied);
+		g_assert(data->metadata_qos_id);
+		id = bt_bap_stream_release(stream, bap_release, data);
+		g_assert(id);
+		return;
+	}
+
+	if (new_state != BT_BAP_STREAM_STATE_CONFIG)
+		return;
+
+	data->metadata_config_count++;
+
+	if (data->metadata_config_count == 2) {
+		/* The peer notification makes the reused stream QoS-ready. */
+		g_assert_cmpuint(old_state, ==, BT_BAP_STREAM_STATE_CONFIG);
+		id = bt_bap_stream_qos(stream, &data->cfg->qos, bap_qos, data);
+		g_assert(id);
+		g_assert(data->metadata_config_replied);
+		data->metadata_qos_id = id;
+		return;
+	}
+
+	g_assert_cmpuint(data->metadata_config_count, ==, 1);
+
+	/* Reuse the actual configured ASE, setting internal need_reconfig. */
+	data->metadata_stream = stream;
+	bt_bap_foreach_pac(data->bap, bt_bap_stream_get_dir(stream),
+						metadata_reuse_pac, data);
+	g_assert(data->metadata_reused);
+	id = bt_bap_stream_qos(stream, &data->cfg->qos, bap_qos, data);
+	g_assert_cmpuint(id, ==, 0);
+
+	id = bt_bap_stream_config(stream, &data->cfg->qos, &data->cfg->cc,
+						metadata_config_response, data);
+	g_assert(id);
+
+	id = bt_bap_stream_metadata(stream, &metadata, NULL, NULL);
+	g_assert_cmpuint(id, ==, 0);
+	g_assert_cmpuint(data->metadata_config_count, ==, 1);
+
+	cached = bt_bap_stream_get_metadata(stream);
+	g_assert(cached);
+	g_assert_cmpuint(cached->iov_len, ==, metadata.iov_len);
+	g_assert(!memcmp(cached->iov_base, value, sizeof(value)));
+}
+
+static struct test_config cfg_snk_cc_metadata = {
+	.cc = LC3_CONFIG_16_2,
+	.qos = LC3_QOS_16_2_1,
+	.snk = true,
+	.state_func = state_cc_metadata,
+};
+
+static struct test_config cfg_src_cc_metadata = {
+	.cc = LC3_CONFIG_16_2,
+	.qos = LC3_QOS_16_2_1,
+	.src = true,
+	.state_func = state_cc_metadata,
+};
+
+#define SCC_SNK_CC_METADATA \
+	SCC_SNK_16_2, \
+	SCC_SNK(LC3_CODEC_ID_DATA, 0x0a, 0x02, 0x01, 0x03, 0x02, 0x02, \
+			0x01, 0x03, 0x04, 0x28, 0x00), \
+	QOS_SNK(0x10, 0x27, 0x00, 0x00, 0x02, 0x28, 0x00, 0x02, 0x0a, 0x00, \
+		0x40, 0x9c, 0x00), \
+	ASE_SNK_RELEASE
+
+#define SCC_SRC_CC_METADATA \
+	SCC_SRC_16_2, \
+	SCC_SRC(LC3_CODEC_ID_DATA, 0x0a, 0x02, 0x01, 0x03, 0x02, 0x02, \
+			0x01, 0x03, 0x04, 0x28, 0x00), \
+	QOS_SRC(0x10, 0x27, 0x00, 0x00, 0x02, 0x28, 0x00, 0x02, 0x0a, 0x00, \
+		0x40, 0x9c, 0x00), \
+	ASE_SRC_RELEASE
+
 static void bap_metadata(struct bt_bap_stream *stream,
 					uint8_t code, uint8_t reason,
 					void *user_data)
@@ -4341,6 +4469,12 @@ static struct test_config cfg_src_metadata_streaming = {
  */
 static void test_ucl_scc_metadata(void)
 {
+	define_test("BAP/UCL/SCC/Metadata-Configured-Sink",
+			test_setup, test_client, &cfg_snk_cc_metadata,
+			SCC_SNK_CC_METADATA);
+	define_test("BAP/UCL/SCC/Metadata-Configured-Source",
+			test_setup, test_client, &cfg_src_cc_metadata,
+			SCC_SRC_CC_METADATA);
 	define_test("BAP/UCL/SCC/BV-115-C [UCL SNK Update Metadata in Enabling "
 			"State]",
 			test_setup, test_client, &cfg_src_metadata,
-- 
2.55.0

RE: Avoid local metadata Config notifications

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 681 bytes --]

This is an automated email and please do not reply to this email.

Dear Submitter,

This series was picked up by the CI more than 2 weeks ago and the pull
request created for it is still open, which means the series was never
applied to the tree.

   Series:       Avoid local metadata Config notifications
   Pull Request: https://github.com/bluez/bluez/pull/2539
   Created:      2026-09-16 14:22:09+00:00

The pull request has been closed and no further action is taken on this
series.

If the change should still be considered, it must be resent to the Linux
Bluetooth mailing list (linux-bluetooth@vger.kernel.org) so that it is
picked up again.

---
Regards,
Linux Bluetooth

[PATCH BlueZ 2/2] unit: Test metadata during BAP client reconfig

[dt]

From: Derek Tern <1263187-dt@users.noreply.gitlab.freedesktop.org>

Add client tests for both remote Sink and Source ASEs. Reuse an actual
configured stream, start a second Codec Configuration, and cache local
metadata before the peer responds.

Check metadata retention and absence of an extra local CONFIG callback.
Require QoS to remain blocked after reuse and after the successful
control point response. Only the fresh peer CONFIG notification may
make the stream ready for a nonzero QoS request and the subsequent
exchange.

Without the shared/bap fix, the premature local CONFIG callback attempts
QoS before the stream is ready and both tests fail at that assertion.
---
 unit/test-bap.c | 134 ++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 134 insertions(+)

diff --git a/unit/test-bap.c b/unit/test-bap.c
index 4e89ba6af..5fcf0262d 100644
--- a/unit/test-bap.c
+++ b/unit/test-bap.c
@@ -82,6 +82,11 @@ struct test_data {
 	size_t iovcnt;
 	struct iovec *iov;
 	int fds[8][2];
+	unsigned int metadata_config_count;
+	struct bt_bap_stream *metadata_stream;
+	bool metadata_reused;
+	bool metadata_config_replied;
+	unsigned int metadata_qos_id;
 };
 
 struct notify {
@@ -4215,6 +4220,129 @@ static void test_scc_release(void)
 	test_usr_scc_release();
 }
 
+static bool metadata_reuse_pac(struct bt_bap_pac *lpac,
+				struct bt_bap_pac *rpac, void *user_data)
+{
+	struct test_data *data = user_data;
+	struct bt_bap_stream *stream;
+
+	stream = bt_bap_stream_new(data->bap, lpac, rpac, &data->cfg->qos,
+							&data->cfg->cc);
+	g_assert(stream == data->metadata_stream);
+	data->metadata_reused = true;
+
+	return false;
+}
+
+static void metadata_config_response(struct bt_bap_stream *stream,
+					uint8_t code, uint8_t reason,
+					void *user_data)
+{
+	struct test_data *data = user_data;
+	unsigned int id;
+
+	g_assert_cmpuint(code, ==, 0);
+	g_assert_cmpuint(reason, ==, 0);
+	g_assert_cmpuint(data->metadata_config_count, ==, 1);
+
+	/* A successful CP response has not confirmed the new ASE status. */
+	id = bt_bap_stream_qos(stream, &data->cfg->qos, bap_qos, data);
+	g_assert_cmpuint(id, ==, 0);
+	data->metadata_config_replied = true;
+}
+
+/* Local metadata must not replace the peer's Codec Configured notification. */
+static void state_cc_metadata(struct bt_bap_stream *stream,
+					uint8_t old_state, uint8_t new_state,
+					void *user_data)
+{
+	struct test_data *data = user_data;
+	uint8_t value[] = { 0x03, 0x02, 0x02, 0x00 };
+	struct iovec metadata = {
+		.iov_base = value,
+		.iov_len = sizeof(value),
+	};
+	struct iovec *cached;
+	unsigned int id;
+
+	if (new_state == BT_BAP_STREAM_STATE_QOS) {
+		g_assert_cmpuint(data->metadata_config_count, ==, 2);
+		g_assert(data->metadata_config_replied);
+		g_assert(data->metadata_qos_id);
+		id = bt_bap_stream_release(stream, bap_release, data);
+		g_assert(id);
+		return;
+	}
+
+	if (new_state != BT_BAP_STREAM_STATE_CONFIG)
+		return;
+
+	data->metadata_config_count++;
+
+	if (data->metadata_config_count == 2) {
+		/* The peer notification makes the reused stream QoS-ready. */
+		g_assert_cmpuint(old_state, ==, BT_BAP_STREAM_STATE_CONFIG);
+		id = bt_bap_stream_qos(stream, &data->cfg->qos, bap_qos, data);
+		g_assert(id);
+		g_assert(data->metadata_config_replied);
+		data->metadata_qos_id = id;
+		return;
+	}
+
+	g_assert_cmpuint(data->metadata_config_count, ==, 1);
+
+	/* Reuse the actual configured ASE, setting internal need_reconfig. */
+	data->metadata_stream = stream;
+	bt_bap_foreach_pac(data->bap, bt_bap_stream_get_dir(stream),
+						metadata_reuse_pac, data);
+	g_assert(data->metadata_reused);
+	id = bt_bap_stream_qos(stream, &data->cfg->qos, bap_qos, data);
+	g_assert_cmpuint(id, ==, 0);
+
+	id = bt_bap_stream_config(stream, &data->cfg->qos, &data->cfg->cc,
+						metadata_config_response, data);
+	g_assert(id);
+
+	id = bt_bap_stream_metadata(stream, &metadata, NULL, NULL);
+	g_assert_cmpuint(id, ==, 0);
+	g_assert_cmpuint(data->metadata_config_count, ==, 1);
+
+	cached = bt_bap_stream_get_metadata(stream);
+	g_assert(cached);
+	g_assert_cmpuint(cached->iov_len, ==, metadata.iov_len);
+	g_assert(!memcmp(cached->iov_base, value, sizeof(value)));
+}
+
+static struct test_config cfg_snk_cc_metadata = {
+	.cc = LC3_CONFIG_16_2,
+	.qos = LC3_QOS_16_2_1,
+	.snk = true,
+	.state_func = state_cc_metadata,
+};
+
+static struct test_config cfg_src_cc_metadata = {
+	.cc = LC3_CONFIG_16_2,
+	.qos = LC3_QOS_16_2_1,
+	.src = true,
+	.state_func = state_cc_metadata,
+};
+
+#define SCC_SNK_CC_METADATA \
+	SCC_SNK_16_2, \
+	SCC_SNK(LC3_CODEC_ID_DATA, 0x0a, 0x02, 0x01, 0x03, 0x02, 0x02, \
+			0x01, 0x03, 0x04, 0x28, 0x00), \
+	QOS_SNK(0x10, 0x27, 0x00, 0x00, 0x02, 0x28, 0x00, 0x02, 0x0a, 0x00, \
+		0x40, 0x9c, 0x00), \
+	ASE_SNK_RELEASE
+
+#define SCC_SRC_CC_METADATA \
+	SCC_SRC_16_2, \
+	SCC_SRC(LC3_CODEC_ID_DATA, 0x0a, 0x02, 0x01, 0x03, 0x02, 0x02, \
+			0x01, 0x03, 0x04, 0x28, 0x00), \
+	QOS_SRC(0x10, 0x27, 0x00, 0x00, 0x02, 0x28, 0x00, 0x02, 0x0a, 0x00, \
+		0x40, 0x9c, 0x00), \
+	ASE_SRC_RELEASE
+
 static void bap_metadata(struct bt_bap_stream *stream,
 					uint8_t code, uint8_t reason,
 					void *user_data)
@@ -4341,6 +4469,12 @@ static struct test_config cfg_src_metadata_streaming = {
  */
 static void test_ucl_scc_metadata(void)
 {
+	define_test("BAP/UCL/SCC/Metadata-Configured-Sink",
+			test_setup, test_client, &cfg_snk_cc_metadata,
+			SCC_SNK_CC_METADATA);
+	define_test("BAP/UCL/SCC/Metadata-Configured-Source",
+			test_setup, test_client, &cfg_src_cc_metadata,
+			SCC_SRC_CC_METADATA);
 	define_test("BAP/UCL/SCC/BV-115-C [UCL SNK Update Metadata in Enabling "
 			"State]",
 			test_setup, test_client, &cfg_src_metadata,
-- 
2.55.0

Re: [PATCH BlueZ 2/2] unit: Test metadata during BAP client reconfig

[Luiz Augusto von Dentz]

Hi,

On Wed, Sep 16, 2026 at 7:14 AM dt <derektern@proton.me> wrote:
>
> From: Derek Tern <1263187-dt@users.noreply.gitlab.freedesktop.org>
>
> Add client tests for both remote Sink and Source ASEs. Reuse an actual
> configured stream, start a second Codec Configuration, and cache local
> metadata before the peer responds.
>
> Check metadata retention and absence of an extra local CONFIG callback.
> Require QoS to remain blocked after reuse and after the successful
> control point response. Only the fresh peer CONFIG notification may
> make the stream ready for a nonzero QoS request and the subsequent
> exchange.
>
> Without the shared/bap fix, the premature local CONFIG callback attempts
> QoS before the stream is ready and both tests fail at that assertion.
> ---
>  unit/test-bap.c | 134 ++++++++++++++++++++++++++++++++++++++++++++++++
>  1 file changed, 134 insertions(+)
>
> diff --git a/unit/test-bap.c b/unit/test-bap.c
> index 4e89ba6af..5fcf0262d 100644
> --- a/unit/test-bap.c
> +++ b/unit/test-bap.c
> @@ -82,6 +82,11 @@ struct test_data {
>         size_t iovcnt;
>         struct iovec *iov;
>         int fds[8][2];
> +       unsigned int metadata_config_count;
> +       struct bt_bap_stream *metadata_stream;
> +       bool metadata_reused;
> +       bool metadata_config_replied;
> +       unsigned int metadata_qos_id;
>  };
>
>  struct notify {
> @@ -4215,6 +4220,129 @@ static void test_scc_release(void)
>         test_usr_scc_release();
>  }
>
> +static bool metadata_reuse_pac(struct bt_bap_pac *lpac,
> +                               struct bt_bap_pac *rpac, void *user_data)
> +{
> +       struct test_data *data = user_data;
> +       struct bt_bap_stream *stream;
> +
> +       stream = bt_bap_stream_new(data->bap, lpac, rpac, &data->cfg->qos,
> +                                                       &data->cfg->cc);
> +       g_assert(stream == data->metadata_stream);
> +       data->metadata_reused = true;
> +
> +       return false;
> +}
> +
> +static void metadata_config_response(struct bt_bap_stream *stream,
> +                                       uint8_t code, uint8_t reason,
> +                                       void *user_data)
> +{
> +       struct test_data *data = user_data;
> +       unsigned int id;
> +
> +       g_assert_cmpuint(code, ==, 0);
> +       g_assert_cmpuint(reason, ==, 0);
> +       g_assert_cmpuint(data->metadata_config_count, ==, 1);
> +
> +       /* A successful CP response has not confirmed the new ASE status. */
> +       id = bt_bap_stream_qos(stream, &data->cfg->qos, bap_qos, data);
> +       g_assert_cmpuint(id, ==, 0);
> +       data->metadata_config_replied = true;
> +}
> +
> +/* Local metadata must not replace the peer's Codec Configured notification. */
> +static void state_cc_metadata(struct bt_bap_stream *stream,
> +                                       uint8_t old_state, uint8_t new_state,
> +                                       void *user_data)
> +{
> +       struct test_data *data = user_data;
> +       uint8_t value[] = { 0x03, 0x02, 0x02, 0x00 };
> +       struct iovec metadata = {
> +               .iov_base = value,
> +               .iov_len = sizeof(value),
> +       };
> +       struct iovec *cached;
> +       unsigned int id;
> +
> +       if (new_state == BT_BAP_STREAM_STATE_QOS) {
> +               g_assert_cmpuint(data->metadata_config_count, ==, 2);
> +               g_assert(data->metadata_config_replied);
> +               g_assert(data->metadata_qos_id);
> +               id = bt_bap_stream_release(stream, bap_release, data);
> +               g_assert(id);
> +               return;
> +       }
> +
> +       if (new_state != BT_BAP_STREAM_STATE_CONFIG)
> +               return;
> +
> +       data->metadata_config_count++;
> +
> +       if (data->metadata_config_count == 2) {
> +               /* The peer notification makes the reused stream QoS-ready. */
> +               g_assert_cmpuint(old_state, ==, BT_BAP_STREAM_STATE_CONFIG);
> +               id = bt_bap_stream_qos(stream, &data->cfg->qos, bap_qos, data);
> +               g_assert(id);
> +               g_assert(data->metadata_config_replied);
> +               data->metadata_qos_id = id;
> +               return;
> +       }
> +
> +       g_assert_cmpuint(data->metadata_config_count, ==, 1);
> +
> +       /* Reuse the actual configured ASE, setting internal need_reconfig. */
> +       data->metadata_stream = stream;
> +       bt_bap_foreach_pac(data->bap, bt_bap_stream_get_dir(stream),
> +                                               metadata_reuse_pac, data);
> +       g_assert(data->metadata_reused);
> +       id = bt_bap_stream_qos(stream, &data->cfg->qos, bap_qos, data);
> +       g_assert_cmpuint(id, ==, 0);
> +
> +       id = bt_bap_stream_config(stream, &data->cfg->qos, &data->cfg->cc,
> +                                               metadata_config_response, data);
> +       g_assert(id);
> +
> +       id = bt_bap_stream_metadata(stream, &metadata, NULL, NULL);
> +       g_assert_cmpuint(id, ==, 0);
> +       g_assert_cmpuint(data->metadata_config_count, ==, 1);
> +
> +       cached = bt_bap_stream_get_metadata(stream);
> +       g_assert(cached);
> +       g_assert_cmpuint(cached->iov_len, ==, metadata.iov_len);
> +       g_assert(!memcmp(cached->iov_base, value, sizeof(value)));
> +}
> +
> +static struct test_config cfg_snk_cc_metadata = {
> +       .cc = LC3_CONFIG_16_2,
> +       .qos = LC3_QOS_16_2_1,
> +       .snk = true,
> +       .state_func = state_cc_metadata,
> +};
> +
> +static struct test_config cfg_src_cc_metadata = {
> +       .cc = LC3_CONFIG_16_2,
> +       .qos = LC3_QOS_16_2_1,
> +       .src = true,
> +       .state_func = state_cc_metadata,
> +};
> +
> +#define SCC_SNK_CC_METADATA \
> +       SCC_SNK_16_2, \
> +       SCC_SNK(LC3_CODEC_ID_DATA, 0x0a, 0x02, 0x01, 0x03, 0x02, 0x02, \
> +                       0x01, 0x03, 0x04, 0x28, 0x00), \
> +       QOS_SNK(0x10, 0x27, 0x00, 0x00, 0x02, 0x28, 0x00, 0x02, 0x0a, 0x00, \
> +               0x40, 0x9c, 0x00), \
> +       ASE_SNK_RELEASE
> +
> +#define SCC_SRC_CC_METADATA \
> +       SCC_SRC_16_2, \
> +       SCC_SRC(LC3_CODEC_ID_DATA, 0x0a, 0x02, 0x01, 0x03, 0x02, 0x02, \
> +                       0x01, 0x03, 0x04, 0x28, 0x00), \
> +       QOS_SRC(0x10, 0x27, 0x00, 0x00, 0x02, 0x28, 0x00, 0x02, 0x0a, 0x00, \
> +               0x40, 0x9c, 0x00), \
> +       ASE_SRC_RELEASE
> +
>  static void bap_metadata(struct bt_bap_stream *stream,
>                                         uint8_t code, uint8_t reason,
>                                         void *user_data)
> @@ -4341,6 +4469,12 @@ static struct test_config cfg_src_metadata_streaming = {
>   */
>  static void test_ucl_scc_metadata(void)
>  {
> +       define_test("BAP/UCL/SCC/Metadata-Configured-Sink",
> +                       test_setup, test_client, &cfg_snk_cc_metadata,
> +                       SCC_SNK_CC_METADATA);
> +       define_test("BAP/UCL/SCC/Metadata-Configured-Source",
> +                       test_setup, test_client, &cfg_src_cc_metadata,
> +                       SCC_SRC_CC_METADATA);

While adding a test is a great initiative, these are not qualification
tests though, and afaik this is only mimicking the code at
profiles/audio/bap.c so I wonder if it wouldn't be a better idea to
just move this testing to test-functional and have `bluetoothctl`
issue endpoint.config to reconfigure the stream.

>         define_test("BAP/UCL/SCC/BV-115-C [UCL SNK Update Metadata in Enabling "
>                         "State]",
>                         test_setup, test_client, &cfg_src_metadata,
> --
> 2.55.0
>
>
>


-- 
Luiz Augusto von Dentz

[PATCH BlueZ v3 1/2] shared/bap: Skip local metadata Config callbacks

[dt]

From: Derek Tern <1263187-dt@users.noreply.gitlab.freedesktop.org>

When reconfiguring a client stream that is already Codec Configured,
setup_config() queues Codec Configuration and then caches metadata.
stream_metadata() emits a same-state CONFIG notification for that local
update. The profile callback treats it as the peer's configuration
completion and clears config_pending before the peer has responded.

If the control point response precedes the ASE state notification, QoS
setup can run while need_reconfig is still set and fail locally.

Cache client metadata in CONFIG without emitting a state notification.
Keep genuine peer CONFIG notifications and server metadata handling
unchanged.
---
v3: Replace the unit regression with a real-daemon functional test.
    The source fix is unchanged. Patched unicast tests pass; the
    unpatched metadata case fails in repeated negative controls.

 src/shared/bap.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/shared/bap.c b/src/shared/bap.c
index 891a2f4fd..6d351d010 100644
--- a/src/shared/bap.c
+++ b/src/shared/bap.c
@@ -2282,6 +2282,11 @@ static uint8_t stream_metadata(struct bt_bap_stream *stream, struct iovec *meta,
 	case BT_BAP_STREAM_STATE_IDLE:
 		/* Initial metadata */
 		break;
+	case BT_BAP_STREAM_STATE_CONFIG:
+		/* Local client metadata does not confirm the peer config. */
+		if (stream->client)
+			break;
+		/* Fallthrough */
 	default:
 		/* Force state change to the same state to update metadata */
 		stream_set_state(stream, bt_bap_stream_get_state(stream));
-- 
2.55.0

[PATCH BlueZ v3 2/2] test-functional: Cover BAP metadata reconfiguration

[dt]

From: Derek Tern <1263187-dt@users.noreply.gitlab.freedesktop.org>

Exercise the real daemon by clearing a configured unicast endpoint and
reconfiguring its retained ASE with empty or Media-context metadata.
Require successful configuration and check the resulting transport.

Use ATT MTU 48 to prevent the control-point response and fresh ASE
notification from being batched together. Without the shared/bap fix,
the Media case fails QoS setup; the empty-metadata control still passes.

Call SetConfiguration directly because endpoint.config does not pass
metadata for unicast presets. Remove the fixture's redundant config
command: SelectProperties already configures both ASEs after pairing.
---
 doc/functional-bap.rst      |  33 +++++++++---
 test/functional/test_bap.py | 103 ++++++++++++++++++++++++++++++++----
 2 files changed, 120 insertions(+), 16 deletions(-)

diff --git a/doc/functional-bap.rst b/doc/functional-bap.rst
index 3fc3439c1..effcc1c99 100644
--- a/doc/functional-bap.rst
+++ b/doc/functional-bap.rst
@@ -67,17 +67,14 @@ test_bap_unicast_transport_created
 	1. Start `bluetoothctl` with the scripts on both hosts.
 	2. Pair over LE: ``scan on`` on the initiator, ``advertise on`` on
 	   the acceptor, then ``pair``.
-	3. Initiator: ``endpoint.config <remote endpoint>
-	   /local/endpoint/ep0 16_2_1``, using the remote PAC Sink endpoint
-	   exposed once the services are resolved.
+	3. Wait for automatic stream configuration through the registered
+	   endpoint's ``SelectProperties`` method.
 	4. Initiator: ``transport.show <transport>`` for each transport.
 
 :Expected:
 	1. ``Endpoint /local/endpoint/ep0 registered`` on both hosts.
 	2. ``Pairing successful``.
-	3. The remote endpoint appears as
-	   ``Endpoint /org/bluez/hci0/dev_XX/pac_sinkN``, and configuring it
-	   creates one transport per location on *both* hosts.
+	3. One transport per location is created on *both* hosts.
 	4. Each transport of the initiator reports the local PAC Source
 	   UUID (``00002bcb-...``), ``Codec: 0x06`` for LC3, ``Device:``
 	   pointing at the acceptor device object, and ``State: idle``.
@@ -108,6 +105,30 @@ test_bap_unicast_transport_acquire
 	be established, as `bluetoothd` sets up the ISO listener on its own
 	when the stream is enabled.
 
+test_bap_unicast_reconfigure_metadata[empty|media]
+------------------------------------------------
+
+:Setup: As above, with the transports already created and ATT MTU 48.
+
+:Steps:
+	1. Call ``MediaEndpoint1.ClearConfiguration`` on the remote endpoint
+	   and wait for completion. The peer retains the codec configuration.
+	2. Call ``MediaEndpoint1.SetConfiguration`` with the previous codec
+	   configuration and QoS, and empty or Media streaming-context metadata.
+
+:Expected: Reconfiguration completes successfully after the fresh
+	Codec Configured notification. The same ASE is reused, and the new
+	transport retains the requested metadata.
+
+:Notes: MTU 48 fits each notification separately, but prevents the peer
+	from batching the Codec Configuration response and the fresh ASE
+	notification together. Nonempty metadata must not let the initiator
+	use the cached Configured state to start QoS prematurely.
+
+	Reconfiguration uses the D-Bus method directly because
+	``bluetoothctl endpoint.config`` does not pass metadata for unicast
+	presets.
+
 BROADCAST
 =========
 
diff --git a/test/functional/test_bap.py b/test/functional/test_bap.py
index ce11dc38d..917e24f27 100644
--- a/test/functional/test_bap.py
+++ b/test/functional/test_bap.py
@@ -5,12 +5,21 @@ Tests for BAP (LE Audio) using bluetoothctl in VM instances
 """
 
 import re
+import threading
 import warnings
 
+import dbus
 import pytest
 
-from pytest_bluezenv import Bluetoothd, Pexpect, find_exe, host_config
-from pytest_bluezenv.utils import bluez_src_dir
+from pytest_bluezenv import (
+    Bluetoothd,
+    Pexpect,
+    find_exe,
+    get_dbus,
+    host_config,
+    mainloop_wrap,
+)
+from pytest_bluezenv.utils import DEFAULT_TIMEOUT, bluez_src_dir
 
 pytestmark = [pytest.mark.vm]
 
@@ -24,8 +33,6 @@ KernelExperimental = true
 ControllerMode = le
 """
 
-PRESET = "16_2_1"
-
 TRANSPORT_RE = r"Transport (/org/bluez/\S+/fd\d+)"
 
 
@@ -214,12 +221,7 @@ def unicast_hosts(hosts):
 
     pair_le(host0, initiator, host1, acceptor)
 
-    # Remote PAC Sink endpoint is exposed once services are resolved
-    _, m = initiator.expect(r"Endpoint (/org/bluez/\S+/pac_sink\d+)")
-    remote = m[0].decode("utf-8")
-
-    initiator.send(f"endpoint.config {remote} /local/endpoint/ep0 {PRESET}\n")
-
+    # SelectProperties configures the streams automatically after pairing.
     yield host0, host1, initiator, acceptor
 
 
@@ -274,6 +276,87 @@ def test_bap_unicast_transport_acquire(unicast_hosts):
     )
 
 
+def reconfigure_transport(transport, metadata):
+    """Clear a configured stream and reuse its ASE with explicit metadata."""
+    done = threading.Event()
+    errors = []
+    remote = transport.rsplit("/", 1)[0]
+
+    def failed(error):
+        errors.append(error)
+        done.set()
+
+    @mainloop_wrap
+    def start():
+        bus = get_dbus()
+        props = dbus.Interface(
+            bus.get_object("org.bluez", transport),
+            "org.freedesktop.DBus.Properties",
+        ).GetAll("org.bluez.MediaTransport1")
+        endpoint = dbus.Interface(
+            bus.get_object("org.bluez", remote), "org.bluez.MediaEndpoint1"
+        )
+        qos = {k: v for k, v in props["QoS"].items() if k not in ("CIG", "CIS")}
+        qos["TargetLatency"] = dbus.Byte(2)
+        config = {
+            "Capabilities": props["Configuration"],
+            "QoS": dbus.Dictionary(qos, signature="sv"),
+            "Metadata": dbus.ByteArray(metadata),
+        }
+
+        def configure():
+            endpoint.SetConfiguration(
+                dbus.ObjectPath("/local/endpoint/ep0"),
+                dbus.Dictionary(config, signature="sv"),
+                reply_handler=done.set,
+                error_handler=failed,
+            )
+
+        # The reply waits for Release to return the peer ASE to CONFIG.
+        endpoint.ClearConfiguration(
+            dbus.ObjectPath(remote), reply_handler=configure, error_handler=failed
+        )
+
+    start()
+    assert done.wait(DEFAULT_TIMEOUT), "reconfiguration did not complete"
+    if errors:
+        raise errors[0]
+
+    @mainloop_wrap
+    def check_transport():
+        objects = dbus.Interface(
+            get_dbus().get_object("org.bluez", "/"),
+            "org.freedesktop.DBus.ObjectManager",
+        ).GetManagedObjects()
+        transports = [
+            interfaces["org.bluez.MediaTransport1"]
+            for path, interfaces in objects.items()
+            if path.startswith(remote + "/")
+            and "org.bluez.MediaTransport1" in interfaces
+        ]
+        assert len(transports) == 1
+        assert bytes(transports[0]["Metadata"]) == metadata
+
+    check_transport()
+
+
+# Fit each notification, but not both the Codec Configuration response and
+# Codec Configured state in one ATT Multiple Handle Value Notification.
+@host_config(
+    [Bluetoothd(conf=BAP_CONF + "\n[GATT]\nExchangeMTU = 48\n"), Pexpect()],
+    [Bluetoothd(conf=BAP_CONF), Pexpect()],
+)
+@pytest.mark.parametrize("metadata", [b"", b"\x03\x02\x04\x00"], ids=["empty", "media"])
+def test_bap_unicast_reconfigure_metadata(unicast_hosts, metadata):
+    host0, host1, initiator, acceptor = unicast_hosts
+    left, _ = expect_transports(initiator)
+    expect_transports(acceptor)
+
+    # endpoint.config currently omits Metadata for unicast presets. Exercise
+    # its D-Bus entry point directly, after bluetoothctl's initial setup.
+    host0.call(reconfigure_transport, left, metadata)
+
+
 # Broadcast code used by the broadcast scripts, see BCAST_CODE in
 # client/player.c
 BCAST_CODE = (
-- 
2.55.0

Re: [PATCH BlueZ v3 2/2] test-functional: Cover BAP metadata reconfiguration

[Luiz Augusto von Dentz]

