* [PATCH BlueZ v1] adapter: remove the devices from the list before freeing them
@ 2026-09-18 21:59 Luiz Augusto von Dentz
2026-09-18 23:23 ` [BlueZ,v1] " bluez.test.bot
2026-09-21 14:30 ` [PATCH BlueZ v1] " patchwork-bot+bluetooth
0 siblings, 2 replies; 3+ messages in thread
From: Luiz Augusto von Dentz @ 2026-09-18 21:59 UTC (permalink / raw)
To: linux-bluetooth
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
The devices of an adapter are freed one by one when it is removed, but
the list keeps pointing at them until every one of them is gone, so it
refers to freed devices while the remaining ones are being removed.
Freeing a device looks devices up though, e.g. cleaning up its GATT
server reports the disconnection, which searches the list for the
device it belongs to, and the search reads the devices already freed:
ERROR: AddressSanitizer: heap-use-after-free
in bacmp lib/bluetooth/bluetooth.h:438
in device_addr_type_cmp src/device.c:5657
in btd_adapter_find_device src/adapter.c:1055
in att_disconnected src/gatt-database.c:335
in gatt_server_cleanup src/device.c:842
in device_free src/device.c:918
Take each device out of the list before removing it, so only the ones
still to be removed are ever found.
This needs more than one device on the adapter to show up, which the
test of a coordinated set is the first to leave behind.
Assisted-by: opencode:claude-opus-5
---
src/adapter.c | 19 ++++++++++++-------
1 file changed, 12 insertions(+), 7 deletions(-)
diff --git a/src/adapter.c b/src/adapter.c
index 717db2ea9bfe..50b4dc6d724e 100644
--- a/src/adapter.c
+++ b/src/adapter.c
@@ -7293,7 +7293,6 @@ static struct btd_adapter *btd_adapter_new(uint16_t index)
static void adapter_remove(struct btd_adapter *adapter)
{
- GSList *l;
struct gatt_db *db;
struct btd_ranging_provider_manager *ranging_manager;
@@ -7302,13 +7301,19 @@ static void adapter_remove(struct btd_adapter *adapter)
g_slist_free(adapter->connect_list);
adapter->connect_list = NULL;
- for (l = adapter->devices; l; l = l->next) {
- device_removed_drivers(adapter, l->data);
- device_remove(l->data, FALSE);
- }
+ while (adapter->devices) {
+ struct btd_device *device = adapter->devices->data;
- g_slist_free(adapter->devices);
- adapter->devices = NULL;
+ /* Take the device out of the list before removing it, as
+ * freeing it looks devices up, e.g. when cleaning up its
+ * GATT server, and the ones already freed would still be
+ * found.
+ */
+ adapter->devices = g_slist_remove(adapter->devices, device);
+
+ device_removed_drivers(adapter, device);
+ device_remove(device, FALSE);
+ }
g_slist_free(adapter->discovery_found);
adapter->discovery_found = NULL;
--
2.55.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* RE: [BlueZ,v1] adapter: remove the devices from the list before freeing them
2026-09-18 21:59 [PATCH BlueZ v1] adapter: remove the devices from the list before freeing them Luiz Augusto von Dentz
@ 2026-09-18 23:23 ` bluez.test.bot
2026-09-21 14:30 ` [PATCH BlueZ v1] " patchwork-bot+bluetooth
1 sibling, 0 replies; 3+ messages in thread
From: bluez.test.bot @ 2026-09-18 23:23 UTC (permalink / raw)
To: linux-bluetooth, luiz.dentz
[-- Attachment #1: Type: text/plain, Size: 50290 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1169029/
---Test result---
Test Summary:
CheckPatch PASS 0.53 seconds
GitLint PASS 1.48 seconds
BuildEll PASS 19.51 seconds
BluezMake PASS 392.21 seconds
CheckSmatch PASS 293.52 seconds
bluezmakeextell PASS 93.95 seconds
TestFunctional FAIL 1134.76 seconds
IncrementalBuild PASS 389.64 seconds
ScanBuild PASS 1129.61 seconds
Details
##############################
Test: TestFunctional - FAIL
Desc: Run test-functional
Output:
FAIL functional.test_bap::test_bap_unicast_set_transport_created[hosts8-vm3-legacy]: failed on setup with "pytest_bluezenv.rpc.RemoteTimeoutError: Connection recv timed out"
FAIL functional.test_bap::test_bap_unicast_set_transport_created[hosts8-vm3-legacy]: failed on teardown with "pytest_bluezenv.plugin.CoredumpWarning: Core dump: test-bluezenv-hosts8.0-bluetoothd-1789772235-71.core
/usr/bin/gdb: warning: Couldn't determine a path for the index cache directory.
[New LWP 71]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/usr/lib/x86_64-linux-gnu/libthread_db.so.1".
Core was generated by `/home/runner/work/bluez/bluez/src/src/src/bluetoothd --nodetach -f /run/bluetoo'.
Program terminated with signal SIGABRT, Aborted.