Hi,

On Thu, Sep 17, 2026 at 11:30 AM dt <derektern@proton.me> wrote:
>
> From: Derek Tern <1263187-dt@users.noreply.gitlab.freedesktop.org>
>
> Exercise the real daemon by clearing a configured unicast endpoint and
> reconfiguring its retained ASE with empty or Media-context metadata.
> Require successful configuration and check the resulting transport.
>
> Use ATT MTU 48 to prevent the control-point response and fresh ASE
> notification from being batched together. Without the shared/bap fix,
> the Media case fails QoS setup; the empty-metadata control still passes.
>
> Call SetConfiguration directly because endpoint.config does not pass
> metadata for unicast presets. Remove the fixture's redundant config
> command: SelectProperties already configures both ASEs after pairing.
> ---
>  doc/functional-bap.rst      |  33 +++++++++---
>  test/functional/test_bap.py | 103 ++++++++++++++++++++++++++++++++----
>  2 files changed, 120 insertions(+), 16 deletions(-)
>
> diff --git a/doc/functional-bap.rst b/doc/functional-bap.rst
> index 3fc3439c1..effcc1c99 100644
> --- a/doc/functional-bap.rst
> +++ b/doc/functional-bap.rst
> @@ -67,17 +67,14 @@ test_bap_unicast_transport_created
>         1. Start `bluetoothctl` with the scripts on both hosts.
>         2. Pair over LE: ``scan on`` on the initiator, ``advertise on`` on
>            the acceptor, then ``pair``.
> -       3. Initiator: ``endpoint.config <remote endpoint>
> -          /local/endpoint/ep0 16_2_1``, using the remote PAC Sink endpoint
> -          exposed once the services are resolved.
> +       3. Wait for automatic stream configuration through the registered
> +          endpoint's ``SelectProperties`` method.
>         4. Initiator: ``transport.show <transport>`` for each transport.
>
>  :Expected:
>         1. ``Endpoint /local/endpoint/ep0 registered`` on both hosts.
>         2. ``Pairing successful``.
> -       3. The remote endpoint appears as
> -          ``Endpoint /org/bluez/hci0/dev_XX/pac_sinkN``, and configuring it
> -          creates one transport per location on *both* hosts.
> +       3. One transport per location is created on *both* hosts.
>         4. Each transport of the initiator reports the local PAC Source
>            UUID (``00002bcb-...``), ``Codec: 0x06`` for LC3, ``Device:``
>            pointing at the acceptor device object, and ``State: idle``.
> @@ -108,6 +105,30 @@ test_bap_unicast_transport_acquire
>         be established, as `bluetoothd` sets up the ISO listener on its own
>         when the stream is enabled.
>
> +test_bap_unicast_reconfigure_metadata[empty|media]
> +------------------------------------------------
> +
> +:Setup: As above, with the transports already created and ATT MTU 48.
> +
> +:Steps:
> +       1. Call ``MediaEndpoint1.ClearConfiguration`` on the remote endpoint
> +          and wait for completion. The peer retains the codec configuration.
> +       2. Call ``MediaEndpoint1.SetConfiguration`` with the previous codec
> +          configuration and QoS, and empty or Media streaming-context metadata.
> +
> +:Expected: Reconfiguration completes successfully after the fresh
> +       Codec Configured notification. The same ASE is reused, and the new
> +       transport retains the requested metadata.
> +
> +:Notes: MTU 48 fits each notification separately, but prevents the peer
> +       from batching the Codec Configuration response and the fresh ASE
> +       notification together. Nonempty metadata must not let the initiator
> +       use the cached Configured state to start QoS prematurely.
> +
> +       Reconfiguration uses the D-Bus method directly because
> +       ``bluetoothctl endpoint.config`` does not pass metadata for unicast
> +       presets.
> +
>  BROADCAST
>  =========
>
> diff --git a/test/functional/test_bap.py b/test/functional/test_bap.py
> index ce11dc38d..917e24f27 100644
> --- a/test/functional/test_bap.py
> +++ b/test/functional/test_bap.py
> @@ -5,12 +5,21 @@ Tests for BAP (LE Audio) using bluetoothctl in VM instances
>  """
>
>  import re
> +import threading
>  import warnings
>
> +import dbus
>  import pytest
>
> -from pytest_bluezenv import Bluetoothd, Pexpect, find_exe, host_config
> -from pytest_bluezenv.utils import bluez_src_dir
> +from pytest_bluezenv import (
> +    Bluetoothd,
> +    Pexpect,
> +    find_exe,
> +    get_dbus,
> +    host_config,
> +    mainloop_wrap,
> +)
> +from pytest_bluezenv.utils import DEFAULT_TIMEOUT, bluez_src_dir
>
>  pytestmark = [pytest.mark.vm]
>
> @@ -24,8 +33,6 @@ KernelExperimental = true
>  ControllerMode = le
>  """
>
> -PRESET = "16_2_1"
> -
>  TRANSPORT_RE = r"Transport (/org/bluez/\S+/fd\d+)"
>
>
> @@ -214,12 +221,7 @@ def unicast_hosts(hosts):
>
>      pair_le(host0, initiator, host1, acceptor)
>
> -    # Remote PAC Sink endpoint is exposed once services are resolved
> -    _, m = initiator.expect(r"Endpoint (/org/bluez/\S+/pac_sink\d+)")
> -    remote = m[0].decode("utf-8")
> -
> -    initiator.send(f"endpoint.config {remote} /local/endpoint/ep0 {PRESET}\n")
> -
> +    # SelectProperties configures the streams automatically after pairing.
>      yield host0, host1, initiator, acceptor
>
>
> @@ -274,6 +276,87 @@ def test_bap_unicast_transport_acquire(unicast_hosts):
>      )
>
>
> +def reconfigure_transport(transport, metadata):
> +    """Clear a configured stream and reuse its ASE with explicit metadata."""
> +    done = threading.Event()
> +    errors = []
> +    remote = transport.rsplit("/", 1)[0]
> +
> +    def failed(error):
> +        errors.append(error)
> +        done.set()
> +
> +    @mainloop_wrap
> +    def start():
> +        bus = get_dbus()
> +        props = dbus.Interface(
> +            bus.get_object("org.bluez", transport),
> +            "org.freedesktop.DBus.Properties",
> +        ).GetAll("org.bluez.MediaTransport1")
> +        endpoint = dbus.Interface(
> +            bus.get_object("org.bluez", remote), "org.bluez.MediaEndpoint1"
> +        )
> +        qos = {k: v for k, v in props["QoS"].items() if k not in ("CIG", "CIS")}
> +        qos["TargetLatency"] = dbus.Byte(2)
> +        config = {
> +            "Capabilities": props["Configuration"],
> +            "QoS": dbus.Dictionary(qos, signature="sv"),
> +            "Metadata": dbus.ByteArray(metadata),
> +        }
> +
> +        def configure():
> +            endpoint.SetConfiguration(
> +                dbus.ObjectPath("/local/endpoint/ep0"),
> +                dbus.Dictionary(config, signature="sv"),
> +                reply_handler=done.set,
> +                error_handler=failed,
> +            )
> +
> +        # The reply waits for Release to return the peer ASE to CONFIG.
> +        endpoint.ClearConfiguration(
> +            dbus.ObjectPath(remote), reply_handler=configure, error_handler=failed
> +        )
> +
> +    start()
> +    assert done.wait(DEFAULT_TIMEOUT), "reconfiguration did not complete"
> +    if errors:
> +        raise errors[0]
> +
> +    @mainloop_wrap
> +    def check_transport():
> +        objects = dbus.Interface(
> +            get_dbus().get_object("org.bluez", "/"),
> +            "org.freedesktop.DBus.ObjectManager",
> +        ).GetManagedObjects()
> +        transports = [
> +            interfaces["org.bluez.MediaTransport1"]
> +            for path, interfaces in objects.items()
> +            if path.startswith(remote + "/")
> +            and "org.bluez.MediaTransport1" in interfaces
> +        ]
> +        assert len(transports) == 1
> +        assert bytes(transports[0]["Metadata"]) == metadata
> +
> +    check_transport()
> +
> +
> +# Fit each notification, but not both the Codec Configuration response and
> +# Codec Configured state in one ATT Multiple Handle Value Notification.
> +@host_config(
> +    [Bluetoothd(conf=BAP_CONF + "\n[GATT]\nExchangeMTU = 48\n"), Pexpect()],

Ok, so this only manifests if the CP Write response and the ASE
Notification are not sent in the same package? So this is
implementation-specific. Also, LE Audio requires a minimum MTU of 64
octets:

3.5.1. ATT and EATT transport requirements

The Unicast Server shall support a minimum ATT_MTU of 64 octets for
one Unenhanced ATT bearer, or for at least one Enhanced ATT bearer if
the Unicast Server supports Enhanced ATT bearers.
[]https://www.bluetooth.com/specifications/specs/bap-1-0-1/

> +    [Bluetoothd(conf=BAP_CONF), Pexpect()],
> +)
> +@pytest.mark.parametrize("metadata", [b"", b"\x03\x02\x04\x00"], ids=["empty", "media"])
> +def test_bap_unicast_reconfigure_metadata(unicast_hosts, metadata):
> +    host0, host1, initiator, acceptor = unicast_hosts
> +    left, _ = expect_transports(initiator)
> +    expect_transports(acceptor)
> +
> +    # endpoint.config currently omits Metadata for unicast presets. Exercise
> +    # its D-Bus entry point directly, after bluetoothctl's initial setup.
> +    host0.call(reconfigure_transport, left, metadata)
> +
> +
>  # Broadcast code used by the broadcast scripts, see BCAST_CODE in
>  # client/player.c
>  BCAST_CODE = (
> --
> 2.55.0
>
>


-- 
Luiz Augusto von Dentz

[PATCH BlueZ v4 1/2] shared/bap: Skip local metadata Config callbacks

[dt]

From: Derek Tern <1263187-dt@users.noreply.gitlab.freedesktop.org>

When reconfiguring a client stream that is already Codec Configured,
setup_config() queues Codec Configuration and then caches metadata.
stream_metadata() emits a same-state CONFIG notification for that local
update. The profile callback treats it as the peer's configuration
completion and clears config_pending before the peer has responded.

If the control point response precedes the ASE state notification, QoS
setup can run while need_reconfig is still set and fail locally.

Cache client metadata in CONFIG without emitting a state notification.
Keep genuine peer CONFIG notifications and server metadata handling
unchanged.
---
Yes, coalescing masks the failure. The earlier earbud capture has
separate notifications and a 117-byte ATT write; the MTU exchange was
not captured.

v4: MTU 48 was incorrect. Use MTU 64 and reconfigure both streams,
    checking their removal, replacement and acquisition. In two A/B
    runs, fixed passes both cases; unfixed fails Media metadata before
    the second ASE notification. The source fix is unchanged.

 src/shared/bap.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/shared/bap.c b/src/shared/bap.c
index 891a2f4fd..6d351d010 100644
--- a/src/shared/bap.c
+++ b/src/shared/bap.c
@@ -2282,6 +2282,11 @@ static uint8_t stream_metadata(struct bt_bap_stream *stream, struct iovec *meta,
 	case BT_BAP_STREAM_STATE_IDLE:
 		/* Initial metadata */
 		break;
+	case BT_BAP_STREAM_STATE_CONFIG:
+		/* Local client metadata does not confirm the peer config. */
+		if (stream->client)
+			break;
+		/* Fallthrough */
 	default:
 		/* Force state change to the same state to update metadata */
 		stream_set_state(stream, bt_bap_stream_get_state(stream));
-- 
2.55.0

[PATCH BlueZ v4 2/2] test-functional: Cover BAP metadata reconfiguration

[dt]

From: Derek Tern <1263187-dt@users.noreply.gitlab.freedesktop.org>

Reconfigure both unicast streams with empty or Media metadata at ATT
MTU 64. The batched response and first Codec Configured notification fit
together, while the second notification must be sent separately. This
exposes premature QoS setup from a local metadata callback.

Check that old transports disappear, both replacements retain their
codec configuration and metadata, and both can be acquired.

Use D-Bus because endpoint.config omits unicast metadata. Remove the
fixture's redundant configuration command: SelectProperties already
configures both streams after pairing.
---
 doc/functional-bap.rst      |  38 +++++++--
 test/functional/test_bap.py | 156 +++++++++++++++++++++++++++++++++---
 2 files changed, 178 insertions(+), 16 deletions(-)

diff --git a/doc/functional-bap.rst b/doc/functional-bap.rst
index 3fc3439c1..704970d53 100644
--- a/doc/functional-bap.rst
+++ b/doc/functional-bap.rst
@@ -67,17 +67,14 @@ test_bap_unicast_transport_created
 	1. Start `bluetoothctl` with the scripts on both hosts.
 	2. Pair over LE: ``scan on`` on the initiator, ``advertise on`` on
 	   the acceptor, then ``pair``.
-	3. Initiator: ``endpoint.config <remote endpoint>
-	   /local/endpoint/ep0 16_2_1``, using the remote PAC Sink endpoint
-	   exposed once the services are resolved.
+	3. Wait for automatic stream configuration through the registered
+	   endpoint's ``SelectProperties`` method.
 	4. Initiator: ``transport.show <transport>`` for each transport.
 
 :Expected:
 	1. ``Endpoint /local/endpoint/ep0 registered`` on both hosts.
 	2. ``Pairing successful``.
-	3. The remote endpoint appears as
-	   ``Endpoint /org/bluez/hci0/dev_XX/pac_sinkN``, and configuring it
-	   creates one transport per location on *both* hosts.
+	3. One transport per location is created on *both* hosts.
 	4. Each transport of the initiator reports the local PAC Source
 	   UUID (``00002bcb-...``), ``Codec: 0x06`` for LC3, ``Device:``
 	   pointing at the acceptor device object, and ``State: idle``.
@@ -108,6 +105,35 @@ test_bap_unicast_transport_acquire
 	be established, as `bluetoothd` sets up the ISO listener on its own
 	when the stream is enabled.
 
+test_bap_unicast_reconfigure_metadata[empty|media]
+------------------------------------------------
+
+:Setup: As above, with both transports already created and ATT MTU 64.
+
+:Steps:
+	1. Save both codec configurations and QoS, then call
+	   ``MediaEndpoint1.ClearConfiguration`` on the remote endpoint.
+	2. Wait for completion and check that both old transports are gone.
+	3. Call ``MediaEndpoint1.SetConfiguration`` for both streams without
+	   waiting between requests, using the saved configurations and
+	   empty or Media streaming-context metadata.
+	4. Acquire both replacement transports.
+
+:Expected: Both configuration requests succeed. Two replacement transports
+	retain their codec configurations and the requested metadata. Both
+	acquisitions succeed and the transports become active.
+
+:Notes: MTU 64 meets BAP's minimum. It fits the two-ASE Codec Configuration
+	response and one Codec Configured notification together, but not the
+	second ASE notification. This exercises the interval in which the
+	initiator has received a successful response but is still waiting
+	for a fresh Configured state before starting QoS.
+
+	Reconfiguration uses the D-Bus method directly because
+	``bluetoothctl endpoint.config`` does not pass metadata for unicast
+	presets. This test covers the initiator's playback streams; it does
+	not exercise microphone streams or simultaneous playback and capture.
+
 BROADCAST
 =========
 
diff --git a/test/functional/test_bap.py b/test/functional/test_bap.py
index ce11dc38d..a941cafb9 100644
--- a/test/functional/test_bap.py
+++ b/test/functional/test_bap.py
@@ -5,12 +5,21 @@ Tests for BAP (LE Audio) using bluetoothctl in VM instances
 """
 
 import re
+import threading
 import warnings
 
+import dbus
 import pytest
 
-from pytest_bluezenv import Bluetoothd, Pexpect, find_exe, host_config
-from pytest_bluezenv.utils import bluez_src_dir
+from pytest_bluezenv import (
+    Bluetoothd,
+    Pexpect,
+    find_exe,
+    get_dbus,
+    host_config,
+    mainloop_wrap,
+)
+from pytest_bluezenv.utils import DEFAULT_TIMEOUT, bluez_src_dir
 
 pytestmark = [pytest.mark.vm]
 
@@ -24,8 +33,6 @@ KernelExperimental = true
 ControllerMode = le
 """
 
-PRESET = "16_2_1"
-
 TRANSPORT_RE = r"Transport (/org/bluez/\S+/fd\d+)"
 
 
@@ -214,12 +221,7 @@ def unicast_hosts(hosts):
 
     pair_le(host0, initiator, host1, acceptor)
 
-    # Remote PAC Sink endpoint is exposed once services are resolved
-    _, m = initiator.expect(r"Endpoint (/org/bluez/\S+/pac_sink\d+)")
-    remote = m[0].decode("utf-8")
-
-    initiator.send(f"endpoint.config {remote} /local/endpoint/ep0 {PRESET}\n")
-
+    # SelectProperties configures the streams automatically after pairing.
     yield host0, host1, initiator, acceptor
 
 
@@ -274,6 +276,140 @@ def test_bap_unicast_transport_acquire(unicast_hosts):
     )
 
 
+def reconfigure_transports(transports, metadata):
+    """Clear both streams and reconfigure them together with explicit metadata."""
+    done = threading.Event()
+    errors = []
+    configs = []
+    replies = []
+    remote = transports[0].rsplit("/", 1)[0]
+    assert all(path.rsplit("/", 1)[0] == remote for path in transports)
+
+    def failed(error):
+        errors.append(error)
+        done.set()
+
+    def wait():
+        assert done.wait(DEFAULT_TIMEOUT), "reconfiguration did not complete"
+        if errors:
+            raise errors[0]
+        done.clear()
+
+    def get_transports():
+        objects = dbus.Interface(
+            get_dbus().get_object("org.bluez", "/"),
+            "org.freedesktop.DBus.ObjectManager",
+        ).GetManagedObjects()
+        return {
+            str(path): interfaces["org.bluez.MediaTransport1"]
+            for path, interfaces in objects.items()
+            if path.startswith(remote + "/")
+            and "org.bluez.MediaTransport1" in interfaces
+        }
+
+    @mainloop_wrap
+    def clear():
+        bus = get_dbus()
+        for transport in transports:
+            props = dbus.Interface(
+                bus.get_object("org.bluez", transport),
+                "org.freedesktop.DBus.Properties",
+            ).GetAll("org.bluez.MediaTransport1")
+            qos = {k: v for k, v in props["QoS"].items() if k not in ("CIG", "CIS")}
+            qos["TargetLatency"] = dbus.Byte(2)
+            configs.append(
+                dbus.Dictionary(
+                    {
+                        "Capabilities": props["Configuration"],
+                        "QoS": dbus.Dictionary(qos, signature="sv"),
+                        "Metadata": dbus.ByteArray(metadata),
+                    },
+                    signature="sv",
+                )
+            )
+
+        # The reply waits for Release to finish for both peer ASEs.
+        dbus.Interface(
+            bus.get_object("org.bluez", remote), "org.bluez.MediaEndpoint1"
+        ).ClearConfiguration(
+            dbus.ObjectPath(remote), reply_handler=done.set, error_handler=failed
+        )
+
+    clear()
+    wait()
+
+    @mainloop_wrap
+    def configure():
+        # Transport paths may be reused, so check their removal before
+        # creating replacements instead of comparing old and new paths.
+        assert not get_transports(), "old transports remain after release"
+        endpoint = dbus.Interface(
+            get_dbus().get_object("org.bluez", remote), "org.bluez.MediaEndpoint1"
+        )
+
+        def configured():
+            replies.append(True)
+            if len(replies) == len(configs):
+                done.set()
+
+        # Queue both requests without waiting for the first response, allowing
+        # the Codec Configuration control-point operation to include both ASEs.
+        for config in configs:
+            endpoint.SetConfiguration(
+                dbus.ObjectPath("/local/endpoint/ep0"),
+                config,
+                reply_handler=configured,
+                error_handler=failed,
+            )
+
+    configure()
+    wait()
+
+    @mainloop_wrap
+    def check_transports():
+        current = get_transports()
+        assert len(current) == len(transports)
+        assert sorted(bytes(props["Configuration"]) for props in current.values()) == (
+            sorted(bytes(config["Capabilities"]) for config in configs)
+        )
+        assert all(bytes(props["Metadata"]) == metadata for props in current.values())
+        return sorted(current)
+
+    return check_transports()
+
+
+# MTU 64 meets BAP's minimum and fits a two-ASE Codec Configuration response
+# with one Codec Configured notification, but not both ASE notifications.
+@host_config(
+    [Bluetoothd(conf=BAP_CONF + "\n[GATT]\nExchangeMTU = 64\n"), Pexpect()],
+    [Bluetoothd(conf=BAP_CONF), Pexpect()],
+)
+@pytest.mark.parametrize("metadata", [b"", b"\x03\x02\x04\x00"], ids=["empty", "media"])
+def test_bap_unicast_reconfigure_metadata(unicast_hosts, metadata):
+    host0, host1, initiator, acceptor = unicast_hosts
+    transports = expect_transports(initiator)
+    expect_transports(acceptor)
+
+    # endpoint.config currently omits Metadata for unicast presets. Exercise
+    # its D-Bus entry point directly, after bluetoothctl's initial setup.
+    left, right = host0.call(reconfigure_transports, transports, metadata)
+    expect_all(
+        initiator,
+        [rf"NEW.*Transport {re.escape(path)} " for path in (left, right)],
+    )
+    initiator.send(f"transport.acquire {left} {right}\n")
+    acquired = r"Acquire successful: fd \d+ MTU \d+:\d+"
+    expect_all(
+        initiator,
+        [
+            acquired,
+            acquired,
+            f"Transport {left} State: active",
+            f"Transport {right} State: active",
+        ],
+    )
+
+
 # Broadcast code used by the broadcast scripts, see BCAST_CODE in
 # client/player.c
 BCAST_CODE = (
-- 
2.55.0

Re: [PATCH BlueZ v4 2/2] test-functional: Cover BAP metadata reconfiguration

[Luiz Augusto von Dentz]

Hi,

On Thu, Sep 17, 2026 at 1:03 PM dt <derektern@proton.me> wrote:
>
> From: Derek Tern <1263187-dt@users.noreply.gitlab.freedesktop.org>
>
> Reconfigure both unicast streams with empty or Media metadata at ATT
> MTU 64. The batched response and first Codec Configured notification fit
> together, while the second notification must be sent separately. This
> exposes premature QoS setup from a local metadata callback.
>
> Check that old transports disappear, both replacements retain their
> codec configuration and metadata, and both can be acquired.
>
> Use D-Bus because endpoint.config omits unicast metadata. Remove the
> fixture's redundant configuration command: SelectProperties already
> configures both streams after pairing.
> ---
>  doc/functional-bap.rst      |  38 +++++++--
>  test/functional/test_bap.py | 156 +++++++++++++++++++++++++++++++++---
>  2 files changed, 178 insertions(+), 16 deletions(-)
>
> diff --git a/doc/functional-bap.rst b/doc/functional-bap.rst
> index 3fc3439c1..704970d53 100644
> --- a/doc/functional-bap.rst
> +++ b/doc/functional-bap.rst
> @@ -67,17 +67,14 @@ test_bap_unicast_transport_created
>         1. Start `bluetoothctl` with the scripts on both hosts.
>         2. Pair over LE: ``scan on`` on the initiator, ``advertise on`` on
>            the acceptor, then ``pair``.
> -       3. Initiator: ``endpoint.config <remote endpoint>
> -          /local/endpoint/ep0 16_2_1``, using the remote PAC Sink endpoint
> -          exposed once the services are resolved.
> +       3. Wait for automatic stream configuration through the registered
> +          endpoint's ``SelectProperties`` method.
>         4. Initiator: ``transport.show <transport>`` for each transport.
>
>  :Expected:
>         1. ``Endpoint /local/endpoint/ep0 registered`` on both hosts.
>         2. ``Pairing successful``.
> -       3. The remote endpoint appears as
> -          ``Endpoint /org/bluez/hci0/dev_XX/pac_sinkN``, and configuring it
> -          creates one transport per location on *both* hosts.
> +       3. One transport per location is created on *both* hosts.
>         4. Each transport of the initiator reports the local PAC Source
>            UUID (``00002bcb-...``), ``Codec: 0x06`` for LC3, ``Device:``
>            pointing at the acceptor device object, and ``State: idle``.
> @@ -108,6 +105,35 @@ test_bap_unicast_transport_acquire
>         be established, as `bluetoothd` sets up the ISO listener on its own
>         when the stream is enabled.
>
> +test_bap_unicast_reconfigure_metadata[empty|media]
> +------------------------------------------------
> +
> +:Setup: As above, with both transports already created and ATT MTU 64.
> +
> +:Steps:
> +       1. Save both codec configurations and QoS, then call
> +          ``MediaEndpoint1.ClearConfiguration`` on the remote endpoint.
> +       2. Wait for completion and check that both old transports are gone.
> +       3. Call ``MediaEndpoint1.SetConfiguration`` for both streams without
> +          waiting between requests, using the saved configurations and
> +          empty or Media streaming-context metadata.
> +       4. Acquire both replacement transports.
> +
> +:Expected: Both configuration requests succeed. Two replacement transports
> +       retain their codec configurations and the requested metadata. Both
> +       acquisitions succeed and the transports become active.
> +
> +:Notes: MTU 64 meets BAP's minimum. It fits the two-ASE Codec Configuration
> +       response and one Codec Configured notification together, but not the
> +       second ASE notification. This exercises the interval in which the
> +       initiator has received a successful response but is still waiting
> +       for a fresh Configured state before starting QoS.
> +
> +       Reconfiguration uses the D-Bus method directly because
> +       ``bluetoothctl endpoint.config`` does not pass metadata for unicast
> +       presets. This test covers the initiator's playback streams; it does
> +       not exercise microphone streams or simultaneous playback and capture.
> +
>  BROADCAST
>  =========
>
> diff --git a/test/functional/test_bap.py b/test/functional/test_bap.py
> index ce11dc38d..a941cafb9 100644
> --- a/test/functional/test_bap.py
> +++ b/test/functional/test_bap.py
> @@ -5,12 +5,21 @@ Tests for BAP (LE Audio) using bluetoothctl in VM instances
>  """
>
>  import re
> +import threading
>  import warnings
>
> +import dbus
>  import pytest
>
> -from pytest_bluezenv import Bluetoothd, Pexpect, find_exe, host_config
> -from pytest_bluezenv.utils import bluez_src_dir
> +from pytest_bluezenv import (
> +    Bluetoothd,
> +    Pexpect,
> +    find_exe,
> +    get_dbus,
> +    host_config,
> +    mainloop_wrap,
> +)
> +from pytest_bluezenv.utils import DEFAULT_TIMEOUT, bluez_src_dir
>
>  pytestmark = [pytest.mark.vm]
>
> @@ -24,8 +33,6 @@ KernelExperimental = true
>  ControllerMode = le
>  """
>
> -PRESET = "16_2_1"
> -
>  TRANSPORT_RE = r"Transport (/org/bluez/\S+/fd\d+)"
>
>
> @@ -214,12 +221,7 @@ def unicast_hosts(hosts):
>
>      pair_le(host0, initiator, host1, acceptor)
>
> -    # Remote PAC Sink endpoint is exposed once services are resolved
> -    _, m = initiator.expect(r"Endpoint (/org/bluez/\S+/pac_sink\d+)")
> -    remote = m[0].decode("utf-8")
> -
> -    initiator.send(f"endpoint.config {remote} /local/endpoint/ep0 {PRESET}\n")
> -
> +    # SelectProperties configures the streams automatically after pairing.
>      yield host0, host1, initiator, acceptor
>
>
> @@ -274,6 +276,140 @@ def test_bap_unicast_transport_acquire(unicast_hosts):
>      )
>
>
> +def reconfigure_transports(transports, metadata):
> +    """Clear both streams and reconfigure them together with explicit metadata."""
> +    done = threading.Event()
> +    errors = []
> +    configs = []
> +    replies = []
> +    remote = transports[0].rsplit("/", 1)[0]
> +    assert all(path.rsplit("/", 1)[0] == remote for path in transports)
> +
> +    def failed(error):
> +        errors.append(error)
> +        done.set()
> +
> +    def wait():
> +        assert done.wait(DEFAULT_TIMEOUT), "reconfiguration did not complete"
> +        if errors:
> +            raise errors[0]
> +        done.clear()
> +
> +    def get_transports():
> +        objects = dbus.Interface(
> +            get_dbus().get_object("org.bluez", "/"),
> +            "org.freedesktop.DBus.ObjectManager",
> +        ).GetManagedObjects()
> +        return {
> +            str(path): interfaces["org.bluez.MediaTransport1"]
> +            for path, interfaces in objects.items()
> +            if path.startswith(remote + "/")
> +            and "org.bluez.MediaTransport1" in interfaces
> +        }
> +
> +    @mainloop_wrap
> +    def clear():
> +        bus = get_dbus()
> +        for transport in transports:
> +            props = dbus.Interface(
> +                bus.get_object("org.bluez", transport),
> +                "org.freedesktop.DBus.Properties",
> +            ).GetAll("org.bluez.MediaTransport1")
> +            qos = {k: v for k, v in props["QoS"].items() if k not in ("CIG", "CIS")}
> +            qos["TargetLatency"] = dbus.Byte(2)
> +            configs.append(
> +                dbus.Dictionary(
> +                    {
> +                        "Capabilities": props["Configuration"],
> +                        "QoS": dbus.Dictionary(qos, signature="sv"),
> +                        "Metadata": dbus.ByteArray(metadata),
> +                    },
> +                    signature="sv",
> +                )
> +            )
> +
> +        # The reply waits for Release to finish for both peer ASEs.
> +        dbus.Interface(
> +            bus.get_object("org.bluez", remote), "org.bluez.MediaEndpoint1"
> +        ).ClearConfiguration(
> +            dbus.ObjectPath(remote), reply_handler=done.set, error_handler=failed
> +        )
> +
> +    clear()
> +    wait()
> +
> +    @mainloop_wrap
> +    def configure():
> +        # Transport paths may be reused, so check their removal before
> +        # creating replacements instead of comparing old and new paths.
> +        assert not get_transports(), "old transports remain after release"
> +        endpoint = dbus.Interface(
> +            get_dbus().get_object("org.bluez", remote), "org.bluez.MediaEndpoint1"
> +        )
> +
> +        def configured():
> +            replies.append(True)
> +            if len(replies) == len(configs):
> +                done.set()
> +
> +        # Queue both requests without waiting for the first response, allowing
> +        # the Codec Configuration control-point operation to include both ASEs.
> +        for config in configs:
> +            endpoint.SetConfiguration(
> +                dbus.ObjectPath("/local/endpoint/ep0"),
> +                config,
> +                reply_handler=configured,
> +                error_handler=failed,
> +            )
> +
> +    configure()
> +    wait()
> +
> +    @mainloop_wrap
> +    def check_transports():
> +        current = get_transports()
> +        assert len(current) == len(transports)
> +        assert sorted(bytes(props["Configuration"]) for props in current.values()) == (
> +            sorted(bytes(config["Capabilities"]) for config in configs)
> +        )
> +        assert all(bytes(props["Metadata"]) == metadata for props in current.values())
> +        return sorted(current)
> +
> +    return check_transports()
> +
> +
> +# MTU 64 meets BAP's minimum and fits a two-ASE Codec Configuration response
> +# with one Codec Configured notification, but not both ASE notifications.
> +@host_config(
> +    [Bluetoothd(conf=BAP_CONF + "\n[GATT]\nExchangeMTU = 64\n"), Pexpect()],
> +    [Bluetoothd(conf=BAP_CONF), Pexpect()],
> +)
> +@pytest.mark.parametrize("metadata", [b"", b"\x03\x02\x04\x00"], ids=["empty", "media"])
> +def test_bap_unicast_reconfigure_metadata(unicast_hosts, metadata):
> +    host0, host1, initiator, acceptor = unicast_hosts
> +    transports = expect_transports(initiator)
> +    expect_transports(acceptor)
> +
> +    # endpoint.config currently omits Metadata for unicast presets. Exercise
> +    # its D-Bus entry point directly, after bluetoothctl's initial setup.

This is not quite correct, you can program a custom preset with
metadata and then use it with endpoint.config:

https://github.com/bluez/bluez/blob/master/doc/bluetoothctl-endpoint.rst#presets

> +    left, right = host0.call(reconfigure_transports, transports, metadata)
> +    expect_all(
> +        initiator,
> +        [rf"NEW.*Transport {re.escape(path)} " for path in (left, right)],
> +    )
> +    initiator.send(f"transport.acquire {left} {right}\n")
> +    acquired = r"Acquire successful: fd \d+ MTU \d+:\d+"
> +    expect_all(
> +        initiator,
> +        [
> +            acquired,
> +            acquired,
> +            f"Transport {left} State: active",
> +            f"Transport {right} State: active",
> +        ],
> +    )
> +
> +
>  # Broadcast code used by the broadcast scripts, see BCAST_CODE in
>  # client/player.c
>  BCAST_CODE = (
> --
> 2.55.0
>
>


-- 
Luiz Augusto von Dentz

[PATCH BlueZ v5 1/3] shared/bap: Skip local metadata Config callbacks

[dt]

From: Derek Tern <1263187-dt@users.noreply.gitlab.freedesktop.org>

When reconfiguring a client stream that is already Codec Configured,
setup_config() queues Codec Configuration and then caches metadata.
stream_metadata() emits a same-state CONFIG notification for that local
update. The profile callback treats it as the peer's configuration
completion and clears config_pending before the peer has responded.

If the control point response precedes the ASE state notification, QoS
setup can run while need_reconfig is still set and fail locally.

Cache client metadata in CONFIG without emitting a state notification.
Keep genuine peer CONFIG notifications and server metadata handling
unchanged.
---
I tried a custom preset with Media metadata. endpoint.config succeeded,
but the transport metadata was empty: cmd_config_endpoint() does not
copy preset->meta. Patch 2 fixes that; patch 3 now uses custom presets.

v5: Use an equivalent early return to remove the fallthrough warning.
    Forward preset metadata and test through endpoint.config. Both
    MTU64 cases pass; without the BAP fix, Media fails at premature QoS.

The CI device_addr_type_cmp teardown crash also reproduces on unmodified
f87a79667 with ASan/UBSan. I have not reproduced the separate CIG stack.

 src/shared/bap.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/shared/bap.c b/src/shared/bap.c
index 891a2f4fd..536d47161 100644
--- a/src/shared/bap.c
+++ b/src/shared/bap.c
@@ -2278,6 +2278,11 @@ static uint8_t stream_metadata(struct bt_bap_stream *stream, struct iovec *meta,
 	util_iov_free(stream->meta, 1);
 	stream->meta = util_iov_dup(meta, 1);
 
+	/* Local client metadata does not confirm the peer config. */
+	if (stream->client && bt_bap_stream_get_state(stream) ==
+					BT_BAP_STREAM_STATE_CONFIG)
+		return 0;
+
 	switch (bt_bap_stream_get_state(stream)) {
 	case BT_BAP_STREAM_STATE_IDLE:
 		/* Initial metadata */
-- 
2.55.0

[PATCH BlueZ v5 2/3] client: Pass unicast preset metadata to config

[dt]

From: Derek Tern <1263187-dt@users.noreply.gitlab.freedesktop.org>

Custom presets retain metadata, but endpoint.config copies only their
codec capabilities and QoS into SetConfiguration. Copy the metadata too,
and free configuration buffers on completion and immediate failure.
---
 client/player.c | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/client/player.c b/client/player.c
index 6cd5aeb4a..ae2ce66f0 100644
--- a/client/player.c
+++ b/client/player.c
@@ -3797,15 +3797,20 @@ static void config_endpoint_setup(DBusMessageIter *iter, void *user_data)
 	append_properties(iter, cfg);
 }
 
+static void config_endpoint_free(struct endpoint_config *cfg)
+{
+	util_iov_free(cfg->caps, 1);
+	util_iov_free(cfg->meta, 1);
+	free(cfg);
+}
+
 static void config_endpoint_reply(DBusMessage *message, void *user_data)
 {
 	struct endpoint_config *cfg = user_data;
 	struct endpoint *ep = cfg->ep;
 	DBusError error;
 
-	free(cfg->caps->iov_base);
-	free(cfg->caps);
-	free(cfg);
+	config_endpoint_free(cfg);
 
 	dbus_error_init(&error);
 
@@ -3827,6 +3832,7 @@ static void endpoint_set_config(struct endpoint_config *cfg)
 						config_endpoint_setup,
 						config_endpoint_reply,
 						cfg, NULL)) {
+		config_endpoint_free(cfg);
 		bt_shell_printf("Failed to config endpoint\n");
 		return bt_shell_noninteractive_quit(EXIT_FAILURE);
 	}
@@ -4050,8 +4056,10 @@ static void cmd_config_endpoint(int argc, char *argv[])
 
 		if (cfg->ep->broadcast)
 			endpoint_set_config_bcast(cfg);
-		else
+		else {
+			cfg->meta = util_iov_dup(&preset->meta, 1);
 			endpoint_set_config(cfg);
+		}
 
 		return;
 	}
@@ -4062,7 +4070,7 @@ static void cmd_config_endpoint(int argc, char *argv[])
 	return;
 
 fail:
-	g_free(cfg);
+	config_endpoint_free(cfg);
 	return bt_shell_noninteractive_quit(EXIT_FAILURE);
 }
 
-- 
2.55.0

[PATCH BlueZ v5 3/3] test-functional: Cover BAP metadata reconfiguration

[dt]

From: Derek Tern <1263187-dt@users.noreply.gitlab.freedesktop.org>

Reconfigure both unicast streams using custom presets with empty or
Media metadata at ATT MTU 64. The second Configured notification arrives
separately, exposing premature QoS setup from a local metadata callback.

Check that old transports disappear, both replacements retain their
codec configuration and metadata, and both can be acquired.

Remove the fixture's redundant configuration command: SelectProperties
already configures both streams after pairing.
---
 doc/functional-bap.rst      |  38 ++++++++--
 test/functional/test_bap.py | 139 +++++++++++++++++++++++++++++++++---
 2 files changed, 160 insertions(+), 17 deletions(-)

diff --git a/doc/functional-bap.rst b/doc/functional-bap.rst
index 3fc3439c1..60c38c5ed 100644
--- a/doc/functional-bap.rst
+++ b/doc/functional-bap.rst
@@ -67,17 +67,14 @@ test_bap_unicast_transport_created
 	1. Start `bluetoothctl` with the scripts on both hosts.
 	2. Pair over LE: ``scan on`` on the initiator, ``advertise on`` on
 	   the acceptor, then ``pair``.
-	3. Initiator: ``endpoint.config <remote endpoint>
-	   /local/endpoint/ep0 16_2_1``, using the remote PAC Sink endpoint
-	   exposed once the services are resolved.
+	3. Wait for automatic stream configuration through the registered
+	   endpoint's ``SelectProperties`` method.
 	4. Initiator: ``transport.show <transport>`` for each transport.
 