#0 __pthread_kill_implementation (threadid=<optimized out>, signo=6, no_tid=0) at ./nptl/pthread_kill.c:44
warning: 44 ./nptl/pthread_kill.c: No such file or directory
Thread 1 (Thread 0x7f4b441ba900 (LWP 71)):
#0 __pthread_kill_implementation (threadid=<optimized out>, signo=6, no_tid=0) at ./nptl/pthread_kill.c:44
tid = <optimized out>
ret = 0
pd = <optimized out>
old_mask = {__val = {4412750543122677053}}
ret = <optimized out>
#1 __pthread_kill_internal (threadid=<optimized out>, signo=6) at ./nptl/pthread_kill.c:89
No locals.
#2 __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ./nptl/pthread_kill.c:100
No locals.
#3 0x00007f4b44915b7e in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
ret = <optimized out>
#4 0x00007f4b448f88ec in __GI_abort () at ./stdlib/abort.c:77
act = {__sigaction_handler = {sa_handler = 0x0, sa_sigaction = 0x0}, sa_mask = {__val = {0, 0, 0, 140720326293872, 140720326294160, 140720326294016, 22, 139961246555088, 0, 140720326293952, 139961263400470, 139961235939328, 4096, 0, 17404849087918711552, 139961236832280}}, sa_flags = 1170477056, sa_restorer = 0x16}
#5 0x00007f4b45520a0f in __sanitizer::Abort () at ../../../../src/libsanitizer/sanitizer_common/sanitizer_posix_libcdep.cpp:165
No locals.
#6 0x00007f4b45646c2d in __sanitizer::Die () at ../../../../src/libsanitizer/sanitizer_common/sanitizer_termination.cpp:58
No locals.
#7 0x00007f4b4561b93c in __asan::ScopedInErrorReport::~ScopedInErrorReport (this=0x7ffc010fbb36) at ../../../../src/libsanitizer/asan/asan_report.cpp:221
buffer_copy = {buffer_ = {<__sanitizer::InternalMmapVectorNoCtor<char, false>> = {data_ = 0x7f4b43c02000 '=' <repeats 65 times>, "\n==71==ERROR: AddressSanitizer: heap-use-after-free on address 0x7cbb436e0208 at pc 0x55e62b341e7c bp 0x7ffc010fc7b0 sp 0x7ffc010fc7a0\n"..., capacity_bytes_ = 4096, size_ = 3419}, <No data fields>}}
buffer_copy = <optimized out>
l = <optimized out>
#8 0x00007f4b4561ae02 in __asan::ReportGenericError (pc=94447055675004, bp=140720326297520, sp=sp@entry=140720326297504, addr=137143732011528, is_write=is_write@entry=false, access_size=8, fatal=true, exp=<optimized out>) at ../../../../src/libsanitizer/asan/asan_report.cpp:536
in_report = {error_report_lock_ = {<No data fields>}, static current_error_ = {kind = __asan::kErrorKindGeneric, {Base = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000K{\000\000\377\000\000\000\000\000\000\000\240\227a+\346U\000\000fmbEK\177\000\000 \274\017\001\374\177\000\000\002\000\000\000\000\000\000\000\300\317kEK\177\000\000\220\noC\313{\000\000\360\273\017\001\374\177\000\0008\247REK\177\000\000^\000\000\000\000\000\000\000\220\noC\313{\000\000\320@\340CK\177\000\000\020\274\017\001\374\177\000\000\240\noC\313{\000\000q\000\000\000\000\000\000\000\200\304\017\001\374\177\000\000^\000\000\000\000\000\000\000@\304\017\001\374\177\000\000\301\323`EK\177\000\000\"\272Z+\346U\000\000\270\377\377\377"...}, tid = 0}, DeadlySignal = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000K{\000\000\377\000\000\000\000\000\000\000\240\227a+\346U\000\000fmbEK\177\000\000 \274\017\001\374\177\000\000\002\000\000\000\000\000\000\000\300\317kEK\177\000\000\220\noC\313{\000\000\360\273\017\001\374\177\000\0008\247REK\177\000\000^\000\000\000\000\000\000\000\220\noC\313{\000\000\320@\340CK\177\000\000\020\274\017\001\374\177\000\000\240\noC\313{\000\000q\000\000\000\000\000\000\000\200\304\017\001\374\177\000\000^\000\000\000\000\000\000\000@\304\017\001\374\177\000\000\301\323`EK\177\000\000\"\272Z+\346U\000\000\270\377\377\377"...}, tid = 0}, signal = {siginfo = 0x7ffc00000002, context = 0x7cbb436e0208, addr = 0, pc = 0, sp = 11033770984949, bp = 137143732011528, is_memory_access = 136, write_flag = __sanitizer::SignalContext::Unknown, is_true_faulting_addr = 128}}, DoubleFree = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000K{\000\000\377\000\000\000\000\000\000\000\240\227a+\346U\000\000fmbEK\177\000\000 \274\017\001\374\177\000\000\002\000\000\000\000\000\000\000\300\317kEK\177\000\000\220\noC\313{\000\000\360\273\017\001\374\177\000\0008\247REK\177\000\000^\000\000\000\000\000\000\000\220\noC\313{\000\000\320@\340CK\177\000\000\020\274\017\001\374\177\000\000\240\noC\313{\000\000q\000\000\000\000\000\000\000\200\304\017\001\374\177\000\000^\000\000\000\000\000\000\000@\304\017\001\374\177\000\000\301\323`EK\177\000\000\"\272Z+\346U\000\000\270\377\377\377"...