 :Expected:
 	1. ``Endpoint /local/endpoint/ep0 registered`` on both hosts.
 	2. ``Pairing successful``.
-	3. The remote endpoint appears as
-	   ``Endpoint /org/bluez/hci0/dev_XX/pac_sinkN``, and configuring it
-	   creates one transport per location on *both* hosts.
+	3. One transport per location is created on *both* hosts.
 	4. Each transport of the initiator reports the local PAC Source
 	   UUID (``00002bcb-...``), ``Codec: 0x06`` for LC3, ``Device:``
 	   pointing at the acceptor device object, and ``State: idle``.
@@ -108,6 +105,35 @@ test_bap_unicast_transport_acquire
 	be established, as `bluetoothd` sets up the ISO listener on its own
 	when the stream is enabled.
 
+test_bap_unicast_reconfigure_metadata[empty|media]
+------------------------------------------------
+
+:Setup: As above, with both transports already created and ATT MTU 64.
+
+:Steps:
+	1. Create two custom presets from the existing codec configurations
+	   and QoS, with empty or Media streaming-context metadata. Call
+	   ``MediaEndpoint1.ClearConfiguration`` on the remote endpoint.
+	2. Wait for completion and check that both old transports are gone.
+	3. Issue ``endpoint.config`` for both presets without waiting
+	   between requests.
+	4. Acquire both replacement transports.
+
+:Expected: Both configuration requests succeed. Two replacement transports
+	retain their codec configurations and the requested metadata. Both
+	acquisitions succeed and the transports become active.
+
+:Notes: MTU 64 meets BAP's minimum. It fits the two-ASE Codec Configuration
+	response and one Codec Configured notification together, but not the
+	second ASE notification. This exercises the interval in which the
+	initiator has received a successful response but is still waiting
+	for a fresh Configured state before starting QoS.
+
+	Release uses D-Bus directly: bluetoothctl has no command for
+	``ClearConfiguration``. This test covers the initiator's playback
+	streams; it does not exercise microphone streams or simultaneous
+	playback and capture.
+
 BROADCAST
 =========
 
diff --git a/test/functional/test_bap.py b/test/functional/test_bap.py
index ce11dc38d..06dd2720b 100644
--- a/test/functional/test_bap.py
+++ b/test/functional/test_bap.py
@@ -4,13 +4,21 @@
 Tests for BAP (LE Audio) using bluetoothctl in VM instances
 """
 
-import re
+import threading
 import warnings
 
+import dbus
 import pytest
 
-from pytest_bluezenv import Bluetoothd, Pexpect, find_exe, host_config
-from pytest_bluezenv.utils import bluez_src_dir
+from pytest_bluezenv import (
+    Bluetoothd,
+    Pexpect,
+    find_exe,
+    get_dbus,
+    host_config,
+    mainloop_wrap,
+)
+from pytest_bluezenv.utils import DEFAULT_TIMEOUT, bluez_src_dir
 
 pytestmark = [pytest.mark.vm]
 
@@ -24,8 +32,6 @@ KernelExperimental = true
 ControllerMode = le
 """
 
-PRESET = "16_2_1"
-
 TRANSPORT_RE = r"Transport (/org/bluez/\S+/fd\d+)"
 
 
@@ -214,12 +220,7 @@ def unicast_hosts(hosts):
 
     pair_le(host0, initiator, host1, acceptor)
 
-    # Remote PAC Sink endpoint is exposed once services are resolved
-    _, m = initiator.expect(r"Endpoint (/org/bluez/\S+/pac_sink\d+)")
-    remote = m[0].decode("utf-8")
-
-    initiator.send(f"endpoint.config {remote} /local/endpoint/ep0 {PRESET}\n")
-
+    # SelectProperties configures the streams automatically after pairing.
     yield host0, host1, initiator, acceptor
 
 
@@ -274,6 +275,122 @@ def test_bap_unicast_transport_acquire(unicast_hosts):
     )
 
 
+def clear_remote_transports(remote):
+    """Release the peer ASEs while retaining the connected GATT session."""
+    done = threading.Event()
+    errors = []
+
+    def failed(error):
+        errors.append(error)
+        done.set()
+
+    @mainloop_wrap
+    def clear():
+        dbus.Interface(
+            get_dbus().get_object("org.bluez", remote), "org.bluez.MediaEndpoint1"
+        ).ClearConfiguration(
+            dbus.ObjectPath(remote), reply_handler=done.set, error_handler=failed
+        )
+
+    clear()
+    assert done.wait(DEFAULT_TIMEOUT), "release did not complete"
+    if errors:
+        raise errors[0]
+
+
+@mainloop_wrap
+def remote_transport_properties(remote):
+    objects = dbus.Interface(
+        get_dbus().get_object("org.bluez", "/"),
+        "org.freedesktop.DBus.ObjectManager",
+    ).GetManagedObjects()
+    return {
+        str(path): props["org.bluez.MediaTransport1"]
+        for path, props in objects.items()
+        if path.startswith(remote + "/") and "org.bluez.MediaTransport1" in props
+    }
+
+
+def add_preset(ctl, name, props, metadata):
+    """Make a custom preset from a transport's codec configuration and QoS."""
+
+    def expect_reply(pattern):
+        failures = FAILURES + [r"(Invalid [^\r\n]*)", r"(No preset found)"]
+        idx, matches = ctl.expect(failures + [pattern], timeout=REPLY_TIMEOUT)
+        if idx < len(failures):
+            raise AssertionError(matches[0].decode("utf-8") if matches else "failed")
+
+    caps = " ".join(f"0x{byte:02x}" for byte in props["Configuration"])
+    meta = " ".join(f"0x{byte:02x}" for byte in metadata) or "no"
+    # dbus.Byte formats as a character unless converted to an ordinary int.
+    qos = {str(key): int(value) for key, value in props["QoS"].items()}
+    ctl.send(f'endpoint.presets /local/endpoint/ep0 {name} "{caps}"\n')
+    for prompt, value in [
+        ("Enter Target Latency", "Balance"),
+        ("Enter SDU Interval", qos["Interval"]),
+        ("Enter Framing", qos["Framing"]),
+        ("Enter PHY", qos["PHY"]),
+        ("Enter Max SDU", qos["SDU"]),
+        ("Enter RTN", qos["Retransmissions"]),
+        ("Enter Max Transport Latency", qos["Latency"]),
+        ("Enter Presentation Delay", qos["PresentationDelay"]),
+        ("Enter Metadata", meta),
+    ]:
+        expect_reply(prompt)
+        ctl.send(f"{value}\n")
+    ctl.send("version\n")
+    expect_reply(r"Version \d")
+
+
+# MTU 64 meets BAP's minimum and fits a two-ASE Codec Configuration response
+# with one Codec Configured notification, but not both ASE notifications.
+@host_config(
+    [Bluetoothd(conf=BAP_CONF + "\n[GATT]\nExchangeMTU = 64\n"), Pexpect()],
+    [Bluetoothd(conf=BAP_CONF), Pexpect()],
+)
+@pytest.mark.parametrize("metadata", [b"", b"\x03\x02\x04\x00"], ids=["empty", "media"])
+def test_bap_unicast_reconfigure_metadata(unicast_hosts, metadata):
+    host0, host1, initiator, acceptor = unicast_hosts
+    transports = expect_transports(initiator)
+    expect_transports(acceptor)
+    remote = transports[0].rsplit("/", 1)[0]
+    original = host0.call(remote_transport_properties, remote)
+    assert set(original) == set(transports)
+    presets = [f"metadata-{i}" for i in range(len(transports))]
+    for name, transport in zip(presets, transports):
+        add_preset(initiator, name, original[transport], metadata)
+
+    host0.call(clear_remote_transports, remote)
+    # Transport paths can be reused: check removal before recreating them.
+    assert not host0.call(remote_transport_properties, remote)
+
+    # PTY input permits both asynchronous requests without waiting for replies.
+    initiator.send(
+        "".join(
+            f"endpoint.config {remote} /local/endpoint/ep0 {name}\n" for name in presets
+        )
+    )
+    expect_all(initiator, [r"Endpoint /local/endpoint/ep0 configured"] * 2)
+    current = host0.call(remote_transport_properties, remote)
+    assert len(current) == len(original)
+    assert sorted(bytes(p["Configuration"]) for p in current.values()) == sorted(
+        bytes(p["Configuration"]) for p in original.values()
+    )
+    assert all(bytes(p["Metadata"]) == metadata for p in current.values())
+    left, right = sorted(current)
+    initiator.send(f"transport.acquire {left} {right}\n")
+    acquired = r"Acquire successful: fd \d+ MTU \d+:\d+"
+    expect_all(
+        initiator,
+        [
+            acquired,
+            acquired,
+            f"Transport {left} State: active",
+            f"Transport {right} State: active",
+        ],
+    )
+
+
 # Broadcast code used by the broadcast scripts, see BCAST_CODE in
 # client/player.c
 BCAST_CODE = (
-- 
2.55.0

RE: [BlueZ,v5,1/3] shared/bap: Skip local metadata Config callbacks

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 102317 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1167962/

---Test result---

Test Summary:
CheckPatch                    PASS      1.38 seconds
GitLint                       PASS      0.95 seconds
BuildEll                      PASS      19.88 seconds
BluezMake                     PASS      397.80 seconds
MakeCheck                     PASS      14.46 seconds
MakeDistcheck                 PASS      145.26 seconds
CheckValgrind                 PASS      238.40 seconds
CheckSmatch                   WARNING   298.54 seconds
bluezmakeextell               PASS      96.21 seconds
TestFunctional                FAIL      1150.62 seconds
IncrementalBuild              PASS      390.98 seconds
ScanBuild                     PASS      1158.76 seconds

Details
##############################
Test: CheckSmatch - WARNING
Desc: Run smatch tool with source
Output:
src/shared/bap.c:318:25: warning: array of flexible structuressrc/shared/bap.c: note: in included file:./src/shared/ascs.h:88:25: warning: array of flexible structuressrc/shared/bap.c:318:25: warning: array of flexible structuressrc/shared/bap.c: note: in included file:./src/shared/ascs.h:88:25: warning: array of flexible structuressrc/shared/bap.c:318:25: warning: array of flexible structuressrc/shared/bap.c: note: in included file:./src/shared/ascs.h:88:25: warning: array of flexible structures
##############################
Test: TestFunctional - FAIL
Desc: Run test-functional
Output:
FAIL functional.test_bap::test_bap_unicast_set_transport_created[hosts8-vm3]: failed on teardown with "pytest_bluezenv.plugin.CoredumpWarning: Core dump: test-bluezenv-hosts8.0-bluetoothd-1789677822-52.core
        /usr/bin/gdb: warning: Couldn't determine a path for the index cache directory.
        [New LWP 52]
        [Thread debugging using libthread_db enabled]
        Using host libthread_db library "/usr/lib/x86_64-linux-gnu/libthread_db.so.1".
        Core was generated by `/home/runner/work/bluez/bluez/src/src/src/bluetoothd --nodetach -f /run/bluetoo'.
        Program terminated with signal SIGABRT, Aborted.
        #0  __pthread_kill_implementation (threadid=<optimized out>, signo=6, no_tid=0) at ./nptl/pthread_kill.c:44

        warning: 44	./nptl/pthread_kill.c: No such file or directory

        Thread 1 (Thread 0x7fed7ba53900 (LWP 52)):
        #0  __pthread_kill_implementation (threadid=<optimized out>, signo=6, no_tid=0) at ./nptl/pthread_kill.c:44
                tid = <optimized out>
                ret = 0
                pd = <optimized out>
                old_mask = {__val = {4412750543122677053}}
                ret = <optimized out>
        #1  __pthread_kill_internal (threadid=<optimized out>, signo=6) at ./nptl/pthread_kill.c:89
        No locals.
        #2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ./nptl/pthread_kill.c:100
        No locals.
        #3  0x00007fed7c1aeb7e in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
                ret = <optimized out>
        #4  0x00007fed7c1918ec in __GI_abort () at ./stdlib/abort.c:77
                act = {__sigaction_handler = {sa_handler = 0x0, sa_sigaction = 0x0}, sa_mask = {__val = {0, 0, 0, 0, 0, 140723664247408, 22, 140657963019216, 0, 140723664247344, 140657979864598, 140657953873920, 4096, 0, 11649929582494253312, 140657954357272}}, sa_flags = 2102239232, sa_restorer = 0x16}
        #5  0x00007fed7cdb9a0f in __sanitizer::Abort () at ../../../../src/libsanitizer/sanitizer_common/sanitizer_posix_libcdep.cpp:165
        No locals.
        #6  0x00007fed7cedfc2d in __sanitizer::Die () at ../../../../src/libsanitizer/sanitizer_common/sanitizer_termination.cpp:58
        No locals.
        #7  0x00007fed7ceb493c in __asan::ScopedInErrorReport::~ScopedInErrorReport (this=0x7ffcc804dba6) at ../../../../src/libsanitizer/asan/asan_report.cpp:221
                buffer_copy = {buffer_ = {<__sanitizer::InternalMmapVectorNoCtor<char, false>> = {data_ = 0x7fed7b602000 '=' <repeats 65 times>, "\n==52==ERROR: AddressSanitizer: heap-use-after-free on address 0x7d5d7aee040b at pc 0x7fed7ce69445 bp 0x7ffcc804f0a0 sp 0x7ffcc804e848\n"..., capacity_bytes_ = 4096, size_ = 3838}, <No data fields>}}
                buffer_copy = <optimized out>
                l = <optimized out>
        #8  0x00007fed7ceb3e02 in __asan::ReportGenericError (pc=140657979462725, bp=140723664253088, sp=sp@entry=140723664250952, addr=addr@entry=137840447849483, is_write=is_write@entry=false, access_size=6, fatal=false, exp=<optimized out>) at ../../../../src/libsanitizer/asan/asan_report.cpp:536
                in_report = {error_report_lock_ = {<No data fields>}, static current_error_ = {kind = __asan::kErrorKindGeneric, {Base = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000\201\3426;\335\254\241nal] orgp\346\004\310\374\177\000\000 \334\004\310\374\177\000\000.\034)|\355\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\240\344\004\310\374\177\000\000\211\375\037|\355\177\000\000\\\334\004\310\374\177\000\000\\\334\004\310\374\177\000\000\\\344\004\310\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\355\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, DeadlySignal = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000\201\3426;\335\254\241nal] orgp\346\004\310\374\177\000\000 \334\004\310\374\177\000\000.\034)|\355\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\240\344\004\310\374\177\000\000\211\375\037|\355\177\000\000\\\334\004\310\374\177\000\000\\\334\004\310\374\177\000\000\\\344\004\310\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\355\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, signal = {siginfo = 0xffffffff00000002, context = 0x7d5d7aee040b, addr = 0, pc = 0, sp = 11897059411519, bp = 137840447849483, is_memory_access = 11, write_flag = __sanitizer::SignalContext::Unknown, is_true_faulting_addr = false}}, DoubleFree = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000\201\3426;\335\254\241nal] orgp\346\004\310\374\177\000\000 \334\004\310\374\177\000\000.\034)|\355\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\240\344\004\310\374\177\000\000\211\375\037|\355\177\000\000\\\334\004\310\374\177\000\000\\\334\004\310\374\177\000\000\\\344\004\310\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\355\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, second_free_stack = 0xffffffff00000002, addr_description = {addr = 137840447849483, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1599, free_stack_id = 2770, chunk_access = {bad_addr = 137840447849483, offset = 11, chunk_begin = 137840447849472, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}}, NewDeleteTypeMismatch = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000\201\3426;\335\254\241nal] orgp\346\004\310\374\177\000\000 \334\004\310\374\177\000\000.\034)|\355\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\240\344\004\310\374\177\000\000\211\375\037|\355\177\000\000\\\334\004\310\374\177\000\000\\\334\004\310\374\177\000\000\\\344\004\310\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\355\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, free_stack = 0xffffffff00000002, addr_description = {addr = 137840447849483, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1599, free_stack_id = 2770, chunk_access = {bad_addr = 137840447849483, offset = 11, chunk_begin = 137840447849472, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, delete_size = 136259881312544, delete_alignment = 140723664248880}, FreeNotMalloced = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000\201\3426;\335\254\241nal] orgp\346\004\310\374\177\000\000 \334\004\310\374\177\000\000.\034)|\355\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\240\344\004\310\374\177\000\000\211\375\037|\355\177\000\000\\\334\004\310\374\177\000\000\\\334\004\310\374\177\000\000\\\344\004\310\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\355\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, free_stack = 0xffffffff00000002, addr_description = {data = {kind = 2062418955, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11897059411519, alloc_stack_id = 2062418955, free_stack_id = 32093, chunk_access = {bad_addr = 11, offset = 137840447849472, chunk_begin = 752, chunk_size = 140723664216072, user_requested_alignment = 288, access_type = 2, alloc_type = 2}}, stack = {addr = 0, tid = 0, offset = 11897059411519, frame_pc = 137840447849483, access_size = 11, frame_descr = 0x7d5d7aee0400 "\322\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11897059411519, size_with_redzone = 137840447849483, name = 0xb <error: Cannot access memory at address 0xb>, module_name = 0x7d5d7aee0400 "\322\n", has_dynamic_init = 752, gcc_location = 0x7ffcc8046008, odr_indicator = 136259881312544}, {beg = 140723664248880, size = 140657978759967, size_with_redzone = 1, name = 0x7bed79d2a120 " t\365zM|", module_name = 0x7ffcc804e880 "\220\350\004\310\374\177", has_dynamic_init = 140657979717074, gcc_location = 0x7fed7b69d0d0, odr_indicator = 132204781712}, {beg = 140723664248928, size = 3, size_with_redzone = 140657979717136, name = 0x7fed7c1ffb8f <__vasprintf_internal+255> "I\211\004$H\205\300t(H\213\265\330\376\377\377L\211\352H\211\307\350\366\032\371\377H\211\301\353\212\350\254\346\n", module_name = 0x55b8d9c1e3db <bt_log_vprintf+171> "\205\300\017\210=\001", has_dynamic_init = 140723664251712, gcc_location = 0x7ffcc804e120, odr_indicator = 2}, {beg = 140657980432320, size = 136672217232208, size_with_redzone = 140723664249072, name = 0x7fed7cdc3738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", module_name = 0x3e <error: Cannot access memory at address 0x3e>, has_dynamic_init = 136672217232208, gcc_location = 0x7fed7b69d0d0, odr_indicator = 140723664249104}}, reg_sites = {2062906208, 31821, 81, 0}, access_size = 140723664251264, size = 69 'E'}, wild = {addr = 0, access_size = 0}}}}}, AllocTypeMismatch = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000\201\3426;\335\254\241nal] orgp\346\004\310\374\177\000\000 \334\004\310\374\177\000\000.\034)|\355\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\240\344\004\310\374\177\000\000\211\375\037|\355\177\000\000\\\334\004\310\374\177\000\000\\\334\004\310\374\177\000\000\\\344\004\310\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\355\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, dealloc_stack = 0xffffffff00000002, alloc_type = 2062418955, dealloc_type = 32093, addr_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 0, kind = (__asan::kShadowKindGap | __asan::kShadowKindHigh | unknown: 0x3c), shadow_byte = 6 '\006'}, heap = {addr = 0, alloc_tid = 11897059411519, free_tid = 137840447849483, alloc_stack_id = 11, free_stack_id = 0, chunk_access = {bad_addr = 137840447849472, offset = 752, chunk_begin = 140723664216072, chunk_size = 136259881312544, user_requested_alignment = 48, access_type = 2, alloc_type = 3}}, stack = {addr = 0, tid = 11897059411519, offset = 137840447849483, frame_pc = 11, access_size = 137840447849472, frame_descr = 0x2f0 <error: Cannot access memory at address 0x2f0>}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 11897059411519, size = 137840447849483, size_with_redzone = 11, name = 0x7d5d7aee0400 "\322\n", module_name = 0x2f0 <error: Cannot access memory at address 0x2f0>, has_dynamic_init = 140723664216072, gcc_location = 0x7bed79d2a120, odr_indicator = 140723664248880}, {beg = 140657978759967, size = 1, size_with_redzone = 136259881312544, name = 0x7ffcc804e880 "\220\350\004\310\374\177", module_name = 0x7fed7cea75d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", has_dynamic_init = 140657954509008, gcc_location = 0x1ec804e090, odr_indicator = 140723664248928}, {beg = 3, size = 140657979717136, size_with_redzone = 140657966447503, name = 0x55b8d9c1e3db <bt_log_vprintf+171> "\205\300\017\210=\001", module_name = 0x7ffcc804eb40 "\344\354\004\310\374\177", has_dynamic_init = 140723664249120, gcc_location = 0x2, odr_indicator = 140657980432320}, {beg = 136672217232208, size = 140723664249072, size_with_redzone = 140657978783544, name = 0x3e <error: Cannot access memory at address 0x3e>, module_name = 0x7c4d7af57350 "\003\021", has_dynamic_init = 140657954509008, gcc_location = 0x7ffcc804e110, odr_indicator = 136672217232224}}, reg_sites = {81, 0, 3355765120, 32764}, access_size = 140657979462725, size = 160 '\240'}, wild = {addr = 0, access_size = 11897059411519}}}}}, MallocUsableSizeNotOwned = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000\201\3426;\335\254\241nal] orgp\346\004\310\374\177\000\000 \334\004\310\374\177\000\000.\034)|\355\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\240\344\004\310\374\177\000\000\211\375\037|\355\177\000\000\\\334\004\310\374\177\000\000\\\334\004\310\374\177\000\000\\\344\004\310\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\355\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, addr_description = {data = {kind = 2062418955, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11897059411519, alloc_stack_id = 2062418955, free_stack_id = 32093, chunk_access = {bad_addr = 11, offset = 137840447849472, chunk_begin = 752, chunk_size = 140723664216072, user_requested_alignment = 288, access_type = 2, alloc_type = 2}}, stack = {addr = 0, tid = 0, offset = 11897059411519, frame_pc = 137840447849483, access_size = 11, frame_descr = 0x7d5d7aee0400 "\322\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11897059411519, size_with_redzone = 137840447849483, name = 0xb <error: Cannot access memory at address 0xb>, module_name = 0x7d5d7aee0400 "\322\n", has_dynamic_init = 752, gcc_location = 0x7ffcc8046008, odr_indicator = 136259881312544}, {beg = 140723664248880, size = 140657978759967, size_with_redzone = 1, name = 0x7bed79d2a120 " t\365zM|", module_name = 0x7ffcc804e880 "\220\350\004\310\374\177", has_dynamic_init = 140657979717074, gcc_location = 0x7fed7b69d0d0, odr_indicator = 132204781712}, {beg = 140723664248928, size = 3, size_with_redzone = 140657979717136, name = 0x7fed7c1ffb8f <__vasprintf_internal+255> "I\211\004$H\205\300t(H\213\265\330\376\377\377L\211\352H\211\307\350\366\032\371\377H\211\301\353\212\350\254\346\n", module_name = 0x55b8d9c1e3db <bt_log_vprintf+171> "\205\300\017\210=\001", has_dynamic_init = 140723664251712, gcc_location = 0x7ffcc804e120, odr_indicator = 2}, {beg = 140657980432320, size = 136672217232208, size_with_redzone = 140723664249072, name = 0x7fed7cdc3738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", module_name = 0x3e <error: Cannot access memory at address 0x3e>, has_dynamic_init = 136672217232208, gcc_location = 0x7fed7b69d0d0, odr_indicator = 140723664249104}}, reg_sites = {2062906208, 31821, 81, 0}, access_size = 140723664251264, size = 69 'E'}, wild = {addr = 0, access_size = 0}}}}}, SanitizerGetAllocatedSizeNotOwned = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000\201\3426;\335\254\241nal] orgp\346\004\310\374\177\000\000 \334\004\310\374\177\000\000.\034)|\355\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\240\344\004\310\374\177\000\000\211\375\037|\355\177\000\000\\\334\004\310\374\177\000\000\\\334\004\310\374\177\000\000\\\344\004\310\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\355\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, addr_description = {data = {kind = 2062418955, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11897059411519, alloc_stack_id = 2062418955, free_stack_id = 32093, chunk_access = {bad_addr = 11, offset = 137840447849472, chunk_begin = 752, chunk_size = 140723664216072, user_requested_alignment = 288, access_type = 2, alloc_type = 2}}, stack = {addr = 0, tid = 0, offset = 11897059411519, frame_pc = 137840447849483, access_size = 11, frame_descr = 0x7d5d7aee0400 "\322\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11897059411519, size_with_redzone = 137840447849483, name = 0xb <error: Cannot access memory at address 0xb>, module_name = 0x7d5d7aee0400 "\322\n", has_dynamic_init = 752, gcc_location = 0x7ffcc8046008, odr_indicator = 136259881312544}, {beg = 140723664248880, size = 140657978759967, size_with_redzone = 1, name = 0x7bed79d2a120 " t\365zM|", module_name = 0x7ffcc804e880 "\220\350\004\310\374\177", has_dynamic_init = 140657979717074, gcc_location = 0x7fed7b69d0d0, odr_indicator = 132204781712}, {beg = 140723664248928, size = 3, size_with_redzone = 140657979717136, name = 0x7fed7c1ffb8f <__vasprintf_internal+255> "I\211\004$H\205\300t(H\213\265\330\376\377\377L\211\352H\211\307\350\366\032\371\377H\211\301\353\212\350\254\346\n", module_name = 0x55b8d9c1e3db <bt_log_vprintf+171> "\205\300\017\210=\001", has_dynamic_init = 140723664251712, gcc_location = 0x7ffcc804e120, odr_indicator = 2}, {beg = 140657980432320, size = 136672217232208, size_with_redzone = 140723664249072, name = 0x7fed7cdc3738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", module_name = 0x3e <error: Cannot access memory at address 0x3e>, has_dynamic_init = 136672217232208, gcc_location = 0x7fed7b69d0d0, odr_indicator = 140723664249104}}, reg_sites = {2062906208, 31821, 81, 0}, access_size = 140723664251264, size = 69 'E'}, wild = {addr = 0, access_size = 0}}}}}, CallocOverflow = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000\201\3426;\335\254\241nal] orgp\346\004\310\374\177\000\000 \334\004\310\374\177\000\000.\034)|\355\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\240\344\004\310\374\177\000\000\211\375\037|\355\177\000\000\\\334\004\310\374\177\000\000\\\334\004\310\374\177\000\000\\\344\004\310\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\355\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, count = 137840447849483, size = 0}, ReallocArrayOverflow = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000\201\3426;\335\254\241nal] orgp\346\004\310\374\177\000\000 \334\004\310\374\177\000\000.\034)|\355\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\240\344\004\310\374\177\000\000\211\375\037|\355\177\000\000\\\334\004\310\374\177\000\000\\\334\004\310\374\177\000\000\\\344\004\310\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\355\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, count = 137840447849483, size = 0}, PvallocOverflow = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000\201\3426;\335\254\241nal] orgp\346\004\310\374\177\000\000 \334\004\310\374\177\000\000.\034)|\355\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\240\344\004\310\374\177\000\000\211\375\037|\355\177\000\000\\\334\004\310\374\177\000\000\\\334\004\310\374\177\000\000\\\344\004\310\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\355\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, size = 137840447849483}, InvalidAllocationAlignment = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000\201\3426;\335\254\241nal] orgp\346\004\310\374\177\000\000 \334\004\310\374\177\000\000.\034)|\355\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\240\344\004\310\374\177\000\000\211\375\037|\355\177\000\000\\\334\004\310\374\177\000\000\\\334\004\310\374\177\000\000\\\344\004\310\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\355\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, alignment = 137840447849483}, InvalidAlignedAllocAlignment = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000\201\3426;\335\254\241nal] orgp\346\004\310\374\177\000\000 \334\004\310\374\177\000\000.\034)|\355\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\240\344\004\310\374\177\000\000\211\375\037|\355\177\000\000\\\334\004\310\374\177\000\000\\\334\004\310\374\177\000\000\\\344\004\310\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\355\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, size = 137840447849483, alignment = 0}, InvalidPosixMemalignAlignment = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000\201\3426;\335\254\241nal] orgp\346\004\310\374\177\000\000 \334\004\310\374\177\000\000.\034)|\355\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\240\344\004\310\374\177\000\000\211\375\037|\355\177\000\000\\\334\004\310\374\177\000\000\\\334\004\310\374\177\000\000\\\344\004\310\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\355\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, alignment = 137840447849483}, AllocationSizeTooBig = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000\201\3426;\335\254\241nal] orgp\346\004\310\374\177\000\000 \334\004\310\374\177\000\000.\034)|\355\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\240\344\004\310\374\177\000\000\211\375\037|\355\177\000\000\\\334\004\310\374\177\000\000\\\334\004\310\374\177\000\000\\\344\004\310\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\355\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, user_size = 137840447849483, total_size = 0, max_size = 0}, RssLimitExceeded = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000\201\3426;\335\254\241nal] orgp\346\004\310\374\177\000\000 \334\004\310\374\177\000\000.\034)|\355\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\240\344\004\310\374\177\000\000\211\375\037|\355\177\000\000\\\334\004\310\374\177\000\000\\\334\004\310\374\177\000\000\\\344\004\310\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\355\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002}, OutOfMemory = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000\201\3426;\335\254\241nal] orgp\346\004\310\374\177\000\000 \334\004\310\374\177\000\000.\034)|\355\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\240\344\004\310\374\177\000\000\211\375\037|\355\177\000\000\\\334\004\310\374\177\000\000\\\334\004\310\374\177\000\000\\\344\004\310\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\355\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, requested_size = 137840447849483}, StringFunctionMemoryRangesOverlap = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000\201\3426;\335\254\241nal] orgp\346\004\310\374\177\000\000 \334\004\310\374\177\000\000.\034)|\355\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\240\344\004\310\374\177\000\000\211\375\037|\355\177\000\000\\\334\004\310\374\177\000\000\\\334\004\310\374\177\000\000\\\344\004\310\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\355\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, length1 = 137840447849483, length2 = 0, addr1_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 11897059411519, kind = (__asan::kShadowKindGap | __asan::kShadowKindHigh | unknown: 0x8), shadow_byte = 4 '\004'}, heap = {addr = 11897059411519, alloc_tid = 137840447849483, free_tid = 11, alloc_stack_id = 2062418944, free_stack_id = 32093, chunk_access = {bad_addr = 752, offset = 140723664216072, chunk_begin = 136259881312544, chunk_size = 140723664248880, user_requested_alignment = 2847, access_type = 1, alloc_type = 3}}, stack = {addr = 11897059411519, tid = 137840447849483, offset = 11, frame_pc = 137840447849472, access_size = 752, frame_descr = 0x7ffcc8046008 ""}, global = {addr = 11897059411519, static kMaxGlobals = 4, globals = {{beg = 137840447849483, size = 11, size_with_redzone = 137840447849472, name = 0x2f0 <error: Cannot access memory at address 0x2f0>, module_name = 0x7ffcc8046008 "", has_dynamic_init = 136259881312544, gcc_location = 0x7ffcc804e030, odr_indicator = 140657978759967}, {beg = 1, size = 136259881312544, size_with_redzone = 140723664251008, name = 0x7fed7cea75d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", module_name = 0x7fed7b69d0d0 "", has_dynamic_init = 132204781712, gcc_location = 0x7ffcc804e060, odr_indicator = 3}, {beg = 140657979717136, size = 140657966447503, size_with_redzone = 94252415706075, name = 0x7ffcc804eb40 "\344\354\004\310\374\177", module_name = 0x7ffcc804e120 "\030", has_dynamic_init = 2, gcc_location = 0x7fed7cf55fc0 <__asan::instance>, odr_indicator = 136672217232208}, {beg = 140723664249072, size = 140657978783544, size_with_redzone = 62, name = 0x7c4d7af57350 "\003\021", module_name = 0x7fed7b69d0d0 "", has_dynamic_init = 140723664249104, gcc_location = 0x7c4d7af57360, odr_indicator = 81}}, reg_sites = {3355765120, 32764, 2095486021, 32749}, access_size = 140723664253088, size = 72 'H'}, wild = {addr = 11897059411519, access_size = 137840447849483}}}}, addr2_description = {data = {kind = 6, {shadow = {addr = 140657980143511, kind = __asan::kShadowKindLow, shadow_byte = 253 '\375'}, heap = {addr = 140657980143511, alloc_tid = 140657980472576, free_tid = 140723664252640, alloc_stack_id = 2095740370, free_stack_id = 32749, chunk_access = {bad_addr = 8315162673665959470, offset = 130735371371, chunk_begin = 140723664250560, chunk_size = 3, user_requested_alignment = 1552, access_type = 3, alloc_type = 1}}, stack = {addr = 140657980143511, tid = 140657980472576, offset = 140723664252640, frame_pc = 140657979717074, access_size = 8315162673665959470, frame_descr = 0x1e706f746b <error: Cannot access memory at address 0x1e706f746b>}, global = {addr = 140657980143511, static kMaxGlobals = 4, globals = {{beg = 140657980472576, size = 140723664252640, size_with_redzone = 140657979717074, name = 0x736564656572662e <error: Cannot access memory at address 0x736564656572662e>, module_name = 0x1e706f746b <error: Cannot access memory at address 0x1e706f746b>, has_dynamic_init = 140723664250560, gcc_location = 0x3, odr_indicator = 140657979717136}, {beg = 140657966447503, size = 94252415706075, size_with_redzone = 140723664253344, name = 0x7ffcc804e740 "`\347\004\310\374\177", module_name = 0x7fed7cf4ff78 "\001", has_dynamic_init = 140723664250752, gcc_location = 0x55b8d9d5e5a0, odr_indicator = 140657958402232}, {beg = 65535, size = 140723664250672, size_with_redzone = 140657979548505, name = 0x40 <error: Cannot access memory at address 0x40>, module_name = 0x7bed79f56a00 "\0166\340E", has_dynamic_init = 140723664250720, gcc_location = 0x7fed7cdca74a <__asan_stack_malloc_0(__sanitizer::uptr)+234>, odr_indicator = 140723664250720}, {beg = 140657979973501, size = 140723664250752, size_with_redzone = 140657979817318, name = 0x7ffcc804e800 "", module_name = 0x2 <error: Cannot access memory at address 0x2>, has_dynamic_init = 140657980432320, gcc_location = 0x7c2d7af4d1c0, odr_indicator = 140723664250832}}, reg_sites = {2094806840, 32749, 40, 0}, access_size = 140657979922973, size = 208 '\320'}, wild = {addr = 140657980143511, access_size = 140657980472576}}}}, function = 0x7ffcc804e7f0 "\240\360\004\310\374\177"}, StringFunctionSizeOverflow = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000\201\3426;\335\254\241nal] orgp\346\004\310\374\177\000\000 \334\004\310\374\177\000\000.\034)|\355\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\240\344\004\310\374\177\000\000\211\375\037|\355\177\000\000\\\334\004\310\374\177\000\000\\\334\004\310\374\177\000\000\\\344\004\310\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\355\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, addr_description = {data = {kind = 2062418955, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11897059411519, alloc_stack_id = 2062418955, free_stack_id = 32093, chunk_access = {bad_addr = 11, offset = 137840447849472, chunk_begin = 752, chunk_size = 140723664216072, user_requested_alignment = 288, access_type = 2, alloc_type = 2}}, stack = {addr = 0, tid = 0, offset = 11897059411519, frame_pc = 137840447849483, access_size = 11, frame_descr = 0x7d5d7aee0400 "\322\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11897059411519, size_with_redzone = 137840447849483, name = 0xb <error: Cannot access memory at address 0xb>, module_name = 0x7d5d7aee0400 "\322\n", has_dynamic_init = 752, gcc_location = 0x7ffcc8046008, odr_indicator = 136259881312544}, {beg = 140723664248880, size = 140657978759967, size_with_redzone = 1, name = 0x7bed79d2a120 " t\365zM|", module_name = 0x7ffcc804e880 "\220\350\004\310\374\177", has_dynamic_init = 140657979717074, gcc_location = 0x7fed7b69d0d0, odr_indicator = 132204781712}, {beg = 140723664248928, size = 3, size_with_redzone = 140657979717136, name = 0x7fed7c1ffb8f <__vasprintf_internal+255> "I\211\004$H\205\300t(H\213\265\330\376\377\377L\211\352H\211\307\350\366\032\371\377H\211\301\353\212\350\254\346\n", module_name = 0x55b8d9c1e3db <bt_log_vprintf+171> "\205\300\017\210=\001", has_dynamic_init = 140723664251712, gcc_location = 0x7ffcc804e120, odr_indicator = 2}, {beg = 140657980432320, size = 136672217232208, size_with_redzone = 140723664249072, name = 0x7fed7cdc3738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", module_name = 0x3e <error: Cannot access memory at address 0x3e>, has_dynamic_init = 136672217232208, gcc_location = 0x7fed7b69d0d0, odr_indicator = 140723664249104}}, reg_sites = {2062906208, 31821, 81, 0}, access_size = 140723664251264, size = 69 'E'}, wild = {addr = 0, access_size = 0}}}}, size = 140723664253088}, BadParamsToAnnotateContiguousContainer = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000\201\3426;\335\254\241nal] orgp\346\004\310\374\177\000\000 \334\004\310\374\177\000\000.\034)|\355\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\240\344\004\310\374\177\000\000\211\375\037|\355\177\000\000\\\334\004\310\374\177\000\000\\\334\004\310\374\177\000\000\\\344\004\310\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\355\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, beg = 137840447849483, end = 0, old_mid = 0, new_mid = 11897059411519}, BadParamsToAnnotateDoubleEndedContiguousContainer = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000\201\3426;\335\254\241nal] orgp\346\004\310\374\177\000\000 \334\004\310\374\177\000\000.\034)|\355\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\240\344\004\310\374\177\000\000\211\375\037|\355\177\000\000\\\334\004\310\374\177\000\000\\\334\004\310\374\177\000\000\\\344\004\310\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\355\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, storage_beg = 137840447849483, storage_end = 0, old_container_beg = 0, old_container_end = 11897059411519, new_container_beg = 137840447849483, new_container_end = 11}, BadParamsToCopyContiguousContainerAnnotations = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000\201\3426;\335\254\241nal] orgp\346\004\310\374\177\000\000 \334\004\310\374\177\000\000.\034)|\355\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\240\344\004\310\374\177\000\000\211\375\037|\355\177\000\000\\\334\004\310\374\177\000\000\\\334\004\310\374\177\000\000\\\344\004\310\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\355\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, old_storage_beg = 137840447849483, old_storage_end = 0, new_storage_beg = 0, new_storage_end = 11897059411519}, ODRViolation = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000\201\3426;\335\254\241nal] orgp\346\004\310\374\177\000\000 \334\004\310\374\177\000\000.\034)|\355\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\240\344\004\310\374\177\000\000\211\375\037|\355\177\000\000\\\334\004\310\374\177\000\000\\\334\004\310\374\177\000\000\\\344\004\310\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\355\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, global1 = {beg = 18446744069414584322, size = 137840447849483, size_with_redzone = 0, name = 0x0, module_name = 0xad20000063f <error: Cannot access memory at address 0xad20000063f>, has_dynamic_init = 137840447849483, gcc_location = 0xb, odr_indicator = 137840447849472}, global2 = {beg = 752, size = 140723664216072, size_with_redzone = 136259881312544, name = 0x7ffcc804e030 "\200\350\004\310\374\177", module_name = 0x7fed7cdbdb1f <__asan::asan_malloc(unsigned long, __sanitizer::BufferedStackTrace*)+47> "H\205\300t\f\311\303f.\017\037\204", has_dynamic_init = 1, gcc_location = 0x7bed79d2a120, odr_indicator = 140723664251008}, stack_id1 = 2095740370, stack_id2 = 32749}, InvalidPointerPair = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000\201\3426;\335\254\241nal] orgp\346\004\310\374\177\000\000 \334\004\310\374\177\000\000.\034)|\355\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\240\344\004\310\374\177\000\000\211\375\037|\355\177\000\000\\\334\004\310\374\177\000\000\\\334\004\310\374\177\000\000\\\344\004\310\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\355\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, pc = 18446744069414584322, bp = 137840447849483, sp = 0, addr1_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 11897059411519, kind = (__asan::kShadowKindGap | __asan::kShadowKindHigh | unknown: 0x8), shadow_byte = 4 '\004'}, heap = {addr = 11897059411519, alloc_tid = 137840447849483, free_tid = 11, alloc_stack_id = 2062418944, free_stack_id = 32093, chunk_access = {bad_addr = 752, offset = 140723664216072, chunk_begin = 136259881312544, chunk_size = 140723664248880, user_requested_alignment = 2847, access_type = 1, alloc_type = 3}}, stack = {addr = 11897059411519, tid = 137840447849483, offset = 11, frame_pc = 137840447849472, access_size = 752, frame_descr = 0x7ffcc8046008 ""}, global = {addr = 11897059411519, static kMaxGlobals = 4, globals = {{beg = 137840447849483, size = 11, size_with_redzone = 137840447849472, name = 0x2f0 <error: Cannot access memory at address 0x2f0>, module_name = 0x7ffcc8046008 "", has_dynamic_init = 136259881312544, gcc_location = 0x7ffcc804e030, odr_indicator = 140657978759967}, {beg = 1, size = 136259881312544, size_with_redzone = 140723664251008, name = 0x7fed7cea75d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", module_name = 0x7fed7b69d0d0 "", has_dynamic_init = 132204781712, gcc_location = 0x7ffcc804e060, odr_indicator = 3}, {beg = 140657979717136, size = 140657966447503, size_with_redzone = 94252415706075, name = 0x7ffcc804eb40 "\344\354\004\310\374\177", module_name = 0x7ffcc804e120 "\030", has_dynamic_init = 2, gcc_location = 0x7fed7cf55fc0 <__asan::instance>, odr_indicator = 136672217232208}, {beg = 140723664249072, size = 140657978783544, size_with_redzone = 62, name = 0x7c4d7af57350 "\003\021", module_name = 0x7fed7b69d0d0 "", has_dynamic_init = 140723664249104, gcc_location = 0x7c4d7af57360, odr_indicator = 81}}, reg_sites = {3355765120, 32764, 2095486021, 32749}, access_size = 140723664253088, size = 72 'H'}, wild = {addr = 11897059411519, access_size = 137840447849483}}}}, addr2_description = {data = {kind = 6, {shadow = {addr = 140657980143511, kind = __asan::kShadowKindLow, shadow_byte = 253 '\375'}, heap = {addr = 140657980143511, alloc_tid = 140657980472576, free_tid = 140723664252640, alloc_stack_id = 2095740370, free_stack_id = 32749, chunk_access = {bad_addr = 8315162673665959470, offset = 130735371371, chunk_begin = 140723664250560, chunk_size = 3, user_requested_alignment = 1552, access_type = 3, alloc_type = 1}}, stack = {addr = 140657980143511, tid = 140657980472576, offset = 140723664252640, frame_pc = 140657979717074, access_size = 8315162673665959470, frame_descr = 0x1e706f746b <error: Cannot access memory at address 0x1e706f746b>}, global = {addr = 140657980143511, static kMaxGlobals = 4, globals = {{beg = 140657980472576, size = 140723664252640, size_with_redzone = 140657979717074, name = 0x736564656572662e <error: Cannot access memory at address 0x736564656572662e>, module_name = 0x1e706f746b <error: Cannot access memory at address 0x1e706f746b>, has_dynamic_init = 140723664250560, gcc_location = 0x3, odr_indicator = 140657979717136}, {beg = 140657966447503, size = 94252415706075, size_with_redzone = 140723664253344, name = 0x7ffcc804e740 "`\347\004\310\374\177", module_name = 0x7fed7cf4ff78 "\001", has_dynamic_init = 140723664250752, gcc_location = 0x55b8d9d5e5a0, odr_indicator = 140657958402232}, {beg = 65535, size = 140723664250672, size_with_redzone = 140657979548505, name = 0x40 <error: Cannot access memory at address 0x40>, module_name = 0x7bed79f56a00 "\0166\340E", has_dynamic_init = 140723664250720, gcc_location = 0x7fed7cdca74a <__asan_stack_malloc_0(__sanitizer::uptr)+234>, odr_indicator = 140723664250720}, {beg = 140657979973501, size = 140723664250752, size_with_redzone = 140657979817318, name = 0x7ffcc804e800 "", module_name = 0x2 <error: Cannot access memory at address 0x2>, has_dynamic_init = 140657980432320, gcc_location = 0x7c2d7af4d1c0, odr_indicator = 140723664250832}}, reg_sites = {2094806840, 32749, 40, 0}, access_size = 140657979922973, size = 208 '\320'}, wild = {addr = 140657980143511, access_size = 140657980472576}}}}}, Generic = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000\201\3426;\335\254\241nal] orgp\346\004\310\374\177\000\000 \334\004\310\374\177\000\000.\034)|\355\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\240\344\004\310\374\177\000\000\211\375\037|\355\177\000\000\\\334\004\310\374\177\000\000\\\334\004\310\374\177\000\000\\\344\004\310\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\355\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, addr_description = {data = {kind = __asan::kAddressKindHeap, {shadow = {addr = 137840447849483, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 137840447849483, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1599, free_stack_id = 2770, chunk_access = {bad_addr = 137840447849483, offset = 11, chunk_begin = 137840447849472, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, stack = {addr = 137840447849483, tid = 0, offset = 0, frame_pc = 11897059411519, access_size = 137840447849483, frame_descr = 0xb <error: Cannot access memory at address 0xb>}, global = {addr = 137840447849483, static kMaxGlobals = 4, globals = {{beg = 0, size = 0, size_with_redzone = 11897059411519, name = 0x7d5d7aee040b "B", module_name = 0xb <error: Cannot access memory at address 0xb>, has_dynamic_init = 137840447849472, gcc_location = 0x2f0, odr_indicator = 140723664216072}, {beg = 136259881312544, size = 140723664248880, size_with_redzone = 140657978759967, name = 0x1 <error: Cannot access memory at address 0x1>, module_name = 0x7bed79d2a120 " t\365zM|", has_dynamic_init = 140723664251008, gcc_location = 0x7fed7cea75d2 <___interceptor_malloc(__sanitizer::uptr)+130>, odr_indicator = 140657954509008}, {beg = 132204781712, size = 140723664248928, size_with_redzone = 3, name = 0x7fed7cea7610 <___interceptor_malloc(__sanitizer::uptr)+192> "D\213\215\314\367\377\377E\205\311tTH\211m\330A\203\371\001t*E\017\276\3061\311H\211\352H\211\306H\215\275\320\367\377\377\350\"\004\001", module_name = 0x7fed7c1ffb8f <__vasprintf_internal+255> "I\211\004$H\205\300t(H\213\265\330\376\377\377L\211\352H\211\307\350\366\032\371\377H\211\301\353\212\350\254\346\n", has_dynamic_init = 94252415706075, gcc_location = 0x7ffcc804eb40, odr_indicator = 140723664249120}, {beg = 2, size = 140657980432320, size_with_redzone = 136672217232208, name = 0x7ffcc804e0f0 "\240\360\004\310\374\177", module_name = 0x7fed7cdc3738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", has_dynamic_init = 62, gcc_location = 0x7c4d7af57350, odr_indicator = 140657954509008}}, reg_sites = {3355762960, 32764, 2062906208, 31821}, access_size = 81, size = 128 '\200'}, wild = {addr = 137840447849483, access_size = 0}}}}, pc = 140657979462725, bp = 140723664253088, sp = 140723664250952, access_size = 6, bug_descr = 0x7fed7cf0f797 "heap-use-after-free", is_write = false, shadow_val = 253 '\375'}}}, halt_on_error_ = true}
                error = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000\201\3426;\335\254\241nal] orgp\346\004\310\374\177\000\000 \334\004\310\374\177\000\000.\034)|\355\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\240\344\004\310\374\177\000\000\211\375\037|\355\177\000\000\\\334\004\310\374\177\000\000\\\334\004\310\374\177\000\000\\\344\004\310\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\355\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, addr_description = {data = {kind = __asan::kAddressKindHeap, {shadow = {addr = 137840447849483, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 137840447849483, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1599, free_stack_id = 2770, chunk_access = {bad_addr = 137840447849483, offset = 11, chunk_begin = 137840447849472, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, stack = {addr = 137840447849483, tid = 0, offset = 0, frame_pc = 11897059411519, access_size = 137840447849483, frame_descr = 0xb <error: Cannot access memory at address 0xb>}, global = {addr = 137840447849483, static kMaxGlobals = 4, globals = {{beg = 0, size = 0, size_with_redzone = 11897059411519, name = 0x7d5d7aee040b "B", module_name = 0xb <error: Cannot access memory at address 0xb>, has_dynamic_init = 137840447849472, gcc_location = 0x2f0, odr_indicator = 140723664216072}, {beg = 136259881312544, size = 140723664248880, size_with_redzone = 140657978759967, name = 0x1 <error: Cannot access memory at address 0x1>, module_name = 0x7bed79d2a120 " t\365zM|", has_dynamic_init = 140723664251008, gcc_location = 0x7fed7cea75d2 <___interceptor_malloc(__sanitizer::uptr)+130>, odr_indicator = 140657954509008}, {beg = 132204781712, size = 140723664248928, size_with_redzone = 3, name = 0x7fed7cea7610 <___interceptor_malloc(__sanitizer::uptr)+192> "D\213\215\314\367\377\377E\205\311tTH\211m\330A\203\371\001t*E\017\276\3061\311H\211\352H\211\306H\215\275\320\367\377\377\350\"\004\001", module_name = 0x7fed7c1ffb8f <__vasprintf_internal+255> "I\211\004$H\205\300t(H\213\265\330\376\377\377L\211\352H\211\307\350\366\032\371\377H\211\301\353\212\350\254\346\n", has_dynamic_init = 94252415706075, gcc_location = 0x7ffcc804eb40, odr_indicator = 140723664249120}, {beg = 2, size = 140657980432320, size_with_redzone = 136672217232208, name = 0x7ffcc804e0f0 "\240\360\004\310\374\177", module_name = 0x7fed7cdc3738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", has_dynamic_init = 62, gcc_location = 0x7c4d7af57350, odr_indicator = 140657954509008}}, reg_sites = {3355762960, 32764, 2062906208, 31821}, access_size = 81, size = 128 '\200'}, wild = {addr = 137840447849483, access_size = 0}}}}, pc = 140657979462725, bp = 140723664253088, sp = 140723664250952, access_size = 6, bug_descr = 0x7fed7cf0f797 "heap-use-after-free", is_write = false, shadow_val = 253 '\375'}
        #9  0x00007fed7ceb3f8d in __asan::ReportGenericError (pc=<optimized out>, bp=bp@entry=140723664253088, sp=sp@entry=140723664250952, addr=addr@entry=137840447849483, is_write=is_write@entry=false, access_size=access_size@entry=6, exp=<optimized out>, fatal=false) at ../../../../src/libsanitizer/asan/asan_report.cpp:536
                in_report = <optimized out>
                error = <optimized out>
                enable_fp = <optimized out>
        #10 0x00007fed7ce69468 in MemcmpInterceptorCommon (ctx=ctx@entry=0x7ffcc804f0b0, real_fn=<optimized out>, a1=a1@entry=0x7d5d7aee040b, a2=a2@entry=0x7bed79c8aee0, size=size@entry=6) at ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:848
                bp = 140723664253088
                pc = <optimized out>
                local_stack = 137496850464832
                sp = 140723664250952
                _ctx = 0x7ffcc804f0b0
                suppressed = <optimized out>
                __offset = 137840447849483
                __size = 6
                __bad = <optimized out>
                result = <optimized out>
        #11 0x00007fed7ce69835 in ___interceptor_memcmp (a1=0x7d5d7aee040b, a2=0x7bed79c8aee0, size=6) at ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:880
                ctx = 0x7ffcc804f0b0
                _ctx = {interceptor_name = 0x7fed7cf136b6 "memcmp"}
        #12 ___interceptor_memcmp (a1=0x7d5d7aee040b, a2=0x7bed79c8aee0, size=6) at ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:875
                ctx = <optimized out>
                _ctx = <optimized out>
        #13 0x000055b8d9b01ea8 in bacmp (ba1=0x7d5d7aee040b, ba2=0x7bed79c8aee0) at ./lib/bluetooth/bluetooth.h:438
        No locals.
        #14 device_addr_type_cmp (a=0x7d5d7aee0400, b=0x7bed79c8aee0) at src/device.c:5640
                dev = 0x7d5d7aee0400
                addr = 0x7bed79c8aee0
                cmp = <optimized out>
        #15 0x00007fed7cbe34c2 in g_slist_find_custom () from /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
        No symbol table info available.
        #16 0x000055b8d9a81744 in btd_adapter_find_device (adapter=<optimized out>, dst=dst@entry=0x7c2d7af0edd8, bdaddr_type=1 '\001') at src/adapter.c:1055
                addr = <optimized out>
                device = <optimized out>
                list = <optimized out>
        #17 0x000055b8d9a23c57 in att_disconnected (err=<optimized out>, user_data=0x7c2d7af0edd0) at src/gatt-database.c:335
                state = 0x7c2d7af0edd0
                device = <optimized out>
                __func__ = "att_disconnected"
        #18 0x000055b8d9a3ab84 in btd_gatt_database_att_disconnected (database=<optimized out>, device=<optimized out>) at src/gatt-database.c:4238
                server = <optimized out>
                att = <optimized out>
                state = <optimized out>
                addr = <optimized out>
                type = <optimized out>
                __func__ = "btd_gatt_database_att_disconnected"
        #19 0x000055b8d9ae4066 in gatt_server_cleanup (device=device@entry=0x7d5d7aee0080) at src/device.c:842
        No locals.
        #20 0x000055b8d9af875c in attio_cleanup (device=0x7d5d7aee0080) at src/device.c:862
        No locals.
        #21 0x000055b8d9af8da7 in device_free (user_data=0x7d5d7aee0080) at src/device.c:918
                device = 0x7d5d7aee0080
                __func__ = "device_free"
        #22 0x000055b8d9b768aa in remove_interface (data=0x7c5d7aeeb000, name=name@entry=0x55b8d9d82a60 "org.bluez.Device1") at gdbus/object.c:742
                iface = 0x7c4d7aefe380
        #23 0x000055b8d9b7946c in g_dbus_unregister_interface (connection=<optimized out>, path=<optimized out>, name=<optimized out>) at gdbus/object.c:1499
                data = <optimized out>
        #24 0x000055b8d9ab4133 in adapter_remove (adapter=adapter@entry=0x7d1d7aee0200) at src/adapter.c:7307
                l = 0x7c0d7af0b410 = {0x7d5d7aee0080}
                db = <optimized out>
                ranging_manager = <optimized out>
                __func__ = "adapter_remove"
        #25 0x000055b8d9ab4cc8 in adapter_cleanup () at src/adapter.c:11262
                adapter = 0x7d1d7aee0200
        #26 0x000055b8d9866330 in main (argc=<optimized out>, argv=<optimized out>) at src/main.c:1723
                context = <optimized out>
                err = <optimized out>
                sdp_mtu = 0
                sdp_flags = <optimized out>
                gdbus_flags = <optimized out>
                __func__ = "main""
FAIL functional.test_bap::test_bap_unicast_set_transport_acquire[hosts8-vm3]: failed on setup with "pytest_bluezenv.rpc.RemoteTimeoutError: Connection recv timed out"
FAIL functional.test_bap::test_bap_unicast_set_transport_acquire[hosts8-vm3]: failed on teardown with "pytest_bluezenv.plugin.CoredumpWarning: Core dump: test-bluezenv-hosts8.0-bluetoothd-1789677843-69.core
        /usr/bin/gdb: warning: Couldn't determine a path for the index cache directory.
        [New LWP 69]
        [Thread debugging using libthread_db enabled]
        Using host libthread_db library "/usr/lib/x86_64-linux-gnu/libthread_db.so.1".
        Core was generated by `/home/runner/work/bluez/bluez/src/src/src/bluetoothd --nodetach -f /run/bluetoo'.
        Program terminated with signal SIGABRT, Aborted.
        #0  __pthread_kill_implementation (threadid=<optimized out>, signo=6, no_tid=0) at ./nptl/pthread_kill.c:44