}, tid = 0}, second_free_stack = 0x7ffc00000002, addr_description = {addr = 137143732011528, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1525, free_stack_id = 2569, chunk_access = {bad_addr = 137143732011528, offset = 392, chunk_begin = 137143732011136, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}}, NewDeleteTypeMismatch = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000K{\000\000\377\000\000\000\000\000\000\000\240\227a+\346U\000\000fmbEK\177\000\000 \274\017\001\374\177\000\000\002\000\000\000\000\000\000\000\300\317kEK\177\000\000\220\noC\313{\000\000\360\273\017\001\374\177\000\0008\247REK\177\000\000^\000\000\000\000\000\000\000\220\noC\313{\000\000\320@\340CK\177\000\000\020\274\017\001\374\177\000\000\240\noC\313{\000\000q\000\000\000\000\000\000\000\200\304\017\001\374\177\000\000^\000\000\000\000\000\000\000@\304\017\001\374\177\000\000\301\323`EK\177\000\000\"\272Z+\346U\000\000\270\377\377\377"...}, tid = 0}, free_stack = 0x7ffc00000002, addr_description = {addr = 137143732011528, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1525, free_stack_id = 2569, chunk_access = {bad_addr = 137143732011528, offset = 392, chunk_begin = 137143732011136, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, delete_size = 139961262295839, delete_alignment = 1}, FreeNotMalloced = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000K{\000\000\377\000\000\000\000\000\000\000\240\227a+\346U\000\000fmbEK\177\000\000 \274\017\001\374\177\000\000\002\000\000\000\000\000\000\000\300\317kEK\177\000\000\220\noC\313{\000\000\360\273\017\001\374\177\000\0008\247REK\177\000\000^\000\000\000\000\000\000\000\220\noC\313{\000\000\320@\340CK\177\000\000\020\274\017\001\374\177\000\000\240\noC\313{\000\000q\000\000\000\000\000\000\000\200\304\017\001\374\177\000\000^\000\000\000\000\000\000\000@\304\017\001\374\177\000\000\301\323`EK\177\000\000\"\272Z+\346U\000\000\270\377\377\377"...}, tid = 0}, free_stack = 0x7ffc00000002, addr_description = {data = {kind = 1131282952, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11033770984949, alloc_stack_id = 1131282952, free_stack_id = 31931, chunk_access = {bad_addr = 392, offset = 137143732011136, chunk_begin = 752, chunk_size = 140720326270984, user_requested_alignment = 2847, access_type = 0, alloc_type = 1}}, stack = {addr = 0, tid = 0, offset = 11033770984949, frame_pc = 137143732011528, access_size = 392, frame_descr = 0x7cbb436e0080 "\t\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11033770984949, size_with_redzone = 137143732011528, name = 0x188 <error: Cannot access memory at address 0x188>, module_name = 0x7cbb436e0080 "\t\n", has_dynamic_init = 752, gcc_location = 0x7ffc010f6008, odr_indicator = 139961262295839}, {beg = 1, size = 136387817919424, size_with_redzone = 140720326297600, name = 0x7f4b4560e5d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", module_name = 0x3 <error: Cannot access memory at address 0x3>, has_dynamic_init = 129987788800, gcc_location = 0x7ffc010fbfe0, odr_indicator = 2}, {beg = 139961263253008, size = 94447056234102, size_with_redzone = 140720326295696, name = 0x7 <error: Cannot access memory at address 0x7>, module_name = 0x7f4b456bcfc0 <__asan::instance> "", has_dynamic_init = 135700624081120, gcc_location = 0x7ffc010fc060, odr_indicator = 139961263353190}, {beg = 140720326295744, size = 6, size_with_redzone = 139961263968192, name = 0x7c0b43717830 "\003\021", module_name = 0x7ffc010fc090 "\b", has_dynamic_init = 139961262319416, gcc_location = 0x78, odr_indicator = 136387817994288}}, reg_sites = {17809536, 32764, 1151304046, 32587}, access_size = 0, size = 124 '|'}, wild = {addr = 0, access_size = 0}}}}}, AllocTypeMismatch = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000K{\000\000\377\000\000\000\000\000\000\000\240\227a+\346U\000\000fmbEK\177\000\000 \274\017\001\374\177\000\000\002\000\000\000\000\000\000\000\300\317kEK\177\000\000\220\noC\313{\000\000\360\273\017\001\374\177\000\0008\247REK\177\000\000^\000\000\000\000\000\000\000\220\noC\313{\000\000\320@\340CK\177\000\000\020\274\017\001\374\177\000\000\240\noC\313{\000\000q\000\000\000\000\000\000\000\200\304\017\001\374\177\000\000^\000\000\000\000\000\000\000@\304\017\001\374\177\000\000\301\323`EK\177\000\000\"\272Z+\346U\000\000\270\377\377\377"...