        warning: 44	./nptl/pthread_kill.c: No such file or directory

        Thread 1 (Thread 0x7f7e72515900 (LWP 69)):
        #0  __pthread_kill_implementation (threadid=<optimized out>, signo=6, no_tid=0) at ./nptl/pthread_kill.c:44
                tid = <optimized out>
                ret = 0
                pd = <optimized out>
                old_mask = {__val = {4412750543122677053}}
                ret = <optimized out>
        #1  __pthread_kill_internal (threadid=<optimized out>, signo=6) at ./nptl/pthread_kill.c:89
        No locals.
        #2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ./nptl/pthread_kill.c:100
        No locals.
        #3  0x00007f7e72c70b7e in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
                ret = <optimized out>
        #4  0x00007f7e72c538ec in __GI_abort () at ./stdlib/abort.c:77
                act = {__sigaction_handler = {sa_handler = 0x0, sa_sigaction = 0x0}, sa_mask = {__val = {0, 0, 0, 140721378755696, 140721378755984, 140721378755840, 22, 140181065157584, 0, 140721378755776, 140181082002966, 140181052313600, 4096, 0, 15654653241169486080, 140181056495640}}, sa_flags = 1945747456, sa_restorer = 0x16}
        #5  0x00007f7e7387ba0f in __sanitizer::Abort () at ../../../../src/libsanitizer/sanitizer_common/sanitizer_posix_libcdep.cpp:165
        No locals.
        #6  0x00007f7e739a1c2d in __sanitizer::Die () at ../../../../src/libsanitizer/sanitizer_common/sanitizer_termination.cpp:58
        No locals.
        #7  0x00007f7e7397693c in __asan::ScopedInErrorReport::~ScopedInErrorReport (this=0x7ffc3fcb0636) at ../../../../src/libsanitizer/asan/asan_report.cpp:221
                buffer_copy = {buffer_ = {<__sanitizer::InternalMmapVectorNoCtor<char, false>> = {data_ = 0x7f7e71d2d000 '=' <repeats 65 times>, "\n==69==ERROR: AddressSanitizer: heap-use-after-free on address 0x7cee719e0208 at pc 0x55b14b880d0c bp 0x7ffc3fcb12b0 sp 0x7ffc3fcb12a0\n"..., capacity_bytes_ = 4096, size_ = 3419}, <No data fields>}}
                buffer_copy = <optimized out>
                l = <optimized out>
        #8  0x00007f7e73975e02 in __asan::ReportGenericError (pc=94219964779788, bp=140721378759344, sp=sp@entry=140721378759328, addr=137363550241288, is_write=is_write@entry=false, access_size=8, fatal=true, exp=<optimized out>) at ../../../../src/libsanitizer/asan/asan_report.cpp:536
                in_report = {error_report_lock_ = {<No data fields>}, static current_error_ = {kind = __asan::kErrorKindGeneric, {Base = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000~{\000\000\377\000\000\000\000\000\000\000\240w\265K\261U\000\000f\035\230s~\177\000\000 \a\313?\374\177\000\000\002\000\000\000\000\000\000\000\300\177\241s~\177\000\000\020\004\237q\376{\000\000\360\006\313?\374\177\000\0008W\210s~\177\000\000^\000\000\000\000\000\000\000\020\004\237q\376{\000\000\320\360\025r~\177\000\000\020\a\313?\374\177\000\000 \004\237q\376{\000\000q\000\000\000\000\000\000\000\200\017\313?\374\177\000\000^\000\000\000\000\000\000\000@\017\313?\374\177\000\000\301\203\226s~\177\000\000\"\232\256K\261U\000\000\270\377\377\377"...}, tid = 0}, DeadlySignal = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000~{\000\000\377\000\000\000\000\000\000\000\240w\265K\261U\000\000f\035\230s~\177\000\000 \a\313?\374\177\000\000\002\000\000\000\000\000\000\000\300\177\241s~\177\000\000\020\004\237q\376{\000\000\360\006\313?\374\177\000\0008W\210s~\177\000\000^\000\000\000\000\000\000\000\020\004\237q\376{\000\000\320\360\025r~\177\000\000\020\a\313?\374\177\000\000 \004\237q\376{\000\000q\000\000\000\000\000\000\000\200\017\313?\374\177\000\000^\000\000\000\000\000\000\000@\017\313?\374\177\000\000\301\203\226s~\177\000\000\"\232\256K\261U\000\000\270\377\377\377"...}, tid = 0}, signal = {siginfo = 0x7ffc00000002, context = 0x7cee719e0208, addr = 0, pc = 0, sp = 11098195494388, bp = 137363550241288, is_memory_access = 136, write_flag = __sanitizer::SignalContext::Unknown, is_true_faulting_addr = 128}}, DoubleFree = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000~{\000\000\377\000\000\000\000\000\000\000\240w\265K\261U\000\000f\035\230s~\177\000\000 \a\313?\374\177\000\000\002\000\000\000\000\000\000\000\300\177\241s~\177\000\000\020\004\237q\376{\000\000\360\006\313?\374\177\000\0008W\210s~\177\000\000^\000\000\000\000\000\000\000\020\004\237q\376{\000\000\320\360\025r~\177\000\000\020\a\313?\374\177\000\000 \004\237q\376{\000\000q\000\000\000\000\000\000\000\200\017\313?\374\177\000\000^\000\000\000\000\000\000\000@\017\313?\374\177\000\000\301\203\226s~\177\000\000\"\232\256K\261U\000\000\270\377\377\377"...}, tid = 0}, second_free_stack = 0x7ffc00000002, addr_description = {addr = 137363550241288, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1524, free_stack_id = 2584, chunk_access = {bad_addr = 137363550241288, offset = 392, chunk_begin = 137363550240896, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}}, NewDeleteTypeMismatch = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000~{\000\000\377\000\000\000\000\000\000\000\240w\265K\261U\000\000f\035\230s~\177\000\000 \a\313?\374\177\000\000\002\000\000\000\000\000\000\000\300\177\241s~\177\000\000\020\004\237q\376{\000\000\360\006\313?\374\177\000\0008W\210s~\177\000\000^\000\000\000\000\000\000\000\020\004\237q\376{\000\000\320\360\025r~\177\000\000\020\a\313?\374\177\000\000 \004\237q\376{\000\000q\000\000\000\000\000\000\000\200\017\313?\374\177\000\000^\000\000\000\000\000\000\000@\017\313?\374\177\000\000\301\203\226s~\177\000\000\"\232\256K\261U\000\000\270\377\377\377"...}, tid = 0}, free_stack = 0x7ffc00000002, addr_description = {addr = 137363550241288, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1524, free_stack_id = 2584, chunk_access = {bad_addr = 137363550241288, offset = 392, chunk_begin = 137363550240896, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, delete_size = 140181080898335, delete_alignment = 1}, FreeNotMalloced = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000~{\000\000\377\000\000\000\000\000\000\000\240w\265K\261U\000\000f\035\230s~\177\000\000 \a\313?\374\177\000\000\002\000\000\000\000\000\000\000\300\177\241s~\177\000\000\020\004\237q\376{\000\000\360\006\313?\374\177\000\0008W\210s~\177\000\000^\000\000\000\000\000\000\000\020\004\237q\376{\000\000\320\360\025r~\177\000\000\020\a\313?\374\177\000\000 \004\237q\376{\000\000q\000\000\000\000\000\000\000\200\017\313?\374\177\000\000^\000\000\000\000\000\000\000@\017\313?\374\177\000\000\301\203\226s~\177\000\000\"\232\256K\261U\000\000\270\377\377\377"...}, tid = 0}, free_stack = 0x7ffc00000002, addr_description = {data = {kind = 1906180616, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11098195494388, alloc_stack_id = 1906180616, free_stack_id = 31982, chunk_access = {bad_addr = 392, offset = 137363550240896, chunk_begin = 752, chunk_size = 140721378779144, user_requested_alignment = 2847, access_type = 3, alloc_type = 3}}, stack = {addr = 0, tid = 0, offset = 11098195494388, frame_pc = 137363550241288, access_size = 392, frame_descr = 0x7cee719e0080 "\030\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11098195494388, size_with_redzone = 137363550241288, name = 0x188 <error: Cannot access memory at address 0x188>, module_name = 0x7cee719e0080 "\030\n", has_dynamic_init = 752, gcc_location = 0x7ffc3fcb6008, odr_indicator = 140181080898335}, {beg = 1, size = 136607636162624, size_with_redzone = 140721378759424, name = 0x7f7e739695d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", module_name = 0x3 <error: Cannot access memory at address 0x3>, has_dynamic_init = 130763059200, gcc_location = 0x7ffc3fcb0ae0, odr_indicator = 2}, {beg = 140181081855504, size = 94219965338886, size_with_redzone = 140721378757520, name = 0x7 <error: Cannot access memory at address 0x7>, module_name = 0x7f7e73a17fc0 <__asan::instance> "", has_dynamic_init = 135920442302432, gcc_location = 0x7ffc3fcb0b60, odr_indicator = 140181081955686}, {beg = 140721378757568, size = 6, size_with_redzone = 140181082570688, name = 0x7c3e71a17a70 "\003\021", module_name = 0x7ffc3fcb0b90 "\b", has_dynamic_init = 140181080921912, gcc_location = 0x78, odr_indicator = 136607636224624}}, reg_sites = {1070271360, 32764, 1926574446, 32638}, access_size = 0, size = 12 '\f'}, wild = {addr = 0, access_size = 0}}}}}, AllocTypeMismatch = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000~{\000\000\377\000\000\000\000\000\000\000\240w\265K\261U\000\000f\035\230s~\177\000\000 \a\313?\374\177\000\000\002\000\000\000\000\000\000\000\300\177\241s~\177\000\000\020\004\237q\376{\000\000\360\006\313?\374\177\000\0008W\210s~\177\000\000^\000\000\000\000\000\000\000\020\004\237q\376{\000\000\320\360\025r~\177\000\000\020\a\313?\374\177\000\000 \004\237q\376{\000\000q\000\000\000\000\000\000\000\200\017\313?\374\177\000\000^\000\000\000\000\000\000\000@\017\313?\374\177\000\000\301\203\226s~\177\000\000\"\232\256K\261U\000\000\270\377\377\377"...}, tid = 0}, dealloc_stack = 0x7ffc00000002, alloc_type = 1906180616, dealloc_type = 31982, addr_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 0, kind = (unknown: 0xf4), shadow_byte = 5 '\005'}, heap = {addr = 0, alloc_tid = 11098195494388, free_tid = 137363550241288, alloc_stack_id = 392, free_stack_id = 0, chunk_access = {bad_addr = 137363550240896, offset = 752, chunk_begin = 140721378779144, chunk_size = 140181080898335, user_requested_alignment = 1, access_type = 0, alloc_type = 0}}, stack = {addr = 0, tid = 11098195494388, offset = 137363550241288, frame_pc = 392, access_size = 137363550240896, frame_descr = 0x2f0 <error: Cannot access memory at address 0x2f0>}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 11098195494388, size = 137363550241288, size_with_redzone = 392, name = 0x7cee719e0080 "\030\n", module_name = 0x2f0 <error: Cannot access memory at address 0x2f0>, has_dynamic_init = 140721378779144, gcc_location = 0x7f7e7387fb1f <__asan::asan_malloc(unsigned long, __sanitizer::BufferedStackTrace*)+47>, odr_indicator = 1}, {beg = 136607636162624, size = 140721378759424, size_with_redzone = 140181081855442, name = 0x3 <error: Cannot access memory at address 0x3>, module_name = 0x1e7215f000 <error: Cannot access memory at address 0x1e7215f000>, has_dynamic_init = 140721378757344, gcc_location = 0x2, odr_indicator = 140181081855504}, {beg = 94219965338886, size = 140721378757520, size_with_redzone = 7, name = 0x7f7e73a17fc0 <__asan::instance> "", module_name = 0x7b9e71ae5fe0 "\003\021", has_dynamic_init = 140721378757472, gcc_location = 0x7f7e73981d66 <__sanitizer::RunFreeHooks(void*)+86>, odr_indicator = 140721378757568}, {beg = 6, size = 140181082570688, size_with_redzone = 136607636224624, name = 0x7ffc3fcb0b90 "\b", module_name = 0x7f7e73885738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", has_dynamic_init = 120, gcc_location = 0x7c3e71a17a70, odr_indicator = 140721378757504}}, reg_sites = {1926574446, 32638, 0, 0}, access_size = 94219964779788, size = 176 '\260'}, wild = {addr = 0, access_size = 11098195494388}}}}}, MallocUsableSizeNotOwned = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000~{\000\000\377\000\000\000\000\000\000\000\240w\265K\261U\000\000f\035\230s~\177\000\000 \a\313?\374\177\000\000\002\000\000\000\000\000\000\000\300\177\241s~\177\000\000\020\004\237q\376{\000\000\360\006\313?\374\177\000\0008W\210s~\177\000\000^\000\000\000\000\000\000\000\020\004\237q\376{\000\000\320\360\025r~\177\000\000\020\a\313?\374\177\000\000 \004\237q\376{\000\000q\000\000\000\000\000\000\000\200\017\313?\374\177\000\000^\000\000\000\000\000\000\000@\017\313?\374\177\000\000\301\203\226s~\177\000\000\"\232\256K\261U\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffc00000002, addr_description = {data = {kind = 1906180616, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11098195494388, alloc_stack_id = 1906180616, free_stack_id = 31982, chunk_access = {bad_addr = 392, offset = 137363550240896, chunk_begin = 752, chunk_size = 140721378779144, user_requested_alignment = 2847, access_type = 3, alloc_type = 3}}, stack = {addr = 0, tid = 0, offset = 11098195494388, frame_pc = 137363550241288, access_size = 392, frame_descr = 0x7cee719e0080 "\030\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11098195494388, size_with_redzone = 137363550241288, name = 0x188 <error: Cannot access memory at address 0x188>, module_name = 0x7cee719e0080 "\030\n", has_dynamic_init = 752, gcc_location = 0x7ffc3fcb6008, odr_indicator = 140181080898335}, {beg = 1, size = 136607636162624, size_with_redzone = 140721378759424, name = 0x7f7e739695d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", module_name = 0x3 <error: Cannot access memory at address 0x3>, has_dynamic_init = 130763059200, gcc_location = 0x7ffc3fcb0ae0, odr_indicator = 2}, {beg = 140181081855504, size = 94219965338886, size_with_redzone = 140721378757520, name = 0x7 <error: Cannot access memory at address 0x7>, module_name = 0x7f7e73a17fc0 <__asan::instance> "", has_dynamic_init = 135920442302432, gcc_location = 0x7ffc3fcb0b60, odr_indicator = 140181081955686}, {beg = 140721378757568, size = 6, size_with_redzone = 140181082570688, name = 0x7c3e71a17a70 "\003\021", module_name = 0x7ffc3fcb0b90 "\b", has_dynamic_init = 140181080921912, gcc_location = 0x78, odr_indicator = 136607636224624}}, reg_sites = {1070271360, 32764, 1926574446, 32638}, access_size = 0, size = 12 '\f'}, wild = {addr = 0, access_size = 0}}}}}, SanitizerGetAllocatedSizeNotOwned = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000~{\000\000\377\000\000\000\000\000\000\000\240w\265K\261U\000\000f\035\230s~\177\000\000 \a\313?\374\177\000\000\002\000\000\000\000\000\000\000\300\177\241s~\177\000\000\020\004\237q\376{\000\000\360\006\313?\374\177\000\0008W\210s~\177\000\000^\000\000\000\000\000\000\000\020\004\237q\376{\000\000\320\360\025r~\177\000\000\020\a\313?\374\177\000\000 \004\237q\376{\000\000q\000\000\000\000\000\000\000\200\017\313?\374\177\000\000^\000\000\000\000\000\000\000@\017\313?\374\177\000\000\301\203\226s~\177\000\000\"\232\256K\261U\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffc00000002, addr_description = {data = {kind = 1906180616, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11098195494388, alloc_stack_id = 1906180616, free_stack_id = 31982, chunk_access = {bad_addr = 392, offset = 137363550240896, chunk_begin = 752, chunk_size = 140721378779144, user_requested_alignment = 2847, access_type = 3, alloc_type = 3}}, stack = {addr = 0, tid = 0, offset = 11098195494388, frame_pc = 137363550241288, access_size = 392, frame_descr = 0x7cee719e0080 "\030\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11098195494388, size_with_redzone = 137363550241288, name = 0x188 <error: Cannot access memory at address 0x188>, module_name = 0x7cee719e0080 "\030\n", has_dynamic_init = 752, gcc_location = 0x7ffc3fcb6008, odr_indicator = 140181080898335}, {beg = 1, size = 136607636162624, size_with_redzone = 140721378759424, name = 0x7f7e739695d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", module_name = 0x3 <error: Cannot access memory at address 0x3>, has_dynamic_init = 130763059200, gcc_location = 0x7ffc3fcb0ae0, odr_indicator = 2}, {beg = 140181081855504, size = 94219965338886, size_with_redzone = 140721378757520, name = 0x7 <error: Cannot access memory at address 0x7>, module_name = 0x7f7e73a17fc0 <__asan::instance> "", has_dynamic_init = 135920442302432, gcc_location = 0x7ffc3fcb0b60, odr_indicator = 140181081955686}, {beg = 140721378757568, size = 6, size_with_redzone = 140181082570688, name = 0x7c3e71a17a70 "\003\021", module_name = 0x7ffc3fcb0b90 "\b", has_dynamic_init = 140181080921912, gcc_location = 0x78, odr_indicator = 136607636224624}}, reg_sites = {1070271360, 32764, 1926574446, 32638}, access_size = 0, size = 12 '\f'}, wild = {addr = 0, access_size = 0}}}}}, CallocOverflow = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000~{\000\000\377\000\000\000\000\000\000\000\240w\265K\261U\000\000f\035\230s~\177\000\000 \a\313?\374\177\000\000\002\000\000\000\000\000\000\000\300\177\241s~\177\000\000\020\004\237q\376{\000\000\360\006\313?\374\177\000\0008W\210s~\177\000\000^\000\000\000\000\000\000\000\020\004\237q\376{\000\000\320\360\025r~\177\000\000\020\a\313?\374\177\000\000 \004\237q\376{\000\000q\000\000\000\000\000\000\000\200\017\313?\374\177\000\000^\000\000\000\000\000\000\000@\017\313?\374\177\000\000\301\203\226s~\177\000\000\"\232\256K\261U\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffc00000002, count = 137363550241288, size = 0}, ReallocArrayOverflow = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000~{\000\000\377\000\000\000\000\000\000\000\240w\265K\261U\000\000f\035\230s~\177\000\000 \a\313?\374\177\000\000\002\000\000\000\000\000\000\000\300\177\241s~\177\000\000\020\004\237q\376{\000\000\360\006\313?\374\177\000\0008W\210s~\177\000\000^\000\000\000\000\000\000\000\020\004\237q\376{\000\000\320\360\025r~\177\000\000\020\a\313?\374\177\000\000 \004\237q\376{\000\000q\000\000\000\000\000\000\000\200\017\313?\374\177\000\000^\000\000\000\000\000\000\000@\017\313?\374\177\000\000\301\203\226s~\177\000\000\"\232\256K\261U\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffc00000002, count = 137363550241288, size = 0}, PvallocOverflow = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000~{\000\000\377\000\000\000\000\000\000\000\240w\265K\261U\000\000f\035\230s~\177\000\000 \a\313?\374\177\000\000\002\000\000\000\000\000\000\000\300\177\241s~\177\000\000\020\004\237q\376{\000\000\360\006\313?\374\177\000\0008W\210s~\177\000\000^\000\000\000\000\000\000\000\020\004\237q\376{\000\000\320\360\025r~\177\000\000\020\a\313?\374\177\000\000 \004\237q\376{\000\000q\000\000\000\000\000\000\000\200\017\313?\374\177\000\000^\000\000\000\000\000\000\000@\017\313?\374\177\000\000\301\203\226s~\177\000\000\"\232\256K\261U\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffc00000002, size = 137363550241288}, InvalidAllocationAlignment = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000~{\000\000\377\000\000\000\000\000\000\000\240w\265K\261U\000\000f\035\230s~\177\000\000 \a\313?\374\177\000\000\002\000\000\000\000\000\000\000\300\177\241s~\177\000\000\020\004\237q\376{\000\000\360\006\313?\374\177\000\0008W\210s~\177\000\000^\000\000\000\000\000\000\000\020\004\237q\376{\000\000\320\360\025r~\177\000\000\020\a\313?\374\177\000\000 \004\237q\376{\000\000q\000\000\000\000\000\000\000\200\017\313?\374\177\000\000^\000\000\000\000\000\000\000@\017\313?\374\177\000\000\301\203\226s~\177\000\000\"\232\256K\261U\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffc00000002, alignment = 137363550241288}, InvalidAlignedAllocAlignment = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000~{\000\000\377\000\000\000\000\000\000\000\240w\265K\261U\000\000f\035\230s~\177\000\000 \a\313?\374\177\000\000\002\000\000\000\000\000\000\000\300\177\241s~\177\000\000\020\004\237q\376{\000\000\360\006\313?\374\177\000\0008W\210s~\177\000\000^\000\000\000\000\000\000\000\020\004\237q\376{\000\000\320\360\025r~\177\000\000\020\a\313?\374\177\000\000 \004\237q\376{\000\000q\000\000\000\000\000\000\000\200\017\313?\374\177\000\000^\000\000\000\000\000\000\000@\017\313?\374\177\000\000\301\203\226s~\177\000\000\"\232\256K\261U\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffc00000002, size = 137363550241288, alignment = 0}, InvalidPosixMemalignAlignment = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000~{\000\000\377\000\000\000\000\000\000\000\240w\265K\261U\000\000f\035\230s~\177\000\000 \a\313?\374\177\000\000\002\000\000\000\000\000\000\000\300\177\241s~\177\000\000\020\004\237q\376{\000\000\360\006\313?\374\177\000\0008W\210s~\177\000\000^\000\000\000\000\000\000\000\020\004\237q\376{\000\000\320\360\025r~\177\000\000\020\a\313?\374\177\000\000 \004\237q\376{\000\000q\000\000\000\000\000\000\000\200\017\313?\374\177\000\000^\000\000\000\000\000\000\000@\017\313?\374\177\000\000\301\203\226s~\177\000\000\"\232\256K\261U\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffc00000002, alignment = 137363550241288}, AllocationSizeTooBig = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000~{\000\000\377\000\000\000\000\000\000\000\240w\265K\261U\000\000f\035\230s~\177\000\000 \a\313?\374\177\000\000\002\000\000\000\000\000\000\000\300\177\241s~\177\000\000\020\004\237q\376{\000\000\360\006\313?\374\177\000\0008W\210s~\177\000\000^\000\000\000\000\000\000\000\020\004\237q\376{\000\000\320\360\025r~\177\000\000\020\a\313?\374\177\000\000 \004\237q\376{\000\000q\000\000\000\000\000\000\000\200\017\313?\374\177\000\000^\000\000\000\000\000\000\000@\017\313?\374\177\000\000\301\203\226s~\177\000\000\"\232\256K\261U\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffc00000002, user_size = 137363550241288, total_size = 0, max_size = 0}, RssLimitExceeded = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000~{\000\000\377\000\000\000\000\000\000\000\240w\265K\261U\000\000f\035\230s~\177\000\000 \a\313?\374\177\000\000\002\000\000\000\000\000\000\000\300\177\241s~\177\000\000\020\004\237q\376{\000\000\360\006\313?\374\177\000\0008W\210s~\177\000\000^\000\000\000\000\000\000\000\020\004\237q\376{\000\000\320\360\025r~\177\000\000\020\a\313?\374\177\000\000 \004\237q\376{\000\000q\000\000\000\000\000\000\000\200\017\313?\374\177\000\000^\000\000\000\000\000\000\000@\017\313?\374\177\000\000\301\203\226s~\177\000\000\"\232\256K\261U\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffc00000002}, OutOfMemory = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000~{\000\000\377\000\000\000\000\000\000\000\240w\265K\261U\000\000f\035\230s~\177\000\000 \a\313?\374\177\000\000\002\000\000\000\000\000\000\000\300\177\241s~\177\000\000\020\004\237q\376{\000\000\360\006\313?\374\177\000\0008W\210s~\177\000\000^\000\000\000\000\000\000\000\020\004\237q\376{\000\000\320\360\025r~\177\000\000\020\a\313?\374\177\000\000 \004\237q\376{\000\000q\000\000\000\000\000\000\000\200\017\313?\374\177\000\000^\000\000\000\000\000\000\000@\017\313?\374\177\000\000\301\203\226s~\177\000\000\"\232\256K\261U\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffc00000002, requested_size = 137363550241288}, StringFunctionMemoryRangesOverlap = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000~{\000\000\377\000\000\000\000\000\000\000\240w\265K\261U\000\000f\035\230s~\177\000\000 \a\313?\374\177\000\000\002\000\000\000\000\000\000\000\300\177\241s~\177\000\000\020\004\237q\376{\000\000\360\006\313?\374\177\000\0008W\210s~\177\000\000^\000\000\000\000\000\000\000\020\004\237q\376{\000\000\320\360\025r~\177\000\000\020\a\313?\374\177\000\000 \004\237q\376{\000\000q\000\000\000\000\000\000\000\200\017\313?\374\177\000\000^\000\000\000\000\000\000\000@\017\313?\374\177\000\000\301\203\226s~\177\000\000\"\232\256K\261U\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffc00000002, length1 = 137363550241288, length2 = 0, addr1_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 11098195494388, kind = (unknown: 0x8), shadow_byte = 2 '\002'}, heap = {addr = 11098195494388, alloc_tid = 137363550241288, free_tid = 392, alloc_stack_id = 1906180224, free_stack_id = 31982, chunk_access = {bad_addr = 752, offset = 140721378779144, chunk_begin = 140181080898335, chunk_size = 1, user_requested_alignment = 2112, access_type = 0, alloc_type = 2}}, stack = {addr = 11098195494388, tid = 137363550241288, offset = 392, frame_pc = 137363550240896, access_size = 752, frame_descr = 0x7ffc3fcb6008 <error: Cannot access memory at address 0x7ffc3fcb6008>}, global = {addr = 11098195494388, static kMaxGlobals = 4, globals = {{beg = 137363550241288, size = 392, size_with_redzone = 137363550240896, name = 0x2f0 <error: Cannot access memory at address 0x2f0>, module_name = 0x7ffc3fcb6008 <error: Cannot access memory at address 0x7ffc3fcb6008>, has_dynamic_init = 140181080898335, gcc_location = 0x1, odr_indicator = 136607636162624}, {beg = 140721378759424, size = 140181081855442, size_with_redzone = 3, name = 0x1e7215f000 <error: Cannot access memory at address 0x1e7215f000>, module_name = 0x7ffc3fcb0ae0 "\020\226\226s~\177", has_dynamic_init = 2, gcc_location = 0x7f7e73969610 <___interceptor_malloc(__sanitizer::uptr)+192>, odr_indicator = 94219965338886}, {beg = 140721378757520, size = 7, size_with_redzone = 140181082570688, name = 0x7b9e71ae5fe0 "\003\021", module_name = 0x7ffc3fcb0b60 "\200\v\313?\374\177", has_dynamic_init = 140181081955686, gcc_location = 0x7ffc3fcb0bc0, odr_indicator = 6}, {beg = 140181082570688, size = 136607636224624, size_with_redzone = 140721378757520, name = 0x7f7e73885738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", module_name = 0x78 <error: Cannot access memory at address 0x78>, has_dynamic_init = 136607636224624, gcc_location = 0x7ffc3fcb0b80, odr_indicator = 140181069181294}}, reg_sites = {0, 0, 1267207436, 21937}, access_size = 140721378759344, size = 160 '\240'}, wild = {addr = 11098195494388, access_size = 137363550241288}}}}, addr2_description = {data = {kind = 8, {shadow = {addr = 140181082281879, kind = __asan::kShadowKindLow, shadow_byte = 253 '\375'}, heap = {addr = 140181082281879, alloc_tid = 140181078801664, free_tid = 140721378758992, alloc_stack_id = 1939036371, free_stack_id = 32638, chunk_access = {bad_addr = 140721378758992, offset = 1936411192, chunk_begin = 140721378759088, chunk_size = 140181078797910, user_requested_alignment = 384, access_type = 0, alloc_type = 0}}, stack = {addr = 140181082281879, tid = 140181078801664, offset = 140721378758992, frame_pc = 140181081643219, access_size = 140721378758992, frame_descr = 0x736b4a38 <error: Cannot access memory at address 0x736b4a38>}, global = {addr = 140181082281879, static kMaxGlobals = 4, globals = {{beg = 140181078801664, size = 140721378758992, size_with_redzone = 140181081643219, name = 0x7ffc3fcb1150 "\200\001\236q\216|", module_name = 0x736b4a38 <error: Cannot access memory at address 0x736b4a38>, has_dynamic_init = 140721378759088, gcc_location = 0x7f7e7367ee56, odr_indicator = 136951233380736}, {beg = 140181078797860, size = 140721378759040, size_with_redzone = 6921098496672, name = 0x22 <error: Cannot access memory at address 0x22>, module_name = 0x2f01c8e5 <error: Cannot access memory at address 0x2f01c8e5>, has_dynamic_init = 140721378759072, gcc_location = 0x7bde719e0aa0, odr_indicator = 140721378759104}, {beg = 136607636224640, size = 136951233380736, size_with_redzone = 136057880652048, name = 0x55b14ba61600 <watch_destroy> "\363\017\036\372SH\211\373H\203\354\020H\205\377\017\2049\002", module_name = 0x7f7e736e3dce "I\211\305L9\360tJH\205\300tUH\213E\310dH+\004%(", has_dynamic_init = 136607636224640, gcc_location = 0x7f7e736e3dce, odr_indicator = 94219966748160}, {beg = 0, size = 140721378759200, size_with_redzone = 140181079211470, name = 0x7c7e719e0140 "\001", module_name = 0x7bbe719f84d0 "\002", has_dynamic_init = 44, gcc_location = 0x0, odr_indicator = 136057880282328}}, reg_sites = {1906649384, 31678, 1906279664, 31678}, access_size = 94219966750030, size = 16 '\020'}, wild = {addr = 140181082281879, access_size = 140181078801664}}}}, function = 0xd940802e51d32100 <error: Cannot access memory at address 0xd940802e51d32100>}, StringFunctionSizeOverflow = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000~{\000\000\377\000\000\000\000\000\000\000\240w\265K\261U\000\000f\035\230s~\177\000\000 \a\313?\374\177\000\000\002\000\000\000\000\000\000\000\300\177\241s~\177\000\000\020\004\237q\376{\000\000\360\006\313?\374\177\000\0008W\210s~\177\000\000^\000\000\000\000\000\000\000\020\004\237q\376{\000\000\320\360\025r~\177\000\000\020\a\313?\374\177\000\000 \004\237q\376{\000\000q\000\000\000\000\000\000\000\200\017\313?\374\177\000\000^\000\000\000\000\000\000\000@\017\313?\374\177\000\000\301\203\226s~\177\000\000\"\232\256K\261U\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffc00000002, addr_description = {data = {kind = 1906180616, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11098195494388, alloc_stack_id = 1906180616, free_stack_id = 31982, chunk_access = {bad_addr = 392, offset = 137363550240896, chunk_begin = 752, chunk_size = 140721378779144, user_requested_alignment = 2847, access_type = 3, alloc_type = 3}}, stack = {addr = 0, tid = 0, offset = 11098195494388, frame_pc = 137363550241288, access_size = 392, frame_descr = 0x7cee719e0080 "\030\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11098195494388, size_with_redzone = 137363550241288, name = 0x188 <error: Cannot access memory at address 0x188>, module_name = 0x7cee719e0080 "\030\n", has_dynamic_init = 752, gcc_location = 0x7ffc3fcb6008, odr_indicator = 140181080898335}, {beg = 1, size = 136607636162624, size_with_redzone = 140721378759424, name = 0x7f7e739695d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", module_name = 0x3 <error: Cannot access memory at address 0x3>, has_dynamic_init = 130763059200, gcc_location = 0x7ffc3fcb0ae0, odr_indicator = 2}, {beg = 140181081855504, size = 94219965338886, size_with_redzone = 140721378757520, name = 0x7 <error: Cannot access memory at address 0x7>, module_name = 0x7f7e73a17fc0 <__asan::instance> "", has_dynamic_init = 135920442302432, gcc_location = 0x7ffc3fcb0b60, odr_indicator = 140181081955686}, {beg = 140721378757568, size = 6, size_with_redzone = 140181082570688, name = 0x7c3e71a17a70 "\003\021", module_name = 0x7ffc3fcb0b90 "\b", has_dynamic_init = 140181080921912, gcc_location = 0x78, odr_indicator = 136607636224624}}, reg_sites = {1070271360, 32764, 1926574446, 32638}, access_size = 0, size = 12 '\f'}, wild = {addr = 0, access_size = 0}}}}, size = 140721378759344}, BadParamsToAnnotateContiguousContainer = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000~{\000\000\377\000\000\000\000\000\000\000\240w\265K\261U\000\000f\035\230s~\177\000\000 \a\313?\374\177\000\000\002\000\000\000\000\000\000\000\300\177\241s~\177\000\000\020\004\237q\376{\000\000\360\006\313?\374\177\000\0008W\210s~\177\000\000^\000\000\000\000\000\000\000\020\004\237q\376{\000\000\320\360\025r~\177\000\000\020\a\313?\374\177\000\000 \004\237q\376{\000\000q\000\000\000\000\000\000\000\200\017\313?\374\177\000\000^\000\000\000\000\000\000\000@\017\313?\374\177\000\000\301\203\226s~\177\000\000\"\232\256K\261U\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffc00000002, beg = 137363550241288, end = 0, old_mid = 0, new_mid = 11098195494388}, BadParamsToAnnotateDoubleEndedContiguousContainer = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000~{\000\000\377\000\000\000\000\000\000\000\240w\265K\261U\000\000f\035\230s~\177\000\000 \a\313?\374\177\000\000\002\000\000\000\000\000\000\000\300\177\241s~\177\000\000\020\004\237q\376{\000\000\360\006\313?\374\177\000\0008W\210s~\177\000\000^\000\000\000\000\000\000\000\020\004\237q\376{\000\000\320\360\025r~\177\000\000\020\a\313?\374\177\000\000 \004\237q\376{\000\000q\000\000\000\000\000\000\000\200\017\313?\374\177\000\000^\000\000\000\000\000\000\000@\017\313?\374\177\000\000\301\203\226s~\177\000\000\"\232\256K\261U\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffc00000002, storage_beg = 137363550241288, storage_end = 0, old_container_beg = 0, old_container_end = 11098195494388, new_container_beg = 137363550241288, new_container_end = 392}, BadParamsToCopyContiguousContainerAnnotations = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000~{\000\000\377\000\000\000\000\000\000\000\240w\265K\261U\000\000f\035\230s~\177\000\000 \a\313?\374\177\000\000\002\000\000\000\000\000\000\000\300\177\241s~\177\000\000\020\004\237q\376{\000\000\360\006\313?\374\177\000\0008W\210s~\177\000\000^\000\000\000\000\000\000\000\020\004\237q\376{\000\000\320\360\025r~\177\000\000\020\a\313?\374\177\000\000 \004\237q\376{\000\000q\000\000\000\000\000\000\000\200\017\313?\374\177\000\000^\000\000\000\000\000\000\000@\017\313?\374\177\000\000\301\203\226s~\177\000\000\"\232\256K\261U\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffc00000002, old_storage_beg = 137363550241288, old_storage_end = 0, new_storage_beg = 0, new_storage_end = 11098195494388}, ODRViolation = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000~{\000\000\377\000\000\000\000\000\000\000\240w\265K\261U\000\000f\035\230s~\177\000\000 \a\313?\374\177\000\000\002\000\000\000\000\000\000\000\300\177\241s~\177\000\000\020\004\237q\376{\000\000\360\006\313?\374\177\000\0008W\210s~\177\000\000^\000\000\000\000\000\000\000\020\004\237q\376{\000\000\320\360\025r~\177\000\000\020\a\313?\374\177\000\000 \004\237q\376{\000\000q\000\000\000\000\000\000\000\200\017\313?\374\177\000\000^\000\000\000\000\000\000\000@\017\313?\374\177\000\000\301\203\226s~\177\000\000\"\232\256K\261U\000\000\270\377\377\377"...}, tid = 0}, global1 = {beg = 140720308486146, size = 137363550241288, size_with_redzone = 0, name = 0x0, module_name = 0xa18000005f4 <error: Cannot access memory at address 0xa18000005f4>, has_dynamic_init = 137363550241288, gcc_location = 0x188, odr_indicator = 137363550240896}, global2 = {beg = 752, size = 140721378779144, size_with_redzone = 140181080898335, name = 0x1 <error: Cannot access memory at address 0x1>, module_name = 0x7c3e71a08840 "\200\a\236q\356|", has_dynamic_init = 140721378759424, gcc_location = 0x7f7e739695d2 <___interceptor_malloc(__sanitizer::uptr)+130>, odr_indicator = 3}, stack_id1 = 1914040320, stack_id2 = 30}, InvalidPointerPair = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000~{\000\000\377\000\000\000\000\000\000\000\240w\265K\261U\000\000f\035\230s~\177\000\000 \a\313?\374\177\000\000\002\000\000\000\000\000\000\000\300\177\241s~\177\000\000\020\004\237q\376{\000\000\360\006\313?\374\177\000\0008W\210s~\177\000\000^\000\000\000\000\000\000\000\020\004\237q\376{\000\000\320\360\025r~\177\000\000\020\a\313?\374\177\000\000 \004\237q\376{\000\000q\000\000\000\000\000\000\000\200\017\313?\374\177\000\000^\000\000\000\000\000\000\000@\017\313?\374\177\000\000\301\203\226s~\177\000\000\"\232\256K\261U\000\000\270\377\377\377"...}, tid = 0}, pc = 140720308486146, bp = 137363550241288, sp = 0, addr1_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 11098195494388, kind = (unknown: 0x8), shadow_byte = 2 '\002'}, heap = {addr = 11098195494388, alloc_tid = 137363550241288, free_tid = 392, alloc_stack_id = 1906180224, free_stack_id = 31982, chunk_access = {bad_addr = 752, offset = 140721378779144, chunk_begin = 140181080898335, chunk_size = 1, user_requested_alignment = 2112, access_type = 0, alloc_type = 2}}, stack = {addr = 11098195494388, tid = 137363550241288, offset = 392, frame_pc = 137363550240896, access_size = 752, frame_descr = 0x7ffc3fcb6008 <error: Cannot access memory at address 0x7ffc3fcb6008>}, global = {addr = 11098195494388, static kMaxGlobals = 4, globals = {{beg = 137363550241288, size = 392, size_with_redzone = 137363550240896, name = 0x2f0 <error: Cannot access memory at address 0x2f0>, module_name = 0x7ffc3fcb6008 <error: Cannot access memory at address 0x7ffc3fcb6008>, has_dynamic_init = 140181080898335, gcc_location = 0x1, odr_indicator = 136607636162624}, {beg = 140721378759424, size = 140181081855442, size_with_redzone = 3, name = 0x1e7215f000 <error: Cannot access memory at address 0x1e7215f000>, module_name = 0x7ffc3fcb0ae0 "\020\226\226s~\177", has_dynamic_init = 2, gcc_location = 0x7f7e73969610 <___interceptor_malloc(__sanitizer::uptr)+192>, odr_indicator = 94219965338886}, {beg = 140721378757520, size = 7, size_with_redzone = 140181082570688, name = 0x7b9e71ae5fe0 "\003\021", module_name = 0x7ffc3fcb0b60 "\200\v\313?\374\177", has_dynamic_init = 140181081955686, gcc_location = 0x7ffc3fcb0bc0, odr_indicator = 6}, {beg = 140181082570688, size = 136607636224624, size_with_redzone = 140721378757520, name = 0x7f7e73885738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", module_name = 0x78 <error: Cannot access memory at address 0x78>, has_dynamic_init = 136607636224624, gcc_location = 0x7ffc3fcb0b80, odr_indicator = 140181069181294}}, reg_sites = {0, 0, 1267207436, 21937}, access_size = 140721378759344, size = 160 '\240'}, wild = {addr = 11098195494388, access_size = 137363550241288}}}}, addr2_description = {data = {kind = 8, {shadow = {addr = 140181082281879, kind = __asan::kShadowKindLow, shadow_byte = 253 '\375'}, heap = {addr = 140181082281879, alloc_tid = 140181078801664, free_tid = 140721378758992, alloc_stack_id = 1939036371, free_stack_id = 32638, chunk_access = {bad_addr = 140721378758992, offset = 1936411192, chunk_begin = 140721378759088, chunk_size = 140181078797910, user_requested_alignment = 384, access_type = 0, alloc_type = 0}}, stack = {addr = 140181082281879, tid = 140181078801664, offset = 140721378758992, frame_pc = 140181081643219, access_size = 140721378758992, frame_descr = 0x736b4a38 <error: Cannot access memory at address 0x736b4a38>}, global = {addr = 140181082281879, static kMaxGlobals = 4, globals = {{beg = 140181078801664, size = 140721378758992, size_with_redzone = 140181081643219, name = 0x7ffc3fcb1150 "\200\001\236q\216|", module_name = 0x736b4a38 <error: Cannot access memory at address 0x736b4a38>, has_dynamic_init = 140721378759088, gcc_location = 0x7f7e7367ee56, odr_indicator = 136951233380736}, {beg = 140181078797860, size = 140721378759040, size_with_redzone = 6921098496672, name = 0x22 <error: Cannot access memory at address 0x22>, module_name = 0x2f01c8e5 <error: Cannot access memory at address 0x2f01c8e5>, has_dynamic_init = 140721378759072, gcc_location = 0x7bde719e0aa0, odr_indicator = 140721378759104}, {beg = 136607636224640, size = 136951233380736, size_with_redzone = 136057880652048, name = 0x55b14ba61600 <watch_destroy> "\363\017\036\372SH\211\373H\203\354\020H\205\377\017\2049\002", module_name = 0x7f7e736e3dce "I\211\305L9\360tJH\205\300tUH\213E\310dH+\004%(", has_dynamic_init = 136607636224640, gcc_location = 0x7f7e736e3dce, odr_indicator = 94219966748160}, {beg = 0, size = 140721378759200, size_with_redzone = 140181079211470, name = 0x7c7e719e0140 "\001", module_name = 0x7bbe719f84d0 "\002", has_dynamic_init = 44, gcc_location = 0x0, odr_indicator = 136057880282328}}, reg_sites = {1906649384, 31678, 1906279664, 31678}, access_size = 94219966750030, size = 16 '\020'}, wild = {addr = 140181082281879, access_size = 140181078801664}}}}}, Generic = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000~{\000\000\377\000\000\000\000\000\000\000\240w\265K\261U\000\000f\035\230s~\177\000\000 \a\313?\374\177\000\000\002\000\000\000\000\000\000\000\300\177\241s~\177\000\000\020\004\237q\376{\000\000\360\006\313?\374\177\000\0008W\210s~\177\000\000^\000\000\000\000\000\000\000\020\004\237q\376{\000\000\320\360\025r~\177\000\000\020\a\313?\374\177\000\000 \004\237q\376{\000\000q\000\000\000\000\000\000\000\200\017\313?\374\177\000\000^\000\000\000\000\000\000\000@\017\313?\374\177\000\000\301\203\226s~\177\000\000\"\232\256K\261U\000\000\270\377\377\377"...}, tid = 0}, addr_description = {data = {kind = __asan::kAddressKindHeap, {shadow = {addr = 137363550241288, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 137363550241288, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1524, free_stack_id = 2584, chunk_access = {bad_addr = 137363550241288, offset = 392, chunk_begin = 137363550240896, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, stack = {addr = 137363550241288, tid = 0, offset = 0, frame_pc = 11098195494388, access_size = 137363550241288, frame_descr = 0x188 <error: Cannot access memory at address 0x188>}, global = {addr = 137363550241288, static kMaxGlobals = 4, globals = {{beg = 0, size = 0, size_with_redzone = 11098195494388, name = 0x7cee719e0208 "", module_name = 0x188 <error: Cannot access memory at address 0x188>, has_dynamic_init = 137363550240896, gcc_location = 0x2f0, odr_indicator = 140721378779144}, {beg = 140181080898335, size = 1, size_with_redzone = 136607636162624, name = 0x7ffc3fcb1300 "\020\222rK\261U", module_name = 0x7f7e739695d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", has_dynamic_init = 3, gcc_location = 0x1e7215f000, odr_indicator = 140721378757344}, {beg = 2, size = 140181081855504, size_with_redzone = 94219965338886, name = 0x7ffc3fcb0b90 "\b", module_name = 0x7 <error: Cannot access memory at address 0x7>, has_dynamic_init = 140181082570688, gcc_location = 0x7b9e71ae5fe0, odr_indicator = 140721378757472}, {beg = 140181081955686, size = 140721378757568, size_with_redzone = 6, name = 0x7f7e73a17fc0 <__asan::instance> "", module_name = 0x7c3e71a17a70 "\003\021", has_dynamic_init = 140721378757520, gcc_location = 0x7f7e73885738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248>, odr_indicator = 120}}, reg_sites = {1906408048, 31806, 1070271360, 32764}, access_size = 140181069181294, size = 0 '\000'}, wild = {addr = 137363550241288, access_size = 0}}}}, pc = 94219964779788, bp = 140721378759344, sp = 140721378759328, access_size = 8, bug_descr = 0x7f7e739d1797 "heap-use-after-free", is_write = false, shadow_val = 253 '\375'}}}, halt_on_error_ = true}
                error = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000~{\000\000\377\000\000\000\000\000\000\000\240w\265K\261U\000\000f\035\230s~\177\000\000 \a\313?\374\177\000\000\002\000\000\000\000\000\000\000\300\177\241s~\177\000\000\020\004\237q\376{\000\000\360\006\313?\374\177\000\0008W\210s~\177\000\000^\000\000\000\000\000\000\000\020\004\237q\376{\000\000\320\360\025r~\177\000\000\020\a\313?\374\177\000\000 \004\237q\376{\000\000q\000\000\000\000\000\000\000\200\017\313?\374\177\000\000^\000\000\000\000\000\000\000@\017\313?\374\177\000\000\301\203\226s~\177\000\000\"\232\256K\261U\000\000\270\377\377\377"...}, tid = 0}, addr_description = {data = {kind = __asan::kAddressKindHeap, {shadow = {addr = 137363550241288, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 137363550241288, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1524, free_stack_id = 2584, chunk_access = {bad_addr = 137363550241288, offset = 392, chunk_begin = 137363550240896, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, stack = {addr = 137363550241288, tid = 0, offset = 0, frame_pc = 11098195494388, access_size = 137363550241288, frame_descr = 0x188 <error: Cannot access memory at address 0x188>}, global = {addr = 137363550241288, static kMaxGlobals = 4, globals = {{beg = 0, size = 0, size_with_redzone = 11098195494388, name = 0x7cee719e0208 "", module_name = 0x188 <error: Cannot access memory at address 0x188>, has_dynamic_init = 137363550240896, gcc_location = 0x2f0, odr_indicator = 140721378779144}, {beg = 140181080898335, size = 1, size_with_redzone = 136607636162624, name = 0x7ffc3fcb1300 "\020\222rK\261U", module_name = 0x7f7e739695d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", has_dynamic_init = 3, gcc_location = 0x1e7215f000, odr_indicator = 140721378757344}, {beg = 2, size = 140181081855504, size_with_redzone = 94219965338886, name = 0x7ffc3fcb0b90 "\b", module_name = 0x7 <error: Cannot access memory at address 0x7>, has_dynamic_init = 140181082570688, gcc_location = 0x7b9e71ae5fe0, odr_indicator = 140721378757472}, {beg = 140181081955686, size = 140721378757568, size_with_redzone = 6, name = 0x7f7e73a17fc0 <__asan::instance> "", module_name = 0x7c3e71a17a70 "\003\021", has_dynamic_init = 140721378757520, gcc_location = 0x7f7e73885738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248>, odr_indicator = 120}}, reg_sites = {1906408048, 31806, 1070271360, 32764}, access_size = 140181069181294, size = 0 '\000'}, wild = {addr = 137363550241288, access_size = 0}}}}, pc = 94219964779788, bp = 140721378759344, sp = 140721378759328, access_size = 8, bug_descr = 0x7f7e739d1797 "heap-use-after-free", is_write = false, shadow_val = 253 '\375'}
        #9  0x00007f7e73975f8d in __asan::ReportGenericError (pc=<optimized out>, bp=bp@entry=140721378759344, sp=sp@entry=140721378759328, addr=<optimized out>, is_write=is_write@entry=false, access_size=access_size@entry=8, exp=<optimized out>, fatal=true) at ../../../../src/libsanitizer/asan/asan_report.cpp:536
                in_report = <optimized out>
                error = <optimized out>
                enable_fp = <optimized out>
        #10 0x00007f7e739773f9 in __asan::__asan_report_load8 (addr=<optimized out>) at ../../../../src/libsanitizer/asan/asan_rtl.cpp:131
                bp = 140721378759344
                pc = <optimized out>
                local_stack = 140721378759456
                sp = 140721378759328
        #11 0x000055b14b880d0c in device_get_adapter (device=<optimized out>) at src/device.c:6900
        No locals.
        #12 0x000055b14b72924f in find_cig_session (data=0x7c3e71a071c0, match_data=0x7b7e70884a30) at profiles/audio/bap.c:2500
                session = 0x7c3e71a071c0
                info = 0x7b7e70884a30
        #13 0x000055b14b907ee1 in queue_find (queue=<optimized out>, function=function@entry=0x55b14b729210 <find_cig_session>, match_data=match_data@entry=0x7b7e70884a30) at src/shared/queue.c:230
                entry = 0x7b9e71a58890
        #14 0x000055b14b72fd14 in find_cig_enumerate (data=0x7c3e71a08840) at profiles/audio/bap.c:2539
                info = <optimized out>
        #15 bap_update_cigs_cb (user_data=0x7c3e71a08840) at profiles/audio/bap.c:2688
                data = 0x7c3e71a08840
                cigs = <optimized out>
                unset = <optimized out>
        #16 0x00007f7e73681b9b in ?? () from /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
        No symbol table info available.
        #17 0x00007f7e736831d7 in ?? () from /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
        No symbol table info available.
        #18 0x00007f7e73683577 in g_main_loop_run () from /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
        No symbol table info available.
        #19 0x000055b14ba63e29 in mainloop_run () at src/shared/mainloop-glib.c:65
        No locals.
        #20 0x000055b14ba6475b in mainloop_run_with_signal (func=func@entry=0x55b14b8c9840 <signal_callback>, user_data=user_data@entry=0x0) at src/shared/mainloop-notify.c:196
                data = 0x7bae719e3490
                io = 0x7bbe719f9b10
                ret = <optimized out>
        #21 0x000055b14b5e230b in main (argc=<optimized out>, argv=<optimized out>) at src/main.c:1713
                context = <optimized out>
                err = <optimized out>
                sdp_mtu = 0
                sdp_flags = <optimized out>
                gdbus_flags = <optimized out>
                __func__ = "main""


https://github.com/bluez/bluez/pull/2542

---
Regards,
Linux Bluetooth

Re: [PATCH BlueZ v5 1/3] shared/bap: Skip local metadata Config callbacks

[patchwork-bot+bluetooth]

Hello:

This series was applied to bluetooth/bluez.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Thu, 17 Sep 2026 19:12:04 +0000 you wrote:
> From: Derek Tern <1263187-dt@users.noreply.gitlab.freedesktop.org>
> 
> When reconfiguring a client stream that is already Codec Configured,
> setup_config() queues Codec Configuration and then caches metadata.
> stream_metadata() emits a same-state CONFIG notification for that local
> update. The profile callback treats it as the peer's configuration
> completion and clears config_pending before the peer has responded.
> 
> [...]