}, tid = 0}, dealloc_stack = 0x7ffc00000002, alloc_type = 1131282952, dealloc_type = 31931, addr_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 0, kind = (__asan::kShadowKindGap | unknown: 0xf4), shadow_byte = 5 '\005'}, heap = {addr = 0, alloc_tid = 11033770984949, free_tid = 137143732011528, alloc_stack_id = 392, free_stack_id = 0, chunk_access = {bad_addr = 137143732011136, offset = 752, chunk_begin = 140720326270984, chunk_size = 139961262295839, user_requested_alignment = 1, access_type = 0, alloc_type = 0}}, stack = {addr = 0, tid = 11033770984949, offset = 137143732011528, frame_pc = 392, access_size = 137143732011136, frame_descr = 0x2f0 <error: Cannot access memory at address 0x2f0>}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 11033770984949, size = 137143732011528, size_with_redzone = 392, name = 0x7cbb436e0080 "\t\n", module_name = 0x2f0 <error: Cannot access memory at address 0x2f0>, has_dynamic_init = 140720326270984, gcc_location = 0x7f4b45524b1f <__asan::asan_malloc(unsigned long, __sanitizer::BufferedStackTrace*)+47>, odr_indicator = 1}, {beg = 136387817919424, size = 140720326297600, size_with_redzone = 139961263252946, name = 0x3 <error: Cannot access memory at address 0x3>, module_name = 0x1e43e04000 <error: Cannot access memory at address 0x1e43e04000>, has_dynamic_init = 140720326295520, gcc_location = 0x2, odr_indicator = 139961263253008}, {beg = 94447056234102, size = 140720326295696, size_with_redzone = 7, name = 0x7f4b456bcfc0 <__asan::instance> "", module_name = 0x7b6b437e80e0 "\003\021", has_dynamic_init = 140720326295648, gcc_location = 0x7f4b45626d66 <__sanitizer::RunFreeHooks(void*)+86>, odr_indicator = 140720326295744}, {beg = 6, size = 139961263968192, size_with_redzone = 136387817994288, name = 0x7ffc010fc090 "\b", module_name = 0x7f4b4552a738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", has_dynamic_init = 120, gcc_location = 0x7c0b43717830, odr_indicator = 140720326295680}}, reg_sites = {1151304046, 32587, 0, 0}, access_size = 94447055675004, size = 176 '\260'}, wild = {addr = 0, access_size = 11033770984949}}}}}, MallocUsableSizeNotOwned = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000K{\000\000\377\000\000\000\000\000\000\000\240\227a+\346U\000\000fmbEK\177\000\000 \274\017\001\374\177\000\000\002\000\000\000\000\000\000\000\300\317kEK\177\000\000\220\noC\313{\000\000\360\273\017\001\374\177\000\0008\247REK\177\000\000^\000\000\000\000\000\000\000\220\noC\313{\000\000\320@\340CK\177\000\000\020\274\017\001\374\177\000\000\240\noC\313{\000\000q\000\000\000\000\000\000\000\200\304\017\001\374\177\000\000^\000\000\000\000\000\000\000@\304\017\001\374\177\000\000\301\323`EK\177\000\000\"\272Z+\346U\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffc00000002, addr_description = {data = {kind = 1131282952, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11033770984949, alloc_stack_id = 1131282952, free_stack_id = 31931, chunk_access = {bad_addr = 392, offset = 137143732011136, chunk_begin = 752, chunk_size = 140720326270984, user_requested_alignment = 2847, access_type = 0, alloc_type = 1}}, stack = {addr = 0, tid = 0, offset = 11033770984949, frame_pc = 137143732011528, access_size = 392, frame_descr = 0x7cbb436e0080 "\t\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11033770984949, size_with_redzone = 137143732011528, name = 0x188 <error: Cannot access memory at address 0x188>, module_name = 0x7cbb436e0080 "\t\n", has_dynamic_init = 752, gcc_location = 0x7ffc010f6008, odr_indicator = 139961262295839}, {beg = 1, size = 136387817919424, size_with_redzone = 140720326297600, name = 0x7f4b4560e5d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", module_name = 0x3 <error: Cannot access memory at address 0x3>, has_dynamic_init = 129987788800, gcc_location = 0x7ffc010fbfe0, odr_indicator = 2}, {beg = 139961263253008, size = 94447056234102, size_with_redzone = 140720326295696, name = 0x7 <error: Cannot access memory at address 0x7>, module_name = 0x7f4b456bcfc0 <__asan::instance> "", has_dynamic_init = 135700624081120, gcc_location = 0x7ffc010fc060, odr_indicator = 139961263353190}, {beg = 140720326295744, size = 6, size_with_redzone = 139961263968192, name = 0x7c0b43717830 "\003\021", module_name = 0x7ffc010fc090 "\b", has_dynamic_init = 139961262319416, gcc_location = 0x78, odr_indicator = 