Here is the summary with links:
  - [BlueZ,v5,1/3] shared/bap: Skip local metadata Config callbacks
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=11bf67364e55
  - [BlueZ,v5,2/3] client: Pass unicast preset metadata to config
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=72a5ce497f34
  - [BlueZ,v5,3/3] test-functional: Cover BAP metadata reconfiguration
    (no matching commit)

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html

RE: [BlueZ,v5,1/3] shared/bap: Skip local metadata Config callbacks

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 703 bytes --]

This is an automated email and please do not reply to this email.

Dear Submitter,

This series was picked up by the CI more than 2 weeks ago and the pull
request created for it is still open, which means the series was never
applied to the tree.

   Series:       [BlueZ,v5,1/3] shared/bap: Skip local metadata Config callbacks
   Pull Request: https://github.com/bluez/bluez/pull/2542
   Created:      2026-09-17 20:04:30+00:00

The pull request has been closed and no further action is taken on this
series.

If the change should still be considered, it must be resent to the Linux
Bluetooth mailing list (linux-bluetooth@vger.kernel.org) so that it is
picked up again.

---
Regards,
Linux Bluetooth

RE: [BlueZ,v3,1/2] shared/bap: Skip local metadata Config callbacks

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 103810 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1167792/

---Test result---

Test Summary:
CheckPatch                    FAIL      0.59 seconds
GitLint                       PASS      0.41 seconds
BuildEll                      PASS      20.29 seconds
BluezMake                     PASS      400.54 seconds
MakeCheck                     PASS      14.63 seconds
MakeDistcheck                 PASS      151.90 seconds
CheckValgrind                 PASS      250.79 seconds
CheckSmatch                   WARNING   318.74 seconds
bluezmakeextell               PASS      100.47 seconds
TestFunctional                FAIL      1184.27 seconds
IncrementalBuild              PASS      400.22 seconds
ScanBuild                     PASS      1183.48 seconds

Details
##############################
Test: CheckPatch - FAIL
Desc: Run checkpatch.pl script
Output:
[BlueZ,v3,1/2] shared/bap: Skip local metadata Config callbacks
WARNING:PREFER_FALLTHROUGH: Prefer 'fallthrough;' over fallthrough comment
#104: FILE: src/shared/bap.c:2289:
+		/* Fallthrough */

/home/runner/work/bluez/bluez/src/patch/14825757.patch total: 0 errors, 1 warnings, 11 lines checked

NOTE: For some of the reported defects, checkpatch may be able to
      mechanically convert to the typical style using --fix or --fix-inplace.

/home/runner/work/bluez/bluez/src/patch/14825757.patch has style problems, please review.

NOTE: Ignored message types: COMMIT_MESSAGE COMPLEX_MACRO CONST_STRUCT FILE_PATH_CHANGES MISSING_SIGN_OFF PREFER_PACKED SPDX_LICENSE_TAG SPLIT_STRING SSCANF_TO_KSTRTO

NOTE: If any of the errors are false positives, please report
      them to the maintainer, see CHECKPATCH in MAINTAINERS.


##############################
Test: CheckSmatch - WARNING
Desc: Run smatch tool with source
Output:
src/shared/bap.c:318:25: warning: array of flexible structuressrc/shared/bap.c: note: in included file:./src/shared/ascs.h:88:25: warning: array of flexible structuressrc/shared/bap.c:318:25: warning: array of flexible structuressrc/shared/bap.c: note: in included file:./src/shared/ascs.h:88:25: warning: array of flexible structuressrc/shared/bap.c:318:25: warning: array of flexible structuressrc/shared/bap.c: note: in included file:./src/shared/ascs.h:88:25: warning: array of flexible structures
##############################
Test: TestFunctional - FAIL
Desc: Run test-functional
Output:
FAIL functional.test_bap::test_bap_unicast_set_transport_created[hosts8-vm3]: failed on teardown with "pytest_bluezenv.plugin.CoredumpWarning: Core dump: test-bluezenv-hosts8.0-bluetoothd-1789666739-52.core
        /usr/bin/gdb: warning: Couldn't determine a path for the index cache directory.
        [New LWP 52]
        [Thread debugging using libthread_db enabled]
        Using host libthread_db library "/usr/lib/x86_64-linux-gnu/libthread_db.so.1".
        Core was generated by `/home/runner/work/bluez/bluez/src/src/src/bluetoothd --nodetach -f /run/bluetoo'.
        Program terminated with signal SIGABRT, Aborted.
        #0  __pthread_kill_implementation (threadid=<optimized out>, signo=6, no_tid=0) at ./nptl/pthread_kill.c:44

        warning: 44	./nptl/pthread_kill.c: No such file or directory

        Thread 1 (Thread 0x7fae3f5e9900 (LWP 52)):
        #0  __pthread_kill_implementation (threadid=<optimized out>, signo=6, no_tid=0) at ./nptl/pthread_kill.c:44
                tid = <optimized out>
                ret = 0
                pd = <optimized out>
                old_mask = {__val = {4412750543122677053}}
                ret = <optimized out>
        #1  __pthread_kill_internal (threadid=<optimized out>, signo=6) at ./nptl/pthread_kill.c:89
        No locals.
        #2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ./nptl/pthread_kill.c:100
        No locals.
        #3  0x00007fae3fd44b7e in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
                ret = <optimized out>
        #4  0x00007fae3fd278ec in __GI_abort () at ./stdlib/abort.c:77
                act = {__sigaction_handler = {sa_handler = 0x4, sa_sigaction = 0x4}, sa_mask = {__val = {135988281085744, 135988281085600, 6552389528793041152, 140723930730768, 140723930731056, 140723930730912, 22, 140386368818128, 0, 140723930730848, 140386385663510, 140386360102912, 4096, 0, 6552389528793041152, 140386360156184}}, sa_flags = 1090977792, sa_restorer = 0x16}
        #5  0x00007fae4094fa0f in __sanitizer::Abort () at ../../../../src/libsanitizer/sanitizer_common/sanitizer_posix_libcdep.cpp:165
        No locals.
        #6  0x00007fae40a75c2d in __sanitizer::Die () at ../../../../src/libsanitizer/sanitizer_common/sanitizer_termination.cpp:58
        No locals.
        #7  0x00007fae40a4a93c in __asan::ScopedInErrorReport::~ScopedInErrorReport (this=0x7ffcd7e712d6) at ../../../../src/libsanitizer/asan/asan_report.cpp:221
                buffer_copy = {buffer_ = {<__sanitizer::InternalMmapVectorNoCtor<char, false>> = {data_ = 0x7fae3f201000 '=' <repeats 65 times>, "\n==52==ERROR: AddressSanitizer: heap-use-after-free on address 0x7d1e3eae040b at pc 0x7fae409ff445 bp 0x7ffcd7e727d0 sp 0x7ffcd7e71f78\n"..., capacity_bytes_ = 4096, size_ = 3838}, <No data fields>}}
                buffer_copy = <optimized out>
                l = <optimized out>
        #8  0x00007fae40a49e02 in __asan::ReportGenericError (pc=140386385261637, bp=140723930736592, sp=sp@entry=140723930734456, addr=addr@entry=137568854082571, is_write=is_write@entry=false, access_size=6, fatal=false, exp=<optimized out>) at ../../../../src/libsanitizer/asan/asan_report.cpp:536
                in_report = {error_report_lock_ = {<No data fields>}, static current_error_ = {kind = __asan::kErrorKindGeneric, {Base = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000\311\262u\217\303\356Znal] org\240\035\347\327\374\177\000\000P\023\347\327\374\177\000\000.|\342?\256\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\320\033\347\327\374\177\000\000\211]\331?\256\177\000\000\214\023\347\327\374\177\000\000\214\023\347\327\374\177\000\000\214\033\347\327\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\256\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, DeadlySignal = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000\311\262u\217\303\356Znal] org\240\035\347\327\374\177\000\000P\023\347\327\374\177\000\000.|\342?\256\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\320\033\347\327\374\177\000\000\211]\331?\256\177\000\000\214\023\347\327\374\177\000\000\214\023\347\327\374\177\000\000\214\033\347\327\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\256\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, signal = {siginfo = 0xffffffff00000002, context = 0x7d1e3eae040b, addr = 0, pc = 0, sp = 11836929869373, bp = 137568854082571, is_memory_access = 11, write_flag = __sanitizer::SignalContext::Unknown, is_true_faulting_addr = false}}, DoubleFree = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000\311\262u\217\303\356Znal] org\240\035\347\327\374\177\000\000P\023\347\327\374\177\000\000.|\342?\256\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\320\033\347\327\374\177\000\000\211]\331?\256\177\000\000\214\023\347\327\374\177\000\000\214\023\347\327\374\177\000\000\214\033\347\327\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\256\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, second_free_stack = 0xffffffff00000002, addr_description = {addr = 137568854082571, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1597, free_stack_id = 2756, chunk_access = {bad_addr = 137568854082571, offset = 11, chunk_begin = 137568854082560, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}}, NewDeleteTypeMismatch = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000\311\262u\217\303\356Znal] org\240\035\347\327\374\177\000\000P\023\347\327\374\177\000\000.|\342?\256\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\320\033\347\327\374\177\000\000\211]\331?\256\177\000\000\214\023\347\327\374\177\000\000\214\023\347\327\374\177\000\000\214\033\347\327\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\256\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, free_stack = 0xffffffff00000002, addr_description = {addr = 137568854082571, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1597, free_stack_id = 2756, chunk_access = {bad_addr = 137568854082571, offset = 11, chunk_begin = 137568854082560, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, delete_size = 135988287545120, delete_alignment = 140723930732384}, FreeNotMalloced = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000\311\262u\217\303\356Znal] org\240\035\347\327\374\177\000\000P\023\347\327\374\177\000\000.|\342?\256\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\320\033\347\327\374\177\000\000\211]\331?\256\177\000\000\214\023\347\327\374\177\000\000\214\023\347\327\374\177\000\000\214\033\347\327\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\256\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, free_stack = 0xffffffff00000002, addr_description = {data = {kind = 1051591691, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11836929869373, alloc_stack_id = 1051591691, free_stack_id = 32030, chunk_access = {bad_addr = 11, offset = 137568854082560, chunk_begin = 752, chunk_size = 140723930750984, user_requested_alignment = 3872, access_type = 1, alloc_type = 2}}, stack = {addr = 0, tid = 0, offset = 11836929869373, frame_pc = 137568854082571, access_size = 11, frame_descr = 0x7d1e3eae0400 "\304\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11836929869373, size_with_redzone = 137568854082571, name = 0xb <error: Cannot access memory at address 0xb>, module_name = 0x7d1e3eae0400 "\304\n", has_dynamic_init = 752, gcc_location = 0x7ffcd7e76008, odr_indicator = 135988287545120}, {beg = 140723930732384, size = 140386384558879, size_with_redzone = 1, name = 0x7bae3d929f20 "`m\265>\016|", module_name = 0x7ffcd7e71fb0 "\300\037\347\327\374\177", has_dynamic_init = 140386385515986, gcc_location = 0x7fae3f2330d0, odr_indicator = 132471265216}, {beg = 140723930732432, size = 3, size_with_redzone = 140386385516048, name = 0x7fae3fd95b8f <__vasprintf_internal+255> "I\211\004$H\205\300t(H\213\265\330\376\377\377L\211\352H\211\307\350\366\032\371\377H\211\301\353\212\350\254\346\n", module_name = 0x5557775bf80b <bt_log_vprintf+171> "\205\300\017\210=\001", has_dynamic_init = 140723930735216, gcc_location = 0x7ffcd7e71850, odr_indicator = 2}, {beg = 140386386231232, size = 136400623463568, size_with_redzone = 140723930732576, name = 0x7fae40959738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", module_name = 0x3e <error: Cannot access memory at address 0x3e>, has_dynamic_init = 136400623463568, gcc_location = 0x7fae3f2330d0, odr_indicator = 140723930732608}}, reg_sites = {1052077216, 31758, 81, 0}, access_size = 140723930734768, size = 69 'E'}, wild = {addr = 0, access_size = 0}}}}}, AllocTypeMismatch = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000\311\262u\217\303\356Znal] org\240\035\347\327\374\177\000\000P\023\347\327\374\177\000\000.|\342?\256\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\320\033\347\327\374\177\000\000\211]\331?\256\177\000\000\214\023\347\327\374\177\000\000\214\023\347\327\374\177\000\000\214\033\347\327\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\256\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, dealloc_stack = 0xffffffff00000002, alloc_type = 1051591691, dealloc_type = 32030, addr_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 0, kind = (__asan::kShadowKindGap | unknown: 0x3c), shadow_byte = 6 '\006'}, heap = {addr = 0, alloc_tid = 11836929869373, free_tid = 137568854082571, alloc_stack_id = 11, free_stack_id = 0, chunk_access = {bad_addr = 137568854082560, offset = 752, chunk_begin = 140723930750984, chunk_size = 135988287545120, user_requested_alignment = 1888, access_type = 1, alloc_type = 0}}, stack = {addr = 0, tid = 11836929869373, offset = 137568854082571, frame_pc = 11, access_size = 137568854082560, frame_descr = 0x2f0 <error: Cannot access memory at address 0x2f0>}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 11836929869373, size = 137568854082571, size_with_redzone = 11, name = 0x7d1e3eae0400 "\304\n", module_name = 0x2f0 <error: Cannot access memory at address 0x2f0>, has_dynamic_init = 140723930750984, gcc_location = 0x7bae3d929f20, odr_indicator = 140723930732384}, {beg = 140386384558879, size = 1, size_with_redzone = 135988287545120, name = 0x7ffcd7e71fb0 "\300\037\347\327\374\177", module_name = 0x7fae40a3d5d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", has_dynamic_init = 140386360307920, gcc_location = 0x1ed7e717c0, odr_indicator = 140723930732432}, {beg = 3, size = 140386385516048, size_with_redzone = 140386372246415, name = 0x5557775bf80b <bt_log_vprintf+171> "\205\300\017\210=\001", module_name = 0x7ffcd7e72270 "\024$\347\327\374\177", has_dynamic_init = 140723930732624, gcc_location = 0x2, odr_indicator = 140386386231232}, {beg = 136400623463568, size = 140723930732576, size_with_redzone = 140386384582456, name = 0x3e <error: Cannot access memory at address 0x3e>, module_name = 0x7c0e3eb56c90 "\003\021", has_dynamic_init = 140386360307920, gcc_location = 0x7ffcd7e71840, odr_indicator = 136400623463584}}, reg_sites = {81, 0, 3622248624, 32764}, access_size = 140386385261637, size = 208 '\320'}, wild = {addr = 0, access_size = 11836929869373}}}}}, MallocUsableSizeNotOwned = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000\311\262u\217\303\356Znal] org\240\035\347\327\374\177\000\000P\023\347\327\374\177\000\000.|\342?\256\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\320\033\347\327\374\177\000\000\211]\331?\256\177\000\000\214\023\347\327\374\177\000\000\214\023\347\327\374\177\000\000\214\033\347\327\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\256\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, addr_description = {data = {kind = 1051591691, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11836929869373, alloc_stack_id = 1051591691, free_stack_id = 32030, chunk_access = {bad_addr = 11, offset = 137568854082560, chunk_begin = 752, chunk_size = 140723930750984, user_requested_alignment = 3872, access_type = 1, alloc_type = 2}}, stack = {addr = 0, tid = 0, offset = 11836929869373, frame_pc = 137568854082571, access_size = 11, frame_descr = 0x7d1e3eae0400 "\304\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11836929869373, size_with_redzone = 137568854082571, name = 0xb <error: Cannot access memory at address 0xb>, module_name = 0x7d1e3eae0400 "\304\n", has_dynamic_init = 752, gcc_location = 0x7ffcd7e76008, odr_indicator = 135988287545120}, {beg = 140723930732384, size = 140386384558879, size_with_redzone = 1, name = 0x7bae3d929f20 "`m\265>\016|", module_name = 0x7ffcd7e71fb0 "\300\037\347\327\374\177", has_dynamic_init = 140386385515986, gcc_location = 0x7fae3f2330d0, odr_indicator = 132471265216}, {beg = 140723930732432, size = 3, size_with_redzone = 140386385516048, name = 0x7fae3fd95b8f <__vasprintf_internal+255> "I\211\004$H\205\300t(H\213\265\330\376\377\377L\211\352H\211\307\350\366\032\371\377H\211\301\353\212\350\254\346\n", module_name = 0x5557775bf80b <bt_log_vprintf+171> "\205\300\017\210=\001", has_dynamic_init = 140723930735216, gcc_location = 0x7ffcd7e71850, odr_indicator = 2}, {beg = 140386386231232, size = 136400623463568, size_with_redzone = 140723930732576, name = 0x7fae40959738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", module_name = 0x3e <error: Cannot access memory at address 0x3e>, has_dynamic_init = 136400623463568, gcc_location = 0x7fae3f2330d0, odr_indicator = 140723930732608}}, reg_sites = {1052077216, 31758, 81, 0}, access_size = 140723930734768, size = 69 'E'}, wild = {addr = 0, access_size = 0}}}}}, SanitizerGetAllocatedSizeNotOwned = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000\311\262u\217\303\356Znal] org\240\035\347\327\374\177\000\000P\023\347\327\374\177\000\000.|\342?\256\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\320\033\347\327\374\177\000\000\211]\331?\256\177\000\000\214\023\347\327\374\177\000\000\214\023\347\327\374\177\000\000\214\033\347\327\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\256\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, addr_description = {data = {kind = 1051591691, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11836929869373, alloc_stack_id = 1051591691, free_stack_id = 32030, chunk_access = {bad_addr = 11, offset = 137568854082560, chunk_begin = 752, chunk_size = 140723930750984, user_requested_alignment = 3872, access_type = 1, alloc_type = 2}}, stack = {addr = 0, tid = 0, offset = 11836929869373, frame_pc = 137568854082571, access_size = 11, frame_descr = 0x7d1e3eae0400 "\304\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11836929869373, size_with_redzone = 137568854082571, name = 0xb <error: Cannot access memory at address 0xb>, module_name = 0x7d1e3eae0400 "\304\n", has_dynamic_init = 752, gcc_location = 0x7ffcd7e76008, odr_indicator = 135988287545120}, {beg = 140723930732384, size = 140386384558879, size_with_redzone = 1, name = 0x7bae3d929f20 "`m\265>\016|", module_name = 0x7ffcd7e71fb0 "\300\037\347\327\374\177", has_dynamic_init = 140386385515986, gcc_location = 0x7fae3f2330d0, odr_indicator = 132471265216}, {beg = 140723930732432, size = 3, size_with_redzone = 140386385516048, name = 0x7fae3fd95b8f <__vasprintf_internal+255> "I\211\004$H\205\300t(H\213\265\330\376\377\377L\211\352H\211\307\350\366\032\371\377H\211\301\353\212\350\254\346\n", module_name = 0x5557775bf80b <bt_log_vprintf+171> "\205\300\017\210=\001", has_dynamic_init = 140723930735216, gcc_location = 0x7ffcd7e71850, odr_indicator = 2}, {beg = 140386386231232, size = 136400623463568, size_with_redzone = 140723930732576, name = 0x7fae40959738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", module_name = 0x3e <error: Cannot access memory at address 0x3e>, has_dynamic_init = 136400623463568, gcc_location = 0x7fae3f2330d0, odr_indicator = 140723930732608}}, reg_sites = {1052077216, 31758, 81, 0}, access_size = 140723930734768, size = 69 'E'}, wild = {addr = 0, access_size = 0}}}}}, CallocOverflow = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000\311\262u\217\303\356Znal] org\240\035\347\327\374\177\000\000P\023\347\327\374\177\000\000.|\342?\256\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\320\033\347\327\374\177\000\000\211]\331?\256\177\000\000\214\023\347\327\374\177\000\000\214\023\347\327\374\177\000\000\214\033\347\327\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\256\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, count = 137568854082571, size = 0}, ReallocArrayOverflow = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000\311\262u\217\303\356Znal] org\240\035\347\327\374\177\000\000P\023\347\327\374\177\000\000.|\342?\256\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\320\033\347\327\374\177\000\000\211]\331?\256\177\000\000\214\023\347\327\374\177\000\000\214\023\347\327\374\177\000\000\214\033\347\327\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\256\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, count = 137568854082571, size = 0}, PvallocOverflow = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000\311\262u\217\303\356Znal] org\240\035\347\327\374\177\000\000P\023\347\327\374\177\000\000.|\342?\256\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\320\033\347\327\374\177\000\000\211]\331?\256\177\000\000\214\023\347\327\374\177\000\000\214\023\347\327\374\177\000\000\214\033\347\327\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\256\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, size = 137568854082571}, InvalidAllocationAlignment = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000\311\262u\217\303\356Znal] org\240\035\347\327\374\177\000\000P\023\347\327\374\177\000\000.|\342?\256\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\320\033\347\327\374\177\000\000\211]\331?\256\177\000\000\214\023\347\327\374\177\000\000\214\023\347\327\374\177\000\000\214\033\347\327\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\256\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, alignment = 137568854082571}, InvalidAlignedAllocAlignment = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000\311\262u\217\303\356Znal] org\240\035\347\327\374\177\000\000P\023\347\327\374\177\000\000.|\342?\256\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\320\033\347\327\374\177\000\000\211]\331?\256\177\000\000\214\023\347\327\374\177\000\000\214\023\347\327\374\177\000\000\214\033\347\327\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\256\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, size = 137568854082571, alignment = 0}, InvalidPosixMemalignAlignment = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000\311\262u\217\303\356Znal] org\240\035\347\327\374\177\000\000P\023\347\327\374\177\000\000.|\342?\256\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\320\033\347\327\374\177\000\000\211]\331?\256\177\000\000\214\023\347\327\374\177\000\000\214\023\347\327\374\177\000\000\214\033\347\327\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\256\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, alignment = 137568854082571}, AllocationSizeTooBig = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000\311\262u\217\303\356Znal] org\240\035\347\327\374\177\000\000P\023\347\327\374\177\000\000.|\342?\256\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\320\033\347\327\374\177\000\000\211]\331?\256\177\000\000\214\023\347\327\374\177\000\000\214\023\347\327\374\177\000\000\214\033\347\327\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\256\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, user_size = 137568854082571, total_size = 0, max_size = 0}, RssLimitExceeded = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000\311\262u\217\303\356Znal] org\240\035\347\327\374\177\000\000P\023\347\327\374\177\000\000.|\342?\256\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\320\033\347\327\374\177\000\000\211]\331?\256\177\000\000\214\023\347\327\374\177\000\000\214\023\347\327\374\177\000\000\214\033\347\327\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\256\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002}, OutOfMemory = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000\311\262u\217\303\356Znal] org\240\035\347\327\374\177\000\000P\023\347\327\374\177\000\000.|\342?\256\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\320\033\347\327\374\177\000\000\211]\331?\256\177\000\000\214\023\347\327\374\177\000\000\214\023\347\327\374\177\000\000\214\033\347\327\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\256\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, requested_size = 137568854082571}, StringFunctionMemoryRangesOverlap = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000\311\262u\217\303\356Znal] org\240\035\347\327\374\177\000\000P\023\347\327\374\177\000\000.|\342?\256\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\320\033\347\327\374\177\000\000\211]\331?\256\177\000\000\214\023\347\327\374\177\000\000\214\023\347\327\374\177\000\000\214\033\347\327\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\256\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, length1 = 137568854082571, length2 = 0, addr1_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 11836929869373, kind = (__asan::kShadowKindGap | __asan::kShadowKindHigh | unknown: 0x8), shadow_byte = 4 '\004'}, heap = {addr = 11836929869373, alloc_tid = 137568854082571, free_tid = 11, alloc_stack_id = 1051591680, free_stack_id = 32030, chunk_access = {bad_addr = 752, offset = 140723930750984, chunk_begin = 135988287545120, chunk_size = 140723930732384, user_requested_alignment = 2847, access_type = 3, alloc_type = 0}}, stack = {addr = 11836929869373, tid = 137568854082571, offset = 11, frame_pc = 137568854082560, access_size = 752, frame_descr = 0x7ffcd7e76008 <error: Cannot access memory at address 0x7ffcd7e76008>}, global = {addr = 11836929869373, static kMaxGlobals = 4, globals = {{beg = 137568854082571, size = 11, size_with_redzone = 137568854082560, name = 0x2f0 <error: Cannot access memory at address 0x2f0>, module_name = 0x7ffcd7e76008 <error: Cannot access memory at address 0x7ffcd7e76008>, has_dynamic_init = 135988287545120, gcc_location = 0x7ffcd7e71760, odr_indicator = 140386384558879}, {beg = 1, size = 135988287545120, size_with_redzone = 140723930734512, name = 0x7fae40a3d5d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", module_name = 0x7fae3f2330d0 "", has_dynamic_init = 132471265216, gcc_location = 0x7ffcd7e71790, odr_indicator = 3}, {beg = 140386385516048, size = 140386372246415, size_with_redzone = 93834153031691, name = 0x7ffcd7e72270 "\024$\347\327\374\177", module_name = 0x7ffcd7e71850 "\030", has_dynamic_init = 2, gcc_location = 0x7fae40aebfc0 <__asan::instance>, odr_indicator = 136400623463568}, {beg = 140723930732576, size = 140386384582456, size_with_redzone = 62, name = 0x7c0e3eb56c90 "\003\021", module_name = 0x7fae3f2330d0 "", has_dynamic_init = 140723930732608, gcc_location = 0x7c0e3eb56ca0, odr_indicator = 81}}, reg_sites = {3622248624, 32764, 1084224581, 32686}, access_size = 140723930736592, size = 120 'x'}, wild = {addr = 11836929869373, access_size = 137568854082571}}}}, addr2_description = {data = {kind = 6, {shadow = {addr = 140386385942423, kind = __asan::kShadowKindLow, shadow_byte = 253 '\375'}, heap = {addr = 140386385942423, alloc_tid = 140386386246912, free_tid = 140723930736144, alloc_stack_id = 1084478930, free_stack_id = 32686, chunk_access = {bad_addr = 8315162673665959470, offset = 130735371371, chunk_begin = 140723930734064, chunk_size = 3, user_requested_alignment = 1552, access_type = 1, alloc_type = 3}}, stack = {addr = 140386385942423, tid = 140386386246912, offset = 140723930736144, frame_pc = 140386385515986, access_size = 8315162673665959470, frame_descr = 0x1e706f746b <error: Cannot access memory at address 0x1e706f746b>}, global = {addr = 140386385942423, static kMaxGlobals = 4, globals = {{beg = 140386386246912, size = 140723930736144, size_with_redzone = 140386385515986, name = 0x736564656572662e <error: Cannot access memory at address 0x736564656572662e>, module_name = 0x1e706f746b <error: Cannot access memory at address 0x1e706f746b>, has_dynamic_init = 140723930734064, gcc_location = 0x3, odr_indicator = 140386385516048}, {beg = 140386372246415, size = 93834153031691, size_with_redzone = 140723930736848, name = 0x7ffcd7e71e70 "\220\036\347\327\374\177", module_name = 0x7fae40ae5f78 "\001", has_dynamic_init = 140723930734256, gcc_location = 0x5557777005e0, odr_indicator = 140386364201144}, {beg = 65535, size = 140723930734176, size_with_redzone = 140386385347417, name = 0x40 <error: Cannot access memory at address 0x40>, module_name = 0x7bae3db55600 "\0166\340E", has_dynamic_init = 140723930734224, gcc_location = 0x7fae4096074a <__asan_stack_malloc_0(__sanitizer::uptr)+234>, odr_indicator = 140723930734224}, {beg = 140386385772413, size = 140723930734256, size_with_redzone = 140386385616230, name = 0x7ffcd7e71f30 "", module_name = 0x2 <error: Cannot access memory at address 0x2>, has_dynamic_init = 140386386231232, gcc_location = 0x7bee3eb4c640, odr_indicator = 140723930734336}}, reg_sites = {1083545400, 32686, 40, 0}, access_size = 140386385721885, size = 208 '\320'}, wild = {addr = 140386385942423, access_size = 140386386246912}}}}, function = 0x7ffcd7e71f20 "\320'\347\327\374\177"}, StringFunctionSizeOverflow = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000\311\262u\217\303\356Znal] org\240\035\347\327\374\177\000\000P\023\347\327\374\177\000\000.|\342?\256\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\320\033\347\327\374\177\000\000\211]\331?\256\177\000\000\214\023\347\327\374\177\000\000\214\023\347\327\374\177\000\000\214\033\347\327\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\256\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, addr_description = {data = {kind = 1051591691, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11836929869373, alloc_stack_id = 1051591691, free_stack_id = 32030, chunk_access = {bad_addr = 11, offset = 137568854082560, chunk_begin = 752, chunk_size = 140723930750984, user_requested_alignment = 3872, access_type = 1, alloc_type = 2}}, stack = {addr = 0, tid = 0, offset = 11836929869373, frame_pc = 137568854082571, access_size = 11, frame_descr = 0x7d1e3eae0400 "\304\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11836929869373, size_with_redzone = 137568854082571, name = 0xb <error: Cannot access memory at address 0xb>, module_name = 0x7d1e3eae0400 "\304\n", has_dynamic_init = 752, gcc_location = 0x7ffcd7e76008, odr_indicator = 135988287545120}, {beg = 140723930732384, size = 140386384558879, size_with_redzone = 1, name = 0x7bae3d929f20 "`m\265>\016|", module_name = 0x7ffcd7e71fb0 "\300\037\347\327\374\177", has_dynamic_init = 140386385515986, gcc_location = 0x7fae3f2330d0, odr_indicator = 132471265216}, {beg = 140723930732432, size = 3, size_with_redzone = 140386385516048, name = 0x7fae3fd95b8f <__vasprintf_internal+255> "I\211\004$H\205\300t(H\213\265\330\376\377\377L\211\352H\211\307\350\366\032\371\377H\211\301\353\212\350\254\346\n", module_name = 0x5557775bf80b <bt_log_vprintf+171> "\205\300\017\210=\001", has_dynamic_init = 140723930735216, gcc_location = 0x7ffcd7e71850, odr_indicator = 2}, {beg = 140386386231232, size = 136400623463568, size_with_redzone = 140723930732576, name = 0x7fae40959738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", module_name = 0x3e <error: Cannot access memory at address 0x3e>, has_dynamic_init = 136400623463568, gcc_location = 0x7fae3f2330d0, odr_indicator = 140723930732608}}, reg_sites = {1052077216, 31758, 81, 0}, access_size = 140723930734768, size = 69 'E'}, wild = {addr = 0, access_size = 0}}}}, size = 140723930736592}, BadParamsToAnnotateContiguousContainer = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000\311\262u\217\303\356Znal] org\240\035\347\327\374\177\000\000P\023\347\327\374\177\000\000.|\342?\256\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\320\033\347\327\374\177\000\000\211]\331?\256\177\000\000\214\023\347\327\374\177\000\000\214\023\347\327\374\177\000\000\214\033\347\327\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\256\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, beg = 137568854082571, end = 0, old_mid = 0, new_mid = 11836929869373}, BadParamsToAnnotateDoubleEndedContiguousContainer = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000\311\262u\217\303\356Znal] org\240\035\347\327\374\177\000\000P\023\347\327\374\177\000\000.|\342?\256\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\320\033\347\327\374\177\000\000\211]\331?\256\177\000\000\214\023\347\327\374\177\000\000\214\023\347\327\374\177\000\000\214\033\347\327\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\256\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, storage_beg = 137568854082571, storage_end = 0, old_container_beg = 0, old_container_end = 11836929869373, new_container_beg = 137568854082571, new_container_end = 11}, BadParamsToCopyContiguousContainerAnnotations = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000\311\262u\217\303\356Znal] org\240\035\347\327\374\177\000\000P\023\347\327\374\177\000\000.|\342?\256\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\320\033\347\327\374\177\000\000\211]\331?\256\177\000\000\214\023\347\327\374\177\000\000\214\023\347\327\374\177\000\000\214\033\347\327\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\256\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, old_storage_beg = 137568854082571, old_storage_end = 0, new_storage_beg = 0, new_storage_end = 11836929869373}, ODRViolation = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000\311\262u\217\303\356Znal] org\240\035\347\327\374\177\000\000P\023\347\327\374\177\000\000.|\342?\256\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\320\033\347\327\374\177\000\000\211]\331?\256\177\000\000\214\023\347\327\374\177\000\000\214\023\347\327\374\177\000\000\214\033\347\327\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\256\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, global1 = {beg = 18446744069414584322, size = 137568854082571, size_with_redzone = 0, name = 0x0, module_name = 0xac40000063d <error: Cannot access memory at address 0xac40000063d>, has_dynamic_init = 137568854082571, gcc_location = 0xb, odr_indicator = 137568854082560}, global2 = {beg = 752, size = 140723930750984, size_with_redzone = 135988287545120, name = 0x7ffcd7e71760 "\260\037\347\327\374\177", module_name = 0x7fae40953b1f <__asan::asan_malloc(unsigned long, __sanitizer::BufferedStackTrace*)+47> "H\205\300t\f\311\303f.\017\037\204", has_dynamic_init = 1, gcc_location = 0x7bae3d929f20, odr_indicator = 140723930734512}, stack_id1 = 1084478930, stack_id2 = 32686}, InvalidPointerPair = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000\311\262u\217\303\356Znal] org\240\035\347\327\374\177\000\000P\023\347\327\374\177\000\000.|\342?\256\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\320\033\347\327\374\177\000\000\211]\331?\256\177\000\000\214\023\347\327\374\177\000\000\214\023\347\327\374\177\000\000\214\033\347\327\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\256\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, pc = 18446744069414584322, bp = 137568854082571, sp = 0, addr1_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 11836929869373, kind = (__asan::kShadowKindGap | __asan::kShadowKindHigh | unknown: 0x8), shadow_byte = 4 '\004'}, heap = {addr = 11836929869373, alloc_tid = 137568854082571, free_tid = 11, alloc_stack_id = 1051591680, free_stack_id = 32030, chunk_access = {bad_addr = 752, offset = 140723930750984, chunk_begin = 135988287545120, chunk_size = 140723930732384, user_requested_alignment = 2847, access_type = 3, alloc_type = 0}}, stack = {addr = 11836929869373, tid = 137568854082571, offset = 11, frame_pc = 137568854082560, access_size = 752, frame_descr = 0x7ffcd7e76008 <error: Cannot access memory at address 0x7ffcd7e76008>}, global = {addr = 11836929869373, static kMaxGlobals = 4, globals = {{beg = 137568854082571, size = 11, size_with_redzone = 137568854082560, name = 0x2f0 <error: Cannot access memory at address 0x2f0>, module_name = 0x7ffcd7e76008 <error: Cannot access memory at address 0x7ffcd7e76008>, has_dynamic_init = 135988287545120, gcc_location = 0x7ffcd7e71760, odr_indicator = 140386384558879}, {beg = 1, size = 135988287545120, size_with_redzone = 140723930734512, name = 0x7fae40a3d5d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", module_name = 0x7fae3f2330d0 "", has_dynamic_init = 132471265216, gcc_location = 0x7ffcd7e71790, odr_indicator = 3}, {beg = 140386385516048, size = 140386372246415, size_with_redzone = 93834153031691, name = 0x7ffcd7e72270 "\024$\347\327\374\177", module_name = 0x7ffcd7e71850 "\030", has_dynamic_init = 2, gcc_location = 0x7fae40aebfc0 <__asan::instance>, odr_indicator = 136400623463568}, {beg = 140723930732576, size = 140386384582456, size_with_redzone = 62, name = 0x7c0e3eb56c90 "\003\021", module_name = 0x7fae3f2330d0 "", has_dynamic_init = 140723930732608, gcc_location = 0x7c0e3eb56ca0, odr_indicator = 81}}, reg_sites = {3622248624, 32764, 1084224581, 32686}, access_size = 140723930736592, size = 120 'x'}, wild = {addr = 11836929869373, access_size = 137568854082571}}}}, addr2_description = {data = {kind = 6, {shadow = {addr = 140386385942423, kind = __asan::kShadowKindLow, shadow_byte = 253 '\375'}, heap = {addr = 140386385942423, alloc_tid = 140386386246912, free_tid = 140723930736144, alloc_stack_id = 1084478930, free_stack_id = 32686, chunk_access = {bad_addr = 8315162673665959470, offset = 130735371371, chunk_begin = 140723930734064, chunk_size = 3, user_requested_alignment = 1552, access_type = 1, alloc_type = 3}}, stack = {addr = 140386385942423, tid = 140386386246912, offset = 140723930736144, frame_pc = 140386385515986, access_size = 8315162673665959470, frame_descr = 0x1e706f746b <error: Cannot access memory at address 0x1e706f746b>}, global = {addr = 140386385942423, static kMaxGlobals = 4, globals = {{beg = 140386386246912, size = 140723930736144, size_with_redzone = 140386385515986, name = 0x736564656572662e <error: Cannot access memory at address 0x736564656572662e>, module_name = 0x1e706f746b <error: Cannot access memory at address 0x1e706f746b>, has_dynamic_init = 140723930734064, gcc_location = 0x3, odr_indicator = 140386385516048}, {beg = 140386372246415, size = 93834153031691, size_with_redzone = 140723930736848, name = 0x7ffcd7e71e70 "\220\036\347\327\374\177", module_name = 0x7fae40ae5f78 "\001", has_dynamic_init = 140723930734256, gcc_location = 0x5557777005e0, odr_indicator = 140386364201144}, {beg = 65535, size = 140723930734176, size_with_redzone = 140386385347417, name = 0x40 <error: Cannot access memory at address 0x40>, module_name = 0x7bae3db55600 "\0166\340E", has_dynamic_init = 140723930734224, gcc_location = 0x7fae4096074a <__asan_stack_malloc_0(__sanitizer::uptr)+234>, odr_indicator = 140723930734224}, {beg = 140386385772413, size = 140723930734256, size_with_redzone = 140386385616230, name = 0x7ffcd7e71f30 "", module_name = 0x2 <error: Cannot access memory at address 0x2>, has_dynamic_init = 140386386231232, gcc_location = 0x7bee3eb4c640, odr_indicator = 140723930734336}}, reg_sites = {1083545400, 32686, 40, 0}, access_size = 140386385721885, size = 208 '\320'}, wild = {addr = 140386385942423, access_size = 140386386246912}}}}}, Generic = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000\311\262u\217\303\356Znal] org\240\035\347\327\374\177\000\000P\023\347\327\374\177\000\000.|\342?\256\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\320\033\347\327\374\177\000\000\211]\331?\256\177\000\000\214\023\347\327\374\177\000\000\214\023\347\327\374\177\000\000\214\033\347\327\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\256\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, addr_description = {data = {kind = __asan::kAddressKindHeap, {shadow = {addr = 137568854082571, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 137568854082571, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1597, free_stack_id = 2756, chunk_access = {bad_addr = 137568854082571, offset = 11, chunk_begin = 137568854082560, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, stack = {addr = 137568854082571, tid = 0, offset = 0, frame_pc = 11836929869373, access_size = 137568854082571, frame_descr = 0xb <error: Cannot access memory at address 0xb>}, global = {addr = 137568854082571, static kMaxGlobals = 4, globals = {{beg = 0, size = 0, size_with_redzone = 11836929869373, name = 0x7d1e3eae040b "B", module_name = 0xb <error: Cannot access memory at address 0xb>, has_dynamic_init = 137568854082560, gcc_location = 0x2f0, odr_indicator = 140723930750984}, {beg = 135988287545120, size = 140723930732384, size_with_redzone = 140386384558879, name = 0x1 <error: Cannot access memory at address 0x1>, module_name = 0x7bae3d929f20 "`m\265>\016|", has_dynamic_init = 140723930734512, gcc_location = 0x7fae40a3d5d2 <___interceptor_malloc(__sanitizer::uptr)+130>, odr_indicator = 140386360307920}, {beg = 132471265216, size = 140723930732432, size_with_redzone = 3, name = 0x7fae40a3d610 <___interceptor_malloc(__sanitizer::uptr)+192> "D\213\215\314\367\377\377E\205\311tTH\211m\330A\203\371\001t*E\017\276\3061\311H\211\352H\211\306H\215\275\320\367\377\377\350\"\004\001", module_name = 0x7fae3fd95b8f <__vasprintf_internal+255> "I\211\004$H\205\300t(H\213\265\330\376\377\377L\211\352H\211\307\350\366\032\371\377H\211\301\353\212\350\254\346\n", has_dynamic_init = 93834153031691, gcc_location = 0x7ffcd7e72270, odr_indicator = 140723930732624}, {beg = 2, size = 140386386231232, size_with_redzone = 136400623463568, name = 0x7ffcd7e71820 "\320'\347\327\374\177", module_name = 0x7fae40959738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", has_dynamic_init = 62, gcc_location = 0x7c0e3eb56c90, odr_indicator = 140386360307920}}, reg_sites = {3622246464, 32764, 1052077216, 31758}, access_size = 81, size = 176 '\260'}, wild = {addr = 137568854082571, access_size = 0}}}}, pc = 140386385261637, bp = 140723930736592, sp = 140723930734456, access_size = 6, bug_descr = 0x7fae40aa5797 "heap-use-after-free", is_write = false, shadow_val = 253 '\375'}}}, halt_on_error_ = true}
                error = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000\311\262u\217\303\356Znal] org\240\035\347\327\374\177\000\000P\023\347\327\374\177\000\000.|\342?\256\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\320\033\347\327\374\177\000\000\211]\331?\256\177\000\000\214\023\347\327\374\177\000\000\214\023\347\327\374\177\000\000\214\033\347\327\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\256\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, addr_description = {data = {kind = __asan::kAddressKindHeap, {shadow = {addr = 137568854082571, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 137568854082571, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1597, free_stack_id = 2756, chunk_access = {bad_addr = 137568854082571, offset = 11, chunk_begin = 137568854082560, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, stack = {addr = 137568854082571, tid = 0, offset = 0, frame_pc = 11836929869373, access_size = 137568854082571, frame_descr = 0xb <error: Cannot access memory at address 0xb>}, global = {addr = 137568854082571, static kMaxGlobals = 4, globals = {{beg = 0, size = 0, size_with_redzone = 11836929869373, name = 0x7d1e3eae040b "B", module_name = 0xb <error: Cannot access memory at address 0xb>, has_dynamic_init = 137568854082560, gcc_location = 0x2f0, odr_indicator = 140723930750984}, {beg = 135988287545120, size = 140723930732384, size_with_redzone = 140386384558879, name = 0x1 <error: Cannot access memory at address 0x1>, module_name = 0x7bae3d929f20 "`m\265>\016|", has_dynamic_init = 140723930734512, gcc_location = 0x7fae40a3d5d2 <___interceptor_malloc(__sanitizer::uptr)+130>, odr_indicator = 140386360307920}, {beg = 132471265216, size = 140723930732432, size_with_redzone = 3, name = 0x7fae40a3d610 <___interceptor_malloc(__sanitizer::uptr)+192> "D\213\215\314\367\377\377E\205\311tTH\211m\330A\203\371\001t*E\017\276\3061\311H\211\352H\211\306H\215\275\320\367\377\377\350\"\004\001", module_name = 0x7fae3fd95b8f <__vasprintf_internal+255> "I\211\004$H\205\300t(H\213\265\330\376\377\377L\211\352H\211\307\350\366\032\371\377H\211\301\353\212\350\254\346\n", has_dynamic_init = 93834153031691, gcc_location = 0x7ffcd7e72270, odr_indicator = 140723930732624}, {beg = 2, size = 140386386231232, size_with_redzone = 136400623463568, name = 0x7ffcd7e71820 "\320'\347\327\374\177", module_name = 0x7fae40959738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", has_dynamic_init = 62, gcc_location = 0x7c0e3eb56c90, odr_indicator = 140386360307920}}, reg_sites = {3622246464, 32764, 1052077216, 31758}, access_size = 81, size = 176 '\260'}, wild = {addr = 137568854082571, access_size = 0}}}}, pc = 140386385261637, bp = 140723930736592, sp = 140723930734456, access_size = 6, bug_descr = 0x7fae40aa5797 "heap-use-after-free", is_write = false, shadow_val = 253 '\375'}
        #9  0x00007fae40a49f8d in __asan::ReportGenericError (pc=<optimized out>, bp=bp@entry=140723930736592, sp=sp@entry=140723930734456, addr=addr@entry=137568854082571, is_write=is_write@entry=false, access_size=access_size@entry=6, exp=<optimized out>, fatal=false) at ../../../../src/libsanitizer/asan/asan_report.cpp:536
                in_report = <optimized out>
                error = <optimized out>
                enable_fp = <optimized out>
        #10 0x00007fae409ff468 in MemcmpInterceptorCommon (ctx=ctx@entry=0x7ffcd7e727e0, real_fn=<optimized out>, a1=a1@entry=0x7d1e3eae040b, a2=a2@entry=0x7bae3d88aae0, size=size@entry=6) at ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:848
                bp = 140723930736592
                pc = <optimized out>
                local_stack = 137225256697920
                sp = 140723930734456
                _ctx = 0x7ffcd7e727e0
                suppressed = <optimized out>
                __offset = 137568854082571
                __size = 6
                __bad = <optimized out>
                result = <optimized out>
        #11 0x00007fae409ff835 in ___interceptor_memcmp (a1=0x7d1e3eae040b, a2=0x7bae3d88aae0, size=6) at ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:880
                ctx = 0x7ffcd7e727e0
                _ctx = {interceptor_name = 0x7fae40aa96b6 "memcmp"}
        #12 ___interceptor_memcmp (a1=0x7d1e3eae040b, a2=0x7bae3d88aae0, size=6) at ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:875
                ctx = <optimized out>
                _ctx = <optimized out>
        #13 0x00005557774a32e8 in bacmp (ba1=0x7d1e3eae040b, ba2=0x7bae3d88aae0) at ./lib/bluetooth/bluetooth.h:438
        No locals.
        #14 device_addr_type_cmp (a=0x7d1e3eae0400, b=0x7bae3d88aae0) at src/device.c:5661
                dev = 0x7d1e3eae0400
                addr = 0x7bae3d88aae0
                cmp = <optimized out>
        #15 0x00007fae407794c2 in g_slist_find_custom () from /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
        No symbol table info available.
        #16 0x0000555777422824 in btd_adapter_find_device (adapter=<optimized out>, dst=dst@entry=0x7bee3eb23558, bdaddr_type=1 '\001') at src/adapter.c:1055
                addr = <optimized out>
                device = <optimized out>
                list = <optimized out>
        #17 0x00005557773c4d37 in att_disconnected (err=<optimized out>, user_data=0x7bee3eb23550) at src/gatt-database.c:335
                state = 0x7bee3eb23550
                device = <optimized out>
                __func__ = "att_disconnected"
        #18 0x00005557773dbc64 in btd_gatt_database_att_disconnected (database=<optimized out>, device=<optimized out>) at src/gatt-database.c:4238
                server = <optimized out>
                att = <optimized out>
                state = <optimized out>
                addr = <optimized out>
                type = <optimized out>
                __func__ = "btd_gatt_database_att_disconnected"
        #19 0x0000555777485346 in gatt_server_cleanup (device=device@entry=0x7d1e3eae0080) at src/device.c:842
        No locals.
        #20 0x0000555777499b9c in attio_cleanup (device=0x7d1e3eae0080) at src/device.c:862
        No locals.
        #21 0x000055577749a1e7 in device_free (user_data=0x7d1e3eae0080) at src/device.c:918
                device = 0x7d1e3eae0080
                __func__ = "device_free"
        #22 0x0000555777517cea in remove_interface (data=0x7c1e3eaeb000, name=name@entry=0x555777724cc0 "org.bluez.Device1") at gdbus/object.c:742
                iface = 0x7c0e3eafe380
        #23 0x000055577751a8ac in g_dbus_unregister_interface (connection=<optimized out>, path=<optimized out>, name=<optimized out>) at gdbus/object.c:1499
                data = <optimized out>
        #24 0x0000555777455573 in adapter_remove (adapter=adapter@entry=0x7cde3eae0200) at src/adapter.c:7354
                l = 0x7bce3eb0b3f0 = {0x7d1e3eae0080}
                db = <optimized out>
                ranging_manager = <optimized out>
                __func__ = "adapter_remove"
        #25 0x0000555777456108 in adapter_cleanup () at src/adapter.c:11309
                adapter = 0x7cde3eae0200
        #26 0x0000555777207410 in main (argc=<optimized out>, argv=<optimized out>) at src/main.c:1723
                context = <optimized out>
                err = <optimized out>
                sdp_mtu = 0
                sdp_flags = <optimized out>
                gdbus_flags = <optimized out>
                __func__ = "main""
FAIL functional.test_bap::test_bap_unicast_set_transport_acquire[hosts8-vm3]: failed on setup with "pytest_bluezenv.rpc.RemoteTimeoutError: Connection recv timed out"
FAIL functional.test_bap::test_bap_unicast_set_transport_acquire[hosts8-vm3]: failed on teardown with "pytest_bluezenv.plugin.CoredumpWarning: Core dump: test-bluezenv-hosts8.0-bluetoothd-1789666760-69.core
        /usr/bin/gdb: warning: Couldn't determine a path for the index cache directory.
        [New LWP 69]
        [Thread debugging using libthread_db enabled]
        Using host libthread_db library "/usr/lib/x86_64-linux-gnu/libthread_db.so.1".
        Core was generated by `/home/runner/work/bluez/bluez/src/src/src/bluetoothd --nodetach -f /run/bluetoo'.
        Program terminated with signal SIGABRT, Aborted.
        #0  __pthread_kill_implementation (threadid=<optimized out>, signo=6, no_tid=0) at ./nptl/pthread_kill.c:44

        warning: 44	./nptl/pthread_kill.c: No such file or directory

        Thread 1 (Thread 0x7fadcf146900 (LWP 69)):
        #0  __pthread_kill_implementation (threadid=<optimized out>, signo=6, no_tid=0) at ./nptl/pthread_kill.c:44
                tid = <optimized out>
                ret = 0
                pd = <optimized out>
                old_mask = {__val = {4412750543122677053}}
                ret = <optimized out>
        #1  __pthread_kill_internal (threadid=<optimized out>, signo=6) at ./nptl/pthread_kill.c:89
        No locals.
        #2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ./nptl/pthread_kill.c:100
        No locals.
        #3  0x00007fadcf8a1b7e in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
                ret = <optimized out>
        #4  0x00007fadcf8848ec in __GI_abort () at ./stdlib/abort.c:77
                act = {__sigaction_handler = {sa_handler = 0x4, sa_sigaction = 0x4}, sa_mask = {__val = {135986396794672, 135986396794528, 7984245523681563136, 140731357807824, 140731357808112, 140731357807968, 22, 140384484907984, 0, 140731357807904, 140384501753366, 140384472064000, 4096, 0, 7984245523681563136, 140384476246040}}, sa_flags = -792932352, sa_restorer = 0x16}
        #5  0x00007fadd04aca0f in __sanitizer::Abort () at ../../../../src/libsanitizer/sanitizer_common/sanitizer_posix_libcdep.cpp:165
        No locals.
        #6  0x00007fadd05d2c2d in __sanitizer::Die () at ../../../../src/libsanitizer/sanitizer_common/sanitizer_termination.cpp:58
        No locals.
        #7  0x00007fadd05a793c in __asan::ScopedInErrorReport::~ScopedInErrorReport (this=0x7ffe92974696) at ../../../../src/libsanitizer/asan/asan_report.cpp:221
                buffer_copy = {buffer_ = {<__sanitizer::InternalMmapVectorNoCtor<char, false>> = {data_ = 0x7fadce95e000 '=' <repeats 65 times>, "\n==69==ERROR: AddressSanitizer: heap-use-after-free on address 0x7d1dce5e0208 at pc 0x55ef26a4a14c bp 0x7ffe92975310 sp 0x7ffe92975300\n"..., capacity_bytes_ = 4096, size_ = 3419}, <No data fields>}}
                buffer_copy = <optimized out>
                l = <optimized out>
        #8  0x00007fadd05a6e02 in __asan::ReportGenericError (pc=94485633868108, bp=140731357811472, sp=sp@entry=140731357811456, addr=137566969790984, is_write=is_write@entry=false, access_size=8, fatal=true, exp=<optimized out>) at ../../../../src/libsanitizer/asan/asan_report.cpp:536
                in_report = {error_report_lock_ = {<No data fields>}, static current_error_ = {kind = __asan::kErrorKindGeneric, {Base = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\255{\000\000\377\000\000\000\000\000\000\000@\033\322&\357U\000\000f-[\320\255\177\000\000\200G\227\222\376\177\000\000\002\000\000\000\000\000\000\000\300\217d\320\255\177\000\000\220\003_\316-|\000\000PG\227\222\376\177\000\0008gK\320\255\177\000\000^\000\000\000\000\000\000\000\220\003_\316-|\000\000\320\000\331\316\255\177\000\000pG\227\222\376\177\000\000\240\003_\316-|\000\000q\000\000\000\000\000\000\000\340O\227\222\376\177\000\000^\000\000\000\000\000\000\000\240O\227\222\376\177\000\000\301\223Y\320\255\177\000\000b:\313&\357U\000\000\270\377\377\377"...}, tid = 0}, DeadlySignal = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\255{\000\000\377\000\000\000\000\000\000\000@\033\322&\357U\000\000f-[\320\255\177\000\000\200G\227\222\376\177\000\000\002\000\000\000\000\000\000\000\300\217d\320\255\177\000\000\220\003_\316-|\000\000PG\227\222\376\177\000\0008gK\320\255\177\000\000^\000\000\000\000\000\000\000\220\003_\316-|\000\000\320\000\331\316\255\177\000\000pG\227\222\376\177\000\000\240\003_\316-|\000\000q\000\000\000\000\000\000\000\340O\227\222\376\177\000\000^\000\000\000\000\000\000\000\240O\227\222\376\177\000\000\301\223Y\320\255\177\000\000b:\313&\357U\000\000\270\377\377\377"...}, tid = 0}, signal = {siginfo = 0x7ffe00000002, context = 0x7d1dce5e0208, addr = 0, pc = 0, sp = 11093900527092, bp = 137566969790984, is_memory_access = 136, write_flag = __sanitizer::SignalContext::Unknown, is_true_faulting_addr = 128}}, DoubleFree = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\255{\000\000\377\000\000\000\000\000\000\000@\033\322&\357U\000\000f-[\320\255\177\000\000\200G\227\222\376\177\000\000\002\000\000\000\000\000\000\000\300\217d\320\255\177\000\000\220\003_\316-|\000\000PG\227\222\376\177\000\0008gK\320\255\177\000\000^\000\000\000\000\000\000\000\220\003_\316-|\000\000\320\000\331\316\255\177\000\000pG\227\222\376\177\000\000\240\003_\316-|\000\000q\000\000\000\000\000\000\000\340O\227\222\376\177\000\000^\000\000\000\000\000\000\000\240O\227\222\376\177\000\000\301\223Y\320\255\177\000\000b:\313&\357U\000\000\270\377\377\377"...}, tid = 0}, second_free_stack = 0x7ffe00000002, addr_description = {addr = 137566969790984, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1524, free_stack_id = 2583, chunk_access = {bad_addr = 137566969790984, offset = 392, chunk_begin = 137566969790592, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}}, NewDeleteTypeMismatch = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\255{\000\000\377\000\000\000\000\000\000\000@\033\322&\357U\000\000f-[\320\255\177\000\000\200G\227\222\376\177\000\000\002\000\000\000\000\000\000\000\300\217d\320\255\177\000\000\220\003_\316-|\000\000PG\227\222\376\177\000\0008gK\320\255\177\000\000^\000\000\000\000\000\000\000\220\003_\316-|\000\000\320\000\331\316\255\177\000\000pG\227\222\376\177\000\000\240\003_\316-|\000\000q\000\000\000\000\000\000\000\340O\227\222\376\177\000\000^\000\000\000\000\000\000\000\240O\227\222\376\177\000\000\301\223Y\320\255\177\000\000b:\313&\357U\000\000\270\377\377\377"...}, tid = 0}, free_stack = 0x7ffe00000002, addr_description = {addr = 137566969790984, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1524, free_stack_id = 2583, chunk_access = {bad_addr = 137566969790984, offset = 392, chunk_begin = 137566969790592, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, delete_size = 140384500648735, delete_alignment = 1}, FreeNotMalloced = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\255{\000\000\377\000\000\000\000\000\000\000@\033\322&\357U\000\000f-[\320\255\177\000\000\200G\227\222\376\177\000\000\002\000\000\000\000\000\000\000\300\217d\320\255\177\000\000\220\003_\316-|\000\000PG\227\222\376\177\000\0008gK\320\255\177\000\000^\000\000\000\000\000\000\000\220\003_\316-|\000\000\320\000\331\316\255\177\000\000pG\227\222\376\177\000\000\240\003_\316-|\000\000q\000\000\000\000\000\000\000\340O\227\222\376\177\000\000^\000\000\000\000\000\000\000\240O\227\222\376\177\000\000\301\223Y\320\255\177\000\000b:\313&\357U\000\000\270\377\377\377"...}, tid = 0}, free_stack = 0x7ffe00000002, addr_description = {data = {kind = 3462267400, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11093900527092, alloc_stack_id = 3462267400, free_stack_id = 32029, chunk_access = {bad_addr = 392, offset = 137566969790592, chunk_begin = 752, chunk_size = 140731357814792, user_requested_alignment = 2847, access_type = 0, alloc_type = 0}}, stack = {addr = 0, tid = 0, offset = 11093900527092, frame_pc = 137566969790984, access_size = 392, frame_descr = 0x7d1dce5e0080 "\027\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11093900527092, size_with_redzone = 137566969790984, name = 0x188 <error: Cannot access memory at address 0x188>, module_name = 0x7d1dce5e0080 "\027\n", has_dynamic_init = 752, gcc_location = 0x7ffe92976008, odr_indicator = 140384500648735}, {beg = 1, size = 136811055693888, size_with_redzone = 140731357811552, name = 0x7fadd059a5d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", module_name = 0x3 <error: Cannot access memory at address 0x3>, has_dynamic_init = 132319346688, gcc_location = 0x7ffe92974b40, odr_indicator = 2}, {beg = 140384501605904, size = 94485634427206, size_with_redzone = 140731357809648, name = 0x7 <error: Cannot access memory at address 0x7>, module_name = 0x7fadd0648fc0 <__asan::instance> "", has_dynamic_init = 136123861852032, gcc_location = 0x7ffe92974bc0, odr_indicator = 140384501706086}, {beg = 140731357809696, size = 6, size_with_redzone = 140384502321088, name = 0x7c6dce616ff0 "\003\021", module_name = 0x7ffe92974bf0 "\b", has_dynamic_init = 140384500672312, gcc_location = 0x78, odr_indicator = 136811055771632}}, reg_sites = {2459388896, 32766, 3482861934, 32685}, access_size = 0, size = 76 'L'}, wild = {addr = 0, access_size = 0}}}}}, AllocTypeMismatch = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\255{\000\000\377\000\000\000\000\000\000\000@\033\322&\357U\000\000f-[\320\255\177\000\000\200G\227\222\376\177\000\000\002\000\000\000\000\000\000\000\300\217d\320\255\177\000\000\220\003_\316-|\000\000PG\227\222\376\177\000\0008gK\320\255\177\000\000^\000\000\000\000\000\000\000\220\003_\316-|\000\000\320\000\331\316\255\177\000\000pG\227\222\376\177\000\000\240\003_\316-|\000\000q\000\000\000\000\000\000\000\340O\227\222\376\177\000\000^\000\000\000\000\000\000\000\240O\227\222\376\177\000\000\301\223Y\320\255\177\000\000b:\313&\357U\000\000\270\377\377\377"...}, tid = 0}, dealloc_stack = 0x7ffe00000002, alloc_type = 3462267400, dealloc_type = 32029, addr_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 0, kind = (unknown: 0xf4), shadow_byte = 5 '\005'}, heap = {addr = 0, alloc_tid = 11093900527092, free_tid = 137566969790984, alloc_stack_id = 392, free_stack_id = 0, chunk_access = {bad_addr = 137566969790592, offset = 752, chunk_begin = 140731357814792, chunk_size = 140384500648735, user_requested_alignment = 1, access_type = 0, alloc_type = 0}}, stack = {addr = 0, tid = 11093900527092, offset = 137566969790984, frame_pc = 392, access_size = 137566969790592, frame_descr = 0x2f0 <error: Cannot access memory at address 0x2f0>}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 11093900527092, size = 137566969790984, size_with_redzone = 392, name = 0x7d1dce5e0080 "\027\n", module_name = 0x2f0 <error: Cannot access memory at address 0x2f0>, has_dynamic_init = 140731357814792, gcc_location = 0x7fadd04b0b1f <__asan::asan_malloc(unsigned long, __sanitizer::BufferedStackTrace*)+47>, odr_indicator = 1}, {beg = 136811055693888, size = 140731357811552, size_with_redzone = 140384501605842, name = 0x3 <error: Cannot access memory at address 0x3>, module_name = 0x1eced90000 <error: Cannot access memory at address 0x1eced90000>, has_dynamic_init = 140731357809472, gcc_location = 0x2, odr_indicator = 140384501605904}, {beg = 94485634427206, size = 140731357809648, size_with_redzone = 7, name = 0x7fadd0648fc0 <__asan::instance> "", module_name = 0x7bcdce6e5f80 "\003\021", has_dynamic_init = 140731357809600, gcc_location = 0x7fadd05b2d66 <__sanitizer::RunFreeHooks(void*)+86>, odr_indicator = 140731357809696}, {beg = 6, size = 140384502321088, size_with_redzone = 136811055771632, name = 0x7ffe92974bf0 "\b", module_name = 0x7fadd04b6738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", has_dynamic_init = 120, gcc_location = 0x7c6dce616ff0, odr_indicator = 140731357809632}}, reg_sites = {3482861934, 32685, 0, 0}, access_size = 94485633868108, size = 16 '\020'}, wild = {addr = 0, access_size = 11093900527092}}}}}, MallocUsableSizeNotOwned = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\255{\000\000\377\000\000\000\000\000\000\000@\033\322&\357U\000\000f-[\320\255\177\000\000\200G\227\222\376\177\000\000\002\000\000\000\000\000\000\000\300\217d\320\255\177\000\000\220\003_\316-|\000\000PG\227\222\376\177\000\0008gK\320\255\177\000\000^\000\000\000\000\000\000\000\220\003_\316-|\000\000\320\000\331\316\255\177\000\000pG\227\222\376\177\000\000\240\003_\316-|\000\000q\000\000\000\000\000\000\000\340O\227\222\376\177\000\000^\000\000\000\000\000\000\000\240O\227\222\376\177\000\000\301\223Y\320\255\177\000\000b:\313&\357U\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffe00000002, addr_description = {data = {kind = 3462267400, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11093900527092, alloc_stack_id = 3462267400, free_stack_id = 32029, chunk_access = {bad_addr = 392, offset = 137566969790592, chunk_begin = 752, chunk_size = 140731357814792, user_requested_alignment = 2847, access_type = 0, alloc_type = 0}}, stack = {addr = 0, tid = 0, offset = 11093900527092, frame_pc = 137566969790984, access_size = 392, frame_descr = 0x7d1dce5e0080 "\027\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11093900527092, size_with_redzone = 137566969790984, name = 0x188 <error: Cannot access memory at address 0x188>, module_name = 0x7d1dce5e0080 "\027\n", has_dynamic_init = 752, gcc_location = 0x7ffe92976008, odr_indicator = 140384500648735}, {beg = 1, size = 136811055693888, size_with_redzone = 140731357811552, name = 0x7fadd059a5d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", module_name = 0x3 <error: Cannot access memory at address 0x3>, has_dynamic_init = 132319346688, gcc_location = 0x7ffe92974b40, odr_indicator = 2}, {beg = 140384501605904, size = 94485634427206, size_with_redzone = 140731357809648, name = 0x7 <error: Cannot access memory at address 0x7>, module_name = 0x7fadd0648fc0 <__asan::instance> "", has_dynamic_init = 136123861852032, gcc_location = 0x7ffe92974bc0, odr_indicator = 140384501706086}, {beg = 140731357809696, size = 6, size_with_redzone = 140384502321088, name = 0x7c6dce616ff0 "\003\021", module_name = 0x7ffe92974bf0 "\b", has_dynamic_init = 140384500672312, gcc_location = 0x78, odr_indicator = 136811055771632}}, reg_sites = {2459388896, 32766, 3482861934, 32685}, access_size = 0, size = 76 'L'}, wild = {addr = 0, access_size = 0}}}}}, SanitizerGetAllocatedSizeNotOwned = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\255{\000\000\377\000\000\000\000\000\000\000@\033\322&\357U\000\000f-[\320\255\177\000\000\200G\227\222\376\177\000\000\002\000\000\000\000\000\000\000\300\217d\320\255\177\000\000\220\003_\316-|\000\000PG\227\222\376\177\000\0008gK\320\255\177\000\000^\000\000\000\000\000\000\000\220\003_\316-|\000\000\320\000\331\316\255\177\000\000pG\227\222\376\177\000\000\240\003_\316-|\000\000q\000\000\000\000\000\000\000\340O\227\222\376\177\000\000^\000\000\000\000\000\000\000\240O\227\222\376\177\000\000\301\223Y\320\255\177\000\000b:\313&\357U\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffe00000002, addr_description = {data = {kind = 3462267400, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11093900527092, alloc_stack_id = 3462267400, free_stack_id = 32029, chunk_access = {bad_addr = 392, offset = 137566969790592, chunk_begin = 752, chunk_size = 140731357814792, user_requested_alignment = 2847, access_type = 0, alloc_type = 0}}, stack = {addr = 0, tid = 0, offset = 11093900527092, frame_pc = 137566969790984, access_size = 392, frame_descr = 0x7d1dce5e0080 "\027\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11093900527092, size_with_redzone = 137566969790984, name = 0x188 <error: Cannot access memory at address 0x188>, module_name = 0x7d1dce5e0080 "\027\n", has_dynamic_init = 752, gcc_location = 0x7ffe92976008, odr_indicator = 140384500648735}, {beg = 1, size = 136811055693888, size_with_redzone = 140731357811552, name = 0x7fadd059a5d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", module_name = 0x3 <error: Cannot access memory at address 0x3>, has_dynamic_init = 132319346688, gcc_location = 0x7ffe92974b40, odr_indicator = 2}, {beg = 140384501605904, size = 94485634427206, size_with_redzone = 140731357809648, name = 0x7 <error: Cannot access memory at address 0x7>, module_name = 0x7fadd0648fc0 <__asan::instance> "", has_dynamic_init = 136123861852032, gcc_location = 0x7ffe92974bc0, odr_indicator = 140384501706086}, {beg = 140731357809696, size = 6, size_with_redzone = 140384502321088, name = 0x7c6dce616ff0 "\003\021", module_name = 0x7ffe92974bf0 "\b", has_dynamic_init = 140384500672312, gcc_location = 0x78, odr_indicator = 136811055771632}}, reg_sites = {2459388896, 32766, 3482861934, 32685}, access_size = 0, size = 76 'L'}, wild = {addr = 0, access_size = 0}}}}}, CallocOverflow = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\255{\000\000\377\000\000\000\000\000\000\000@\033\322&\357U\000\000f-[\320\255\177\000\000\200G\227\222\376\177\000\000\002\000\000\000\000\000\000\000\300\217d\320\255\177\000\000\220\003_\316-|\000\000PG\227\222\376\177\000\0008gK\320\255\177\000\000^\000\000\000\000\000\000\000\220\003_\316-|\000\000\320\000\331\316\255\177\000\000pG\227\222\376\177\000\000\240\003_\316-|\000\000q\000\000\000\000\000\000\000\340O\227\222\376\177\000\000^\000\000\000\000\000\000\000\240O\227\222\376\177\000\000\301\223Y\320\255\177\000\000b:\313&\357U\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffe00000002, count = 137566969790984, size = 0}, ReallocArrayOverflow = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\255{\000\000\377\000\000\000\000\000\000\000@\033\322&\357U\000\000f-[\320\255\177\000\000\200G\227\222\376\177\000\000\002\000\000\000\000\000\000\000\300\217d\320\255\177\000\000\220\003_\316-|\000\000PG\227\222\376\177\000\0008gK\320\255\177\000\000^\000\000\000\000\000\000\000\220\003_\316-|\000\000\320\000\331\316\255\177\000\000pG\227\222\376\177\000\000\240\003_\316-|\000\000q\000\000\000\000\000\000\000\340O\227\222\376\177\000\000^\000\000\000\000\000\000\000\240O\227\222\376\177\000\000\301\223Y\320\255\177\000\000b:\313&\357U\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffe00000002, count = 137566969790984, size = 0}, PvallocOverflow = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\255{\000\000\377\000\000\000\000\000\000\000@\033\322&\357U\000\000f-[\320\255\177\000\000\200G\227\222\376\177\000\000\002\000\000\000\000\000\000\000\300\217d\320\255\177\000\000\220\003_\316-|\000\000PG\227\222\376\177\000\0008gK\320\255\177\000\000^\000\000\000\000\000\000\000\220\003_\316-|\000\000\320\000\331\316\255\177\000\000pG\227\222\376\177\000\000\240\003_\316-|\000\000q\000\000\000\000\000\000\000\340O\227\222\376\177\000\000^\000\000\000\000\000\000\000\240O\227\222\376\177\000\000\301\223Y\320\255\177\000\000b:\313&\357U\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffe00000002, size = 137566969790984}, InvalidAllocationAlignment = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\255{\000\000\377\000\000\000\000\000\000\000@\033\322&\357U\000\000f-[\320\255\177\000\000\200G\227\222\376\177\000\000\002\000\000\000\000\000\000\000\300\217d\320\255\177\000\000\220\003_\316-|\000\000PG\227\222\376\177\000\0008gK\320\255\177\000\000^\000\000\000\000\000\000\000\220\003_\316-|\000\000\320\000\331\316\255\177\000\000pG\227\222\376\177\000\000\240\003_\316-|\000\000q\000\000\000\000\000\000\000\340O\227\222\376\177\000\000^\000\000\000\000\000\000\000\240O\227\222\376\177\000\000\301\223Y\320\255\177\000\000b:\313&\357U\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffe00000002, alignment = 137566969790984}, InvalidAlignedAllocAlignment = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\255{\000\000\377\000\000\000\000\000\000\000@\033\322&\357U\000\000f-[\320\255\177\000\000\200G\227\222\376\177\000\000\002\000\000\000\000\000\000\000\300\217d\320\255\177\000\000\220\003_\316-|\000\000PG\227\222\376\177\000\0008gK\320\255\177\000\000^\000\000\000\000\000\000\000\220\003_\316-|\000\000\320\000\331\316\255\177\000\000pG\227\222\376\177\000\000\240\003_\316-|\000\000q\000\000\000\000\000\000\000\340O\227\222\376\177\000\000^\000\000\000\000\000\000\000\240O\227\222\376\177\000\000\301\223Y\320\255\177\000\000b:\313&\357U\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffe00000002, size = 137566969790984, alignment = 0}, InvalidPosixMemalignAlignment = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\255{\000\000\377\000\000\000\000\000\000\000@\033\322&\357U\000\000f-[\320\255\177\000\000\200G\227\222\376\177\000\000\002\000\000\000\000\000\000\000\300\217d\320\255\177\000\000\220\003_\316-|\000\000PG\227\222\376\177\000\0008gK\320\255\177\000\000^\000\000\000\000\000\000\000\220\003_\316-|\000\000\320\000\331\316\255\177\000\000pG\227\222\376\177\000\000\240\003_\316-|\000\000q\000\000\000\000\000\000\000\340O\227\222\376\177\000\000^\000\000\000\000\000\000\000\240O\227\222\376\177\000\000\301\223Y\320\255\177\000\000b:\313&\357U\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffe00000002, alignment = 137566969790984}, AllocationSizeTooBig = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\255{\000\000\377\000\000\000\000\000\000\000@\033\322&\357U\000\000f-[\320\255\177\000\000\200G\227\222\376\177\000\000\002\000\000\000\000\000\000\000\300\217d\320\255\177\000\000\220\003_\316-|\000\000PG\227\222\376\177\000\0008gK\320\255\177\000\000^\000\000\000\000\000\000\000\220\003_\316-|\000\000\320\000\331\316\255\177\000\000pG\227\222\376\177\000\000\240\003_\316-|\000\000q\000\000\000\000\000\000\000\340O\227\222\376\177\000\000^\000\000\000\000\000\000\000\240O\227\222\376\177\000\000\301\223Y\320\255\177\000\000b:\313&\357U\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffe00000002, user_size = 137566969790984, total_size = 0, max_size = 0}, RssLimitExceeded = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\255{\000\000\377\000\000\000\000\000\000\000@\033\322&\357U\000\000f-[\320\255\177\000\000\200G\227\222\376\177\000\000\002\000\000\000\000\000\000\000\300\217d\320\255\177\000\000\220\003_\316-|\000\000PG\227\222\376\177\000\0008gK\320\255\177\000\000^\000\000\000\000\000\000\000\220\003_\316-|\000\000\320\000\331\316\255\177\000\000pG\227\222\376\177\000\000\240\003_\316-|\000\000q\000\000\000\000\000\000\000\340O\227\222\376\177\000\000^\000\000\000\000\000\000\000\240O\227\222\376\177\000\000\301\223Y\320\255\177\000\000b:\313&\357U\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffe00000002}, OutOfMemory = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\255{\000\000\377\000\000\000\000\000\000\000@\033\322&\357U\000\000f-[\320\255\177\000\000\200G\227\222\376\177\000\000\002\000\000\000\000\000\000\000\300\217d\320\255\177\000\000\220\003_\316-|\000\000PG\227\222\376\177\000\0008gK\320\255\177\000\000^\000\000\000\000\000\000\000\220\003_\316-|\000\000\320\000\331\316\255\177\000\000pG\227\222\376\177\000\000\240\003_\316-|\000\000q\000\000\000\000\000\000\000\340O\227\222\376\177\000\000^\000\000\000\000\000\000\000\240O\227\222\376\177\000\000\301\223Y\320\255\177\000\000b:\313&\357U\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffe00000002, requested_size = 137566969790984}, StringFunctionMemoryRangesOverlap = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\255{\000\000\377\000\000\000\000\000\000\000@\033\322&\357U\000\000f-[\320\255\177\000\000\200G\227\222\376\177\000\000\002\000\000\000\000\000\000\000\300\217d\320\255\177\000\000\220\003_\316-|\000\000PG\227\222\376\177\000\0008gK\320\255\177\000\000^\000\000\000\000\000\000\000\220\003_\316-|\000\000\320\000\331\316\255\177\000\000pG\227\222\376\177\000\000\240\003_\316-|\000\000q\000\000\000\000\000\000\000\340O\227\222\376\177\000\000^\000\000\000\000\000\000\000\240O\227\222\376\177\000\000\301\223Y\320\255\177\000\000b:\313&\357U\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffe00000002, length1 = 137566969790984, length2 = 0, addr1_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 11093900527092, kind = (unknown: 0x8), shadow_byte = 2 '\002'}, heap = {addr = 11093900527092, alloc_tid = 137566969790984, free_tid = 392, alloc_stack_id = 3462267008, free_stack_id = 32029, chunk_access = {bad_addr = 752, offset = 140731357814792, chunk_begin = 140384500648735, chunk_size = 1, user_requested_alignment = 64, access_type = 0, alloc_type = 1}}, stack = {addr = 11093900527092, tid = 137566969790984, offset = 392, frame_pc = 137566969790592, access_size = 752, frame_descr = 0x7ffe92976008 ""}, global = {addr = 11093900527092, static kMaxGlobals = 4, globals = {{beg = 137566969790984, size = 392, size_with_redzone = 137566969790592, name = 0x2f0 <error: Cannot access memory at address 0x2f0>, module_name = 0x7ffe92976008 "", has_dynamic_init = 140384500648735, gcc_location = 0x1, odr_indicator = 136811055693888}, {beg = 140731357811552, size = 140384501605842, size_with_redzone = 3, name = 0x1eced90000 <error: Cannot access memory at address 0x1eced90000>, module_name = 0x7ffe92974b40 "\020\246Y\320\255\177", has_dynamic_init = 2, gcc_location = 0x7fadd059a610 <___interceptor_malloc(__sanitizer::uptr)+192>, odr_indicator = 94485634427206}, {beg = 140731357809648, size = 7, size_with_redzone = 140384502321088, name = 0x7bcdce6e5f80 "\003\021", module_name = 0x7ffe92974bc0 "\340K\227\222\376\177", has_dynamic_init = 140384501706086, gcc_location = 0x7ffe92974c20, odr_indicator = 6}, {beg = 140384502321088, size = 136811055771632, size_with_redzone = 140731357809648, name = 0x7fadd04b6738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", module_name = 0x78 <error: Cannot access memory at address 0x78>, has_dynamic_init = 136811055771632, gcc_location = 0x7ffe92974be0, odr_indicator = 140384488931694}}, reg_sites = {0, 0, 648323404, 21999}, access_size = 140731357811472, size = 0 '\000'}, wild = {addr = 11093900527092, access_size = 137566969790984}}}}, addr2_description = {data = {kind = 8, {shadow = {addr = 140384502032279, kind = __asan::kShadowKindLow, shadow_byte = 253 '\375'}, heap = {addr = 140384502032279, alloc_tid = 140384498613504, free_tid = 140731357811120, alloc_stack_id = 3495323859, free_stack_id = 32685, chunk_access = {bad_addr = 140731357811120, offset = 3492698680, chunk_begin = 140731357811216, chunk_size = 140384498548310, user_requested_alignment = 384, access_type = 0, alloc_type = 0}}, stack = {addr = 140384502032279, tid = 140384498613504, offset = 140731357811120, frame_pc = 140384501393619, access_size = 140731357811120, frame_descr = 0xd02e5a38 <error: Cannot access memory at address 0xd02e5a38>}, global = {addr = 140384502032279, static kMaxGlobals = 4, globals = {{beg = 140384498613504, size = 140731357811120, size_with_redzone = 140384501393619, name = 0x7ffe929751b0 "\200\001^\316\275|", module_name = 0xd02e5a38 <error: Cannot access memory at address 0xd02e5a38>, has_dynamic_init = 140731357811216, gcc_location = 0x7fadd02afe56, odr_indicator = 137154652930432}, {beg = 140384498548260, size = 140731357811168, size_with_redzone = 6866820008608, name = 0x22 <error: Cannot access memory at address 0x22>, module_name = 0x2f29754c <error: Cannot access memory at address 0x2f29754c>, has_dynamic_init = 140731357811200, gcc_location = 0x7c0dce5e0aa0, odr_indicator = 140731357811232}, {beg = 136811055771648, size = 137154652930432, size_with_redzone = 136261300199952, name = 0x55ef26c2aa00 <watch_destroy> "\363\017\036\372SH\211\373H\203\354\020H\205\377\017\2049\002", module_name = 0x7fadd0314dce "I\211\305L9\360tJH\205\300tUH\213E\310dH+\004%(", has_dynamic_init = 136811055771648, gcc_location = 0x7fadd0314dce, odr_indicator = 94485635836416}, {beg = 0, size = 140731357811328, size_with_redzone = 140384498961870, name = 0x7cadce5e0f40 "\001", module_name = 0x7bedce5f84d0 "\002", has_dynamic_init = 44, gcc_location = 0x0, odr_indicator = 136261299832024}}, reg_sites = {3462734376, 31725, 3462366448, 31725}, access_size = 94485635838286, size = 16 '\020'}, wild = {addr = 140384502032279, access_size = 140384498613504}}}}, function = 0x6ecdbd005e8ad200 <error: Cannot access memory at address 0x6ecdbd005e8ad200>}, StringFunctionSizeOverflow = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\255{\000\000\377\000\000\000\000\000\000\000@\033\322&\357U\000\000f-[\320\255\177\000\000\200G\227\222\376\177\000\000\002\000\000\000\000\000\000\000\300\217d\320\255\177\000\000\220\003_\316-|\000\000PG\227\222\376\177\000\0008gK\320\255\177\000\000^\000\000\000\000\000\000\000\220\003_\316-|\000\000\320\000\331\316\255\177\000\000pG\227\222\376\177\000\000\240\003_\316-|\000\000q\000\000\000\000\000\000\000\340O\227\222\376\177\000\000^\000\000\000\000\000\000\000\240O\227\222\376\177\000\000\301\223Y\320\255\177\000\000b:\313&\357U\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffe00000002, addr_description = {data = {kind = 3462267400, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11093900527092, alloc_stack_id = 3462267400, free_stack_id = 32029, chunk_access = {bad_addr = 392, offset = 137566969790592, chunk_begin = 752, chunk_size = 140731357814792, user_requested_alignment = 2847, access_type = 0, alloc_type = 0}}, stack = {addr = 0, tid = 0, offset = 11093900527092, frame_pc = 137566969790984, access_size = 392, frame_descr = 0x7d1dce5e0080 "\027\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11093900527092, size_with_redzone = 137566969790984, name = 0x188 <error: Cannot access memory at address 0x188>, module_name = 0x7d1dce5e0080 "\027\n", has_dynamic_init = 752, gcc_location = 0x7ffe92976008, odr_indicator = 140384500648735}, {beg = 1, size = 136811055693888, size_with_redzone = 140731357811552, name = 0x7fadd059a5d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", module_name = 0x3 <error: Cannot access memory at address 0x3>, has_dynamic_init = 132319346688, gcc_location = 0x7ffe92974b40, odr_indicator = 2}, {beg = 140384501605904, size = 94485634427206, size_with_redzone = 140731357809648, name = 0x7 <error: Cannot access memory at address 0x7>, module_name = 0x7fadd0648fc0 <__asan::instance> "", has_dynamic_init = 136123861852032, gcc_location = 0x7ffe92974bc0, odr_indicator = 140384501706086}, {beg = 140731357809696, size = 6, size_with_redzone = 140384502321088, name = 0x7c6dce616ff0 "\003\021", module_name = 0x7ffe92974bf0 "\b", has_dynamic_init = 140384500672312, gcc_location = 0x78, odr_indicator = 136811055771632}}, reg_sites = {2459388896, 32766, 3482861934, 32685}, access_size = 0, size = 76 'L'}, wild = {addr = 0, access_size = 0}}}}, size = 140731357811472}, BadParamsToAnnotateContiguousContainer = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\255{\000\000\377\000\000\000\000\000\000\000@\033\322&\357U\000\000f-[\320\255\177\000\000\200G\227\222\376\177\000\000\002\000\000\000\000\000\000\000\300\217d\320\255\177\000\000\220\003_\316-|\000\000PG\227\222\376\177\000\0008gK\320\255\177\000\000^\000\000\000\000\000\000\000\220\003_\316-|\000\000\320\000\331\316\255\177\000\000pG\227\222\376\177\000\000\240\003_\316-|\000\000q\000\000\000\000\000\000\000\340O\227\222\376\177\000\000^\000\000\000\000\000\000\000\240O\227\222\376\177\000\000\301\223Y\320\255\177\000\000b:\313&\357U\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffe00000002, beg = 137566969790984, end = 0, old_mid = 0, new_mid = 11093900527092}, BadParamsToAnnotateDoubleEndedContiguousContainer = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\255{\000\000\377\000\000\000\000\000\000\000@\033\322&\357U\000\000f-[\320\255\177\000\000\200G\227\222\376\177\000\000\002\000\000\000\000\000\000\000\300\217d\320\255\177\000\000\220\003_\316-|\000\000PG\227\222\376\177\000\0008gK\320\255\177\000\000^\000\000\000\000\000\000\000\220\003_\316-|\000\000\320\000\331\316\255\177\000\000pG\227\222\376\177\000\000\240\003_\316-|\000\000q\000\000\000\000\000\000\000\340O\227\222\376\177\000\000^\000\000\000\000\000\000\000\240O\227\222\376\177\000\000\301\223Y\320\255\177\000\000b:\313&\357U\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffe00000002, storage_beg = 137566969790984, storage_end = 0, old_container_beg = 0, old_container_end = 11093900527092, new_container_beg = 137566969790984, new_container_end = 392}, BadParamsToCopyContiguousContainerAnnotations = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\255{\000\000\377\000\000\000\000\000\000\000@\033\322&\357U\000\000f-[\320\255\177\000\000\200G\227\222\376\177\000\000\002\000\000\000\000\000\000\000\300\217d\320\255\177\000\000\220\003_\316-|\000\000PG\227\222\376\177\000\0008gK\320\255\177\000\000^\000\000\000\000\000\000\000\220\003_\316-|\000\000\320\000\331\316\255\177\000\000pG\227\222\376\177\000\000\240\003_\316-|\000\000q\000\000\000\000\000\000\000\340O\227\222\376\177\000\000^\000\000\000\000\000\000\000\240O\227\222\376\177\000\000\301\223Y\320\255\177\000\000b:\313&\357U\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffe00000002, old_storage_beg = 137566969790984, old_storage_end = 0, new_storage_beg = 0, new_storage_end = 11093900527092}, ODRViolation = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\255{\000\000\377\000\000\000\000\000\000\000@\033\322&\357U\000\000f-[\320\255\177\000\000\200G\227\222\376\177\000\000\002\000\000\000\000\000\000\000\300\217d\320\255\177\000\000\220\003_\316-|\000\000PG\227\222\376\177\000\0008gK\320\255\177\000\000^\000\000\000\000\000\000\000\220\003_\316-|\000\000\320\000\331\316\255\177\000\000pG\227\222\376\177\000\000\240\003_\316-|\000\000q\000\000\000\000\000\000\000\340O\227\222\376\177\000\000^\000\000\000\000\000\000\000\240O\227\222\376\177\000\000\301\223Y\320\255\177\000\000b:\313&\357U\000\000\270\377\377\377"...}, tid = 0}, global1 = {beg = 140728898420738, size = 137566969790984, size_with_redzone = 0, name = 0x0, module_name = 0xa17000005f4 <error: Cannot access memory at address 0xa17000005f4>, has_dynamic_init = 137566969790984, gcc_location = 0x188, odr_indicator = 137566969790592}, global2 = {beg = 752, size = 140731357814792, size_with_redzone = 140384500648735, name = 0x1 <error: Cannot access memory at address 0x1>, module_name = 0x7c6dce604040 "\200\a^\316\035}", has_dynamic_init = 140731357811552, gcc_location = 0x7fadd059a5d2 <___interceptor_malloc(__sanitizer::uptr)+130>, odr_indicator = 3}, stack_id1 = 3470327808, stack_id2 = 30}, InvalidPointerPair = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\255{\000\000\377\000\000\000\000\000\000\000@\033\322&\357U\000\000f-[\320\255\177\000\000\200G\227\222\376\177\000\000\002\000\000\000\000\000\000\000\300\217d\320\255\177\000\000\220\003_\316-|\000\000PG\227\222\376\177\000\0008gK\320\255\177\000\000^\000\000\000\000\000\000\000\220\003_\316-|\000\000\320\000\331\316\255\177\000\000pG\227\222\376\177\000\000\240\003_\316-|\000\000q\000\000\000\000\000\000\000\340O\227\222\376\177\000\000^\000\000\000\000\000\000\000\240O\227\222\376\177\000\000\301\223Y\320\255\177\000\000b:\313&\357U\000\000\270\377\377\377"...}, tid = 0}, pc = 140728898420738, bp = 137566969790984, sp = 0, addr1_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 11093900527092, kind = (unknown: 0x8), shadow_byte = 2 '\002'}, heap = {addr = 11093900527092, alloc_tid = 137566969790984, free_tid = 392, alloc_stack_id = 3462267008, free_stack_id = 32029, chunk_access = {bad_addr = 752, offset = 140731357814792, chunk_begin = 140384500648735, chunk_size = 1, user_requested_alignment = 64, access_type = 0, alloc_type = 1}}, stack = {addr = 11093900527092, tid = 137566969790984, offset = 392, frame_pc = 137566969790592, access_size = 752, frame_descr = 0x7ffe92976008 ""}, global = {addr = 11093900527092, static kMaxGlobals = 4, globals = {{beg = 137566969790984, size = 392, size_with_redzone = 137566969790592, name = 0x2f0 <error: Cannot access memory at address 0x2f0>, module_name = 0x7ffe92976008 "", has_dynamic_init = 140384500648735, gcc_location = 0x1, odr_indicator = 136811055693888}, {beg = 140731357811552, size = 140384501605842, size_with_redzone = 3, name = 0x1eced90000 <error: Cannot access memory at address 0x1eced90000>, module_name = 0x7ffe92974b40 "\020\246Y\320\255\177", has_dynamic_init = 2, gcc_location = 0x7fadd059a610 <___interceptor_malloc(__sanitizer::uptr)+192>, odr_indicator = 94485634427206}, {beg = 140731357809648, size = 7, size_with_redzone = 140384502321088, name = 0x7bcdce6e5f80 "\003\021", module_name = 0x7ffe92974bc0 "\340K\227\222\376\177", has_dynamic_init = 140384501706086, gcc_location = 0x7ffe92974c20, odr_indicator = 6}, {beg = 140384502321088, size = 136811055771632, size_with_redzone = 140731357809648, name = 0x7fadd04b6738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", module_name = 0x78 <error: Cannot access memory at address 0x78>, has_dynamic_init = 136811055771632, gcc_location = 0x7ffe92974be0, odr_indicator = 140384488931694}}, reg_sites = {0, 0, 648323404, 21999}, access_size = 140731357811472, size = 0 '\000'}, wild = {addr = 11093900527092, access_size = 137566969790984}}}}, addr2_description = {data = {kind = 8, {shadow = {addr = 140384502032279, kind = __asan::kShadowKindLow, shadow_byte = 253 '\375'}, heap = {addr = 140384502032279, alloc_tid = 140384498613504, free_tid = 140731357811120, alloc_stack_id = 3495323859, free_stack_id = 32685, chunk_access = {bad_addr = 140731357811120, offset = 3492698680, chunk_begin = 140731357811216, chunk_size = 140384498548310, user_requested_alignment = 384, access_type = 0, alloc_type = 0}}, stack = {addr = 140384502032279, tid = 140384498613504, offset = 140731357811120, frame_pc = 140384501393619, access_size = 140731357811120, frame_descr = 0xd02e5a38 <error: Cannot access memory at address 0xd02e5a38>}, global = {addr = 140384502032279, static kMaxGlobals = 4, globals = {{beg = 140384498613504, size = 140731357811120, size_with_redzone = 140384501393619, name = 0x7ffe929751b0 "\200\001^\316\275|", module_name = 0xd02e5a38 <error: Cannot access memory at address 0xd02e5a38>, has_dynamic_init = 140731357811216, gcc_location = 0x7fadd02afe56, odr_indicator = 137154652930432}, {beg = 140384498548260, size = 140731357811168, size_with_redzone = 6866820008608, name = 0x22 <error: Cannot access memory at address 0x22>, module_name = 0x2f29754c <error: Cannot access memory at address 0x2f29754c>, has_dynamic_init = 140731357811200, gcc_location = 0x7c0dce5e0aa0, odr_indicator = 140731357811232}, {beg = 136811055771648, size = 137154652930432, size_with_redzone = 136261300199952, name = 0x55ef26c2aa00 <watch_destroy> "\363\017\036\372SH\211\373H\203\354\020H\205\377\017\2049\002", module_name = 0x7fadd0314dce "I\211\305L9\360tJH\205\300tUH\213E\310dH+\004%(", has_dynamic_init = 136811055771648, gcc_location = 0x7fadd0314dce, odr_indicator = 94485635836416}, {beg = 0, size = 140731357811328, size_with_redzone = 140384498961870, name = 0x7cadce5e0f40 "\001", module_name = 0x7bedce5f84d0 "\002", has_dynamic_init = 44, gcc_location = 0x0, odr_indicator = 136261299832024}}, reg_sites = {3462734376, 31725, 3462366448, 31725}, access_size = 94485635838286, size = 16 '\020'}, wild = {addr = 140384502032279, access_size = 140384498613504}}}}}, Generic = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\255{\000\000\377\000\000\000\000\000\000\000@\033\322&\357U\000\000f-[\320\255\177\000\000\200G\227\222\376\177\000\000\002\000\000\000\000\000\000\000\300\217d\320\255\177\000\000\220\003_\316-|\000\000PG\227\222\376\177\000\0008gK\320\255\177\000\000^\000\000\000\000\000\000\000\220\003_\316-|\000\000\320\000\331\316\255\177\000\000pG\227\222\376\177\000\000\240\003_\316-|\000\000q\000\000\000\000\000\000\000\340O\227\222\376\177\000\000^\000\000\000\000\000\000\000\240O\227\222\376\177\000\000\301\223Y\320\255\177\000\000b:\313&\357U\000\000\270\377\377\377"...}, tid = 0}, addr_description = {data = {kind = __asan::kAddressKindHeap, {shadow = {addr = 137566969790984, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 137566969790984, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1524, free_stack_id = 2583, chunk_access = {bad_addr = 137566969790984, offset = 392, chunk_begin = 137566969790592, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, stack = {addr = 137566969790984, tid = 0, offset = 0, frame_pc = 11093900527092, access_size = 137566969790984, frame_descr = 0x188 <error: Cannot access memory at address 0x188>}, global = {addr = 137566969790984, static kMaxGlobals = 4, globals = {{beg = 0, size = 0, size_with_redzone = 11093900527092, name = 0x7d1dce5e0208 "", module_name = 0x188 <error: Cannot access memory at address 0x188>, has_dynamic_init = 137566969790592, gcc_location = 0x2f0, odr_indicator = 140731357814792}, {beg = 140384500648735, size = 1, size_with_redzone = 136811055693888, name = 0x7ffe92975360 "\360\"\217&\357U", module_name = 0x7fadd059a5d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", has_dynamic_init = 3, gcc_location = 0x1eced90000, odr_indicator = 140731357809472}, {beg = 2, size = 140384501605904, size_with_redzone = 94485634427206, name = 0x7ffe92974bf0 "\b", module_name = 0x7 <error: Cannot access memory at address 0x7>, has_dynamic_init = 140384502321088, gcc_location = 0x7bcdce6e5f80, odr_indicator = 140731357809600}, {beg = 140384501706086, size = 140731357809696, size_with_redzone = 6, name = 0x7fadd0648fc0 <__asan::instance> "", module_name = 0x7c6dce616ff0 "\003\021", has_dynamic_init = 140731357809648, gcc_location = 0x7fadd04b6738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248>, odr_indicator = 120}}, reg_sites = {3462492144, 31853, 2459388896, 32766}, access_size = 140384488931694, size = 0 '\000'}, wild = {addr = 137566969790984, access_size = 0}}}}, pc = 94485633868108, bp = 140731357811472, sp = 140731357811456, access_size = 8, bug_descr = 0x7fadd0602797 "heap-use-after-free", is_write = false, shadow_val = 253 '\375'}}}, halt_on_error_ = true}
                error = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\255{\000\000\377\000\000\000\000\000\000\000@\033\322&\357U\000\000f-[\320\255\177\000\000\200G\227\222\376\177\000\000\002\000\000\000\000\000\000\000\300\217d\320\255\177\000\000\220\003_\316-|\000\000PG\227\222\376\177\000\0008gK\320\255\177\000\000^\000\000\000\000\000\000\000\220\003_\316-|\000\000\320\000\331\316\255\177\000\000pG\227\222\376\177\000\000\240\003_\316-|\000\000q\000\000\000\000\000\000\000\340O\227\222\376\177\000\000^\000\000\000\000\000\000\000\240O\227\222\376\177\000\000\301\223Y\320\255\177\000\000b:\313&\357U\000\000\270\377\377\377"...}, tid = 0}, addr_description = {data = {kind = __asan::kAddressKindHeap, {shadow = {addr = 137566969790984, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 137566969790984, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1524, free_stack_id = 2583, chunk_access = {bad_addr = 137566969790984, offset = 392, chunk_begin = 137566969790592, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, stack = {addr = 137566969790984, tid = 0, offset = 0, frame_pc = 11093900527092, access_size = 137566969790984, frame_descr = 0x188 <error: Cannot access memory at address 0x188>}, global = {addr = 137566969790984, static kMaxGlobals = 4, globals = {{beg = 0, size = 0, size_with_redzone = 11093900527092, name = 0x7d1dce5e0208 "", module_name = 0x188 <error: Cannot access memory at address 0x188>, has_dynamic_init = 137566969790592, gcc_location = 0x2f0, odr_indicator = 140731357814792}, {beg = 140384500648735, size = 1, size_with_redzone = 136811055693888, name = 0x7ffe92975360 "\360\"\217&\357U", module_name = 0x7fadd059a5d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", has_dynamic_init = 3, gcc_location = 0x1eced90000, odr_indicator = 140731357809472}, {beg = 2, size = 140384501605904, size_with_redzone = 94485634427206, name = 0x7ffe92974bf0 "\b", module_name = 0x7 <error: Cannot access memory at address 0x7>, has_dynamic_init = 140384502321088, gcc_location = 0x7bcdce6e5f80, odr_indicator = 140731357809600}, {beg = 140384501706086, size = 140731357809696, size_with_redzone = 6, name = 0x7fadd0648fc0 <__asan::instance> "", module_name = 0x7c6dce616ff0 "\003\021", has_dynamic_init = 140731357809648, gcc_location = 0x7fadd04b6738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248>, odr_indicator = 120}}, reg_sites = {3462492144, 31853, 2459388896, 32766}, access_size = 140384488931694, size = 0 '\000'}, wild = {addr = 137566969790984, access_size = 0}}}}, pc = 94485633868108, bp = 140731357811472, sp = 140731357811456, access_size = 8, bug_descr = 0x7fadd0602797 "heap-use-after-free", is_write = false, shadow_val = 253 '\375'}
        #9  0x00007fadd05a6f8d in __asan::ReportGenericError (pc=<optimized out>, bp=bp@entry=140731357811472, sp=sp@entry=140731357811456, addr=<optimized out>, is_write=is_write@entry=false, access_size=access_size@entry=8, exp=<optimized out>, fatal=true) at ../../../../src/libsanitizer/asan/asan_report.cpp:536
                in_report = <optimized out>
                error = <optimized out>
                enable_fp = <optimized out>
        #10 0x00007fadd05a83f9 in __asan::__asan_report_load8 (addr=<optimized out>) at ../../../../src/libsanitizer/asan/asan_rtl.cpp:131
                bp = 140731357811472
                pc = <optimized out>
                local_stack = 140731357811584
                sp = 140731357811456
        #11 0x000055ef26a4a14c in device_get_adapter (device=<optimized out>) at src/device.c:6921
        No locals.
        #12 0x000055ef268f232f in find_cig_session (data=0x7c6dce60b000, match_data=0x7badcd4855b0) at profiles/audio/bap.c:2500
                session = 0x7c6dce60b000
                info = 0x7badcd4855b0
        #13 0x000055ef26ad1321 in queue_find (queue=<optimized out>, function=function@entry=0x55ef268f22f0 <find_cig_session>, match_data=match_data@entry=0x7badcd4855b0) at src/shared/queue.c:230
                entry = 0x7bcdce69ab90
        #14 0x000055ef268f8df4 in find_cig_enumerate (data=0x7c6dce604040) at profiles/audio/bap.c:2539
                info = <optimized out>
        #15 bap_update_cigs_cb (user_data=0x7c6dce604040) at profiles/audio/bap.c:2688
                data = 0x7c6dce604040
                cigs = <optimized out>
                unset = <optimized out>
        #16 0x00007fadd02b2b9b in ?? () from /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
        No symbol table info available.
        #17 0x00007fadd02b41d7 in ?? () from /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
        No symbol table info available.
        #18 0x00007fadd02b4577 in g_main_loop_run () from /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
        No symbol table info available.
        #19 0x000055ef26c2d229 in mainloop_run () at src/shared/mainloop-glib.c:65
        No locals.
        #20 0x000055ef26c2db5b in mainloop_run_with_signal (func=func@entry=0x55ef26a92c80 <signal_callback>, user_data=user_data@entry=0x0) at src/shared/mainloop-notify.c:196
                data = 0x7bddce5e3490
                io = 0x7bedce5f9b10
                ret = <optimized out>
        #21 0x000055ef267ab3eb in main (argc=<optimized out>, argv=<optimized out>) at src/main.c:1713
                context = <optimized out>
                err = <optimized out>
                sdp_mtu = 0
                sdp_flags = <optimized out>
                gdbus_flags = <optimized out>
                __func__ = "main""


https://github.com/bluez/bluez/pull/2541

---
Regards,
Linux Bluetooth