136387817994288}}, reg_sites = {17809536, 32764, 1151304046, 32587}, access_size = 0, size = 124 '|'}, wild = {addr = 0, access_size = 0}}}}}, SanitizerGetAllocatedSizeNotOwned = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000K{\000\000\377\000\000\000\000\000\000\000\240\227a+\346U\000\000fmbEK\177\000\000 \274\017\001\374\177\000\000\002\000\000\000\000\000\000\000\300\317kEK\177\000\000\220\noC\313{\000\000\360\273\017\001\374\177\000\0008\247REK\177\000\000^\000\000\000\000\000\000\000\220\noC\313{\000\000\320@\340CK\177\000\000\020\274\017\001\374\177\000\000\240\noC\313{\000\000q\000\000\000\000\000\000\000\200\304\017\001\374\177\000\000^\000\000\000\000\000\000\000@\304\017\001\374\177\000\000\301\323`EK\177\000\000\"\272Z+\346U\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffc00000002, addr_description = {data = {kind = 1131282952, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11033770984949, alloc_stack_id = 1131282952, free_stack_id = 31931, chunk_access = {bad_addr = 392, offset = 137143732011136, chunk_begin = 752, chunk_size = 140720326270984, user_requested_alignment = 2847, access_type = 0, alloc_type = 1}}, stack = {addr = 0, tid = 0, offset = 11033770984949, frame_pc = 137143732011528, access_size = 392, frame_descr = 0x7cbb436e0080 "\t\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11033770984949, size_with_redzone = 137143732011528, name = 0x188 <error: Cannot access memory at address 0x188>, module_name = 0x7cbb436e0080 "\t\n", has_dynamic_init = 752, gcc_location = 0x7ffc010f6008, odr_indicator = 139961262295839}, {beg = 1, size = 136387817919424, size_with_redzone = 140720326297600, name = 0x7f4b4560e5d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", module_name = 0x3 <error: Cannot access memory at address 0x3>, has_dynamic_init = 129987788800, gcc_location = 0x7ffc010fbfe0, odr_indicator = 2}, {beg = 139961263253008, size = 94447056234102, size_with_redzone = 140720326295696, name = 0x7 <error: Cannot access memory at address 0x7>, module_name = 0x7f4b456bcfc0 <__asan::instance> "", has_dynamic_init = 135700624081120, gcc_location = 0x7ffc010fc060, odr_indicator = 139961263353190}, {beg = 140720326295744, size = 6, size_with_redzone = 139961263968192, name = 0x7c0b43717830 "\003\021", module_name = 0x7ffc010fc090 "\b", has_dynamic_init = 139961262319416, gcc_location = 0x78, odr_indicator = 136387817994288}}, reg_sites = {17809536, 32764, 1151304046, 32587}, access_size = 0, size = 124 '|'}, wild = {addr = 0, access_size = 0}}}}}, CallocOverflow = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000K{\000\000\377\000\000\000\000\000\000\000\240\227a+\346U\000\000fmbEK\177\000\000 \274\017\001\374\177\000\000\002\000\000\000\000\000\000\000\300\317kEK\177\000\000\220\noC\313{\000\000\360\273\017\001\374\177\000\0008\247REK\177\000\000^\000\000\000\000\000\000\000\220\noC\313{\000\000\320@\340CK\177\000\000\020\274\017\001\374\177\000\000\240\noC\313{\000\000q\000\000\000\000\000\000\000\200\304\017\001\374\177\000\000^\000\000\000\000\000\000\000@\304\017\001\374\177\000\000\301\323`EK\177\000\000\"\272Z+\346U\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffc00000002, count = 137143732011528, size = 0}, ReallocArrayOverflow = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000K{\000\000\377\000\000\000\000\000\000\000\240\227a+\346U\000\000fmbEK\177\000\000 \274\017\001\374\177\000\000\002\000\000\000\000\000\000\000\300\317kEK\177\000\000\220\noC\313{\000\000\360\273\017\001\374\177\000\0008\247REK\177\000\000^\000\000\000\000\000\000\000\220\noC\313{\000\000\320@\340CK\177\000\000\020\274\017\001\374\177\000\000\240\noC\313{\000\000q\000\000\000\000\000\000\000\200\304\017\001\374\177\000\000^\000\000\000\000\000\000\000@\304\017\001\374\177\000\000\301\323`EK\177\000\000\"\272Z+\346U\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffc00000002, count = 137143732011528, size = 0}, PvallocOverflow = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000K{\000\000\377\000\000\000\000\000\000\000\240\227a+\346U\000\000fmbEK\177\000\000 \274\017\001\374\177\000\000\002\000\000\000\000\000\000\000\300\317kEK\177\000\000\220\noC\313{\000\000\360\273\017\001\374\177\000\0008\247REK\177\000\000^\000\000\000\000\000\000\000\220\noC\313{\000\000\320@\340CK\177\000\000\020\274\017\001\374\177\000\000\240\noC\313{\000\000q\000\000\000\000\000\000\000\200\304\017\001\374\177\000\000^\000\000\000\000\000\000\000@\304\017\001\374\177\000\000\301\323`EK\177\000\000\"\272Z+\346U\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffc00000002, size = 137143732011528}, InvalidAllocationAlignment = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000K{\000\000\377\000\000\000\000\000\000\000\240\227a+\346U\000\000fmbEK\177\000\000 \274\017\001\374\177\000\000\002\000\000\000\000\000\000\000\300\317kEK\177\000\000\220\noC\313{\000\000\360\273\017\001\374\177\000\0008\247REK\177\000\000^\000\000\000\000\000\000\000\220\noC\313{\000\000\320@\340CK\177\000\000\020\274\017\001\374\177\000\000\240\noC\313{\000\000q\000\000\000\000\000\000\000\200\304\017\001\374\177\000\000^\000\000\000\000\000\000\000@\304\017\001\374\177\000\000\301\323`EK\177\000\000\"\272Z+\346U\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffc00000002, alignment = 137143732011528}, InvalidAlignedAllocAlignment = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000K{\000\000\377\000\000\000\000\000\000\000\240\227a+\346U\000\000fmbEK\177\000\000 \274\017\001\374\177\000\000\002\000\000\000\000\000\000\000\300\317kEK\177\000\000\220\noC\313{\000\000\360\273\017\001\374\177\000\0008\247REK\177\000\000^\000\000\000\000\000\000\000\220\noC\313{\000\000\320@\340CK\177\000\000\020\274\017\001\374\177\000\000\240\noC\313{\000\000q\000\000\000\000\000\000\000\200\304\017\001\374\177\000\000^\000\000\000\000\000\000\000@\304\017\001\374\177\000\000\301\323`EK\177\000\000\"\272Z+\346U\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffc00000002, size = 137143732011528, alignment = 0}, InvalidPosixMemalignAlignment = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000K{\000\000\377\000\000\000\000\000\000\000\240\227a+\346U\000\000fmbEK\177\000\000 \274\017\001\374\177\000\000\002\000\000\000\000\000\000\000\300\317kEK\177\000\000\220\noC\313{\000\000\360\273\017\001\374\177\000\0008\247REK\177\000\000^\000\000\000\000\000\000\000\220\noC\313{\000\000\320@\340CK\177\000\000\020\274\017\001\374\177\000\000\240\noC\313{\000\000q\000\000\000\000\000\000\000\200\304\017\001\374\177\000\000^\000\000\000\000\000\000\000@\304\017\001\374\177\000\000\301\323`EK\177\000\000\"\272Z+\346U\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffc00000002, alignment = 137143732011528}, AllocationSizeTooBig = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000K{\000\000\377\000\000\000\000\000\000\000\240\227a+\346U\000\000fmbEK\177\000\000 \274\017\001\374\177\000\000\002\000\000\000\000\000\000\000\300\317kEK\177\000\000\220\noC\313{\000\000\360\273\017\001\374\177\000\0008\247REK\177\000\000^\000\000\000\000\000\000\000\220\noC\313{\000\000\320@\340CK\177\000\000\020\274\017\001\374\177\000\000\240\noC\313{\000\000q\000\000\000\000\000\000\000\200\304\017\001\374\177\000\000^\000\000\000\000\000\000\000@\304\017\001\374\177\000\000\301\323`EK\177\000\000\"\272Z+\346U\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffc00000002, user_size = 137143732011528, total_size = 0, max_size = 0}, RssLimitExceeded = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000K{\000\000\377\000\000\000\000\000\000\000\240\227a+\346U\000\000fmbEK\177\000\000 \274\017\001\374\177\000\000\002\000\000\000\000\000\000\000\300\317kEK\177\000\000\220\noC\313{\000\000\360\273\017\001\374\177\000\0008\247REK\177\000\000^\000\000\000\000\000\000\000\220\noC\313{\000\000\320@\340CK\177\000\000\020\274\017\001\374\177\000\000\240\noC\313{\000\000q\000\000\000\000\000\000\000\200\304\017\001\374\177\000\000^\000\000\000\000\000\000\000@\304\017\001\374\177\000\000\301\323`EK\177\000\000\"\272Z+\346U\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffc00000002}, OutOfMemory = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000K{\000\000\377\000\000\000\000\000\000\000\240\227a+\346U\000\000fmbEK\177\000\000 \274\017\001\374\177\000\000\002\000\000\000\000\000\000\000\300\317kEK\177\000\000\220\noC\313{\000\000\360\273\017\001\374\177\000\0008\247REK\177\000\000^\000\000\000\000\000\000\000\220\noC\313{\000\000\320@\340CK\177\000\000\020\274\017\001\374\177\000\000\240\noC\313{\000\000q\000\000\000\000\000\000\000\200\304\017\001\374\177\000\000^\000\000\000\000\000\000\000@\304\017\001\374\177\000\000\301\323`EK\177\000\000\"\272Z+\346U\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffc00000002, requested_size = 137143732011528}, StringFunctionMemoryRangesOverlap = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000K{\000\000\377\000\000\000\000\000\000\000\240\227a+\346U\000\000fmbEK\177\000\000 \274\017\001\374\177\000\000\002\000\000\000\000\000\000\000\300\317kEK\177\000\000\220\noC\313{\000\000\360\273\017\001\374\177\000\0008\247REK\177\000\000^\000\000\000\000\000\000\000\220\noC\313{\000\000\320@\340CK\177\000\000\020\274\017\001\374\177\000\000\240\noC\313{\000\000q\000\000\000\000\000\000\000\200\304\017\001\374\177\000\000^\000\000\000\000\000\000\000@\304\017\001\374\177\000\000\301\323`EK\177\000\000\"\272Z+\346U\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffc00000002, length1 = 137143732011528, length2 = 0, addr1_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 11033770984949, kind = (unknown: 0x8), shadow_byte = 2 '\002'}, heap = {addr = 11033770984949, alloc_tid = 137143732011528, free_tid = 392, alloc_stack_id = 1131282560, free_stack_id = 31931, chunk_access = {bad_addr = 752, offset = 140720326270984, chunk_begin = 139961262295839, chunk_size = 1, user_requested_alignment = 960, access_type = 1, alloc_type = 1}}, stack = {addr = 11033770984949, tid = 137143732011528, offset = 392, frame_pc = 137143732011136, access_size = 752, frame_descr = 0x7ffc010f6008 ""}, global = {addr = 11033770984949, static kMaxGlobals = 4, globals = {{beg = 137143732011528, size = 392, size_with_redzone = 137143732011136, name = 0x2f0 <error: Cannot access memory at address 0x2f0>, module_name = 0x7ffc010f6008 "", has_dynamic_init = 139961262295839, gcc_location = 0x1, odr_indicator = 136387817919424}, {beg = 140720326297600, size = 139961263252946, size_with_redzone = 3, name = 0x1e43e04000 <error: Cannot access memory at address 0x1e43e04000>, module_name = 0x7ffc010fbfe0 "\020\346`EK\177", has_dynamic_init = 2, gcc_location = 0x7f4b4560e610 <___interceptor_malloc(__sanitizer::uptr)+192>, odr_indicator = 94447056234102}, {beg = 140720326295696, size = 7, size_with_redzone = 139961263968192, name = 0x7b6b437e80e0 "\003\021", module_name = 0x7ffc010fc060 "\200\300\017\001\374\177", has_dynamic_init = 139961263353190, gcc_location = 0x7ffc010fc0c0, odr_indicator = 6}, {beg = 139961263968192, size = 136387817994288, size_with_redzone = 140720326295696, name = 0x7f4b4552a738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", module_name = 0x78 <error: Cannot access memory at address 0x78>, has_dynamic_init = 136387817994288, gcc_location = 0x7ffc010fc080, odr_indicator = 139961250578798}}, reg_sites = {0, 0, 724835964, 21990}, access_size = 140720326297520, size = 160 '\240'}, wild = {addr = 11033770984949, access_size = 137143732011528}}}}, addr2_description = {data = {kind = 8, {shadow = {addr = 139961263679383, kind = __asan::kShadowKindLow, shadow_byte = 253 '\375'}, heap = {addr = 139961263679383, alloc_tid = 139961260244224, free_tid = 140720326297168, alloc_stack_id = 1163765971, free_stack_id = 32587, chunk_access = {bad_addr = 140720326297168, offset = 1161140792, chunk_begin = 140720326297264, chunk_size = 139961260195414, user_requested_alignment = 384, access_type = 0, alloc_type = 0}}, stack = {addr = 139961263679383, tid = 139961260244224, offset = 140720326297168, frame_pc = 139961263040723, access_size = 140720326297168, frame_descr = 0x45359a38 <error: Cannot access memory at address 0x45359a38>}, global = {addr = 139961263679383, static kMaxGlobals = 4, globals = {{beg = 139961260244224, size = 140720326297168, size_with_redzone = 139961263040723, name = 0x7ffc010fc650 "\200\001nC[|", module_name = 0x45359a38 <error: Cannot access memory at address 0x45359a38>, has_dynamic_init = 140720326297264, gcc_location = 0x7f4b45323e56, odr_indicator = 136731415150976}, {beg = 139961260195364, size = 140720326297216, size_with_redzone = 6873078958752, name = 0x14 <error: Cannot access memory at address 0x14>, module_name = 0x2f40f15d <error: Cannot access memory at address 0x2f40f15d>, has_dynamic_init = 140720326297248, gcc_location = 0x7bab436e0aa0, odr_indicator = 140720326297280}, {beg = 136387817994304, size = 136731415150976, size_with_redzone = 135838062422544, name = 0x55e62b522740 <watch_destroy> "\363\017\036\372SH\211\373H\203\354\020H\205\377\017\2049\002", module_name = 0x7f4b45388dce "I\211\305L9\360tJH\205\300tUH\213E\310dH+\004%(", has_dynamic_init = 136387817994304, gcc_location = 0x7f4b45388dce, odr_indicator = 94447057643328}, {beg = 0, size = 140720326297376, size_with_redzone = 139961260608974, name = 0x7c4b436e0f40 "\001", module_name = 0x7b8b436f84d0 "\002", has_dynamic_init = 44, gcc_location = 0x0, odr_indicator = 135838062052568}}, reg_sites = {1131751976, 31627, 1131382000, 31627}, access_size = 94447057645198, size = 16 '\020'}, wild = {addr = 139961263679383, access_size = 139961260244224}}}}, function = 0xf18a7207d6ad2300 <error: Cannot access memory at address 0xf18a7207d6ad2300>}, StringFunctionSizeOverflow = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000K{\000\000\377\000\000\000\000\000\000\000\240\227a+\346U\000\000fmbEK\177\000\000 \274\017\001\374\177\000\000\002\000\000\000\000\000\000\000\300\317kEK\177\000\000\220\noC\313{\000\000\360\273\017\001\374\177\000\0008\247REK\177\000\000^\000\000\000\000\000\000\000\220\noC\313{\000\000\320@\340CK\177\000\000\020\274\017\001\374\177\000\000\240\noC\313{\000\000q\000\000\000\000\000\000\000\200\304\017\001\374\177\000\000^\000\000\000\000\000\000\000@\304\017\001\374\177\000\000\301\323`EK\177\000\000\"\272Z+\346U\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffc00000002, addr_description = {data = {kind = 1131282952, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11033770984949, alloc_stack_id = 1131282952, free_stack_id = 31931, chunk_access = {bad_addr = 392, offset = 137143732011136, chunk_begin = 752, chunk_size = 140720326270984, user_requested_alignment = 2847, access_type = 0, alloc_type = 1}}, stack = {addr = 0, tid = 0, offset = 11033770984949, frame_pc = 137143732011528, access_size = 392, frame_descr = 0x7cbb436e0080 "\t\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11033770984949, size_with_redzone = 137143732011528, name = 0x188 <error: Cannot access memory at address 0x188>, module_name = 0x7cbb436e0080 "\t\n", has_dynamic_init = 752, gcc_location = 0x7ffc010f6008, odr_indicator = 139961262295839}, {beg = 1, size = 136387817919424, size_with_redzone = 140720326297600, name = 0x7f4b4560e5d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", module_name = 0x3 <error: Cannot access memory at address 0x3>, has_dynamic_init = 129987788800, gcc_location = 0x7ffc010fbfe0, odr_indicator = 2}, {beg = 139961263253008, size = 94447056234102, size_with_redzone = 140720326295696, name = 0x7 <error: Cannot access memory at address 0x7>, module_name = 0x7f4b456bcfc0 <__asan::instance> "", has_dynamic_init = 135700624081120, gcc_location = 0x7ffc010fc060, odr_indicator = 139961263353190}, {beg = 140720326295744, size = 6, size_with_redzone = 139961263968192, name = 0x7c0b43717830 "\003\021", module_name = 0x7ffc010fc090 "\b", has_dynamic_init = 139961262319416, gcc_location = 0x78, odr_indicator = 136387817994288}}, reg_sites = {17809536, 32764, 1151304046, 32587}, access_size = 0, size = 124 '|'}, wild = {addr = 0, access_size = 0}}}}, size = 140720326297520}, BadParamsToAnnotateContiguousContainer = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000K{\000\000\377\000\000\000\000\000\000\000\240\227a+\346U\000\000fmbEK\177\000\000 \274\017\001\374\177\000\000\002\000\000\000\000\000\000\000\300\317kEK\177\000\000\220\noC\313{\000\000\360\273\017\001\374\177\000\0008\247REK\177\000\000^\000\000\000\000\000\000\000\220\noC\313{\000\000\320@\340CK\177\000\000\020\274\017\001\374\177\000\000\240\noC\313{\000\000q\000\000\000\000\000\000\000\200\304\017\001\374\177\000\000^\000\000\000\000\000\000\000@\304\017\001\374\177\000\000\301\323`EK\177\000\000\"\272Z+\346U\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffc00000002, beg = 137143732011528, end = 0, old_mid = 0, new_mid = 11033770984949}, BadParamsToAnnotateDoubleEndedContiguousContainer = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000K{\000\000\377\000\000\000\000\000\000\000\240\227a+\346U\000\000fmbEK\177\000\000 \274\017\001\374\177\000\000\002\000\000\000\000\000\000\000\300\317kEK\177\000\000\220\noC\313{\000\000\360\273\017\001\374\177\000\0008\247REK\177\000\000^\000\000\000\000\000\000\000\220\noC\313{\000\000\320@\340CK\177\000\000\020\274\017\001\374\177\000\000\240\noC\313{\000\000q\000\000\000\000\000\000\000\200\304\017\001\374\177\000\000^\000\000\000\000\000\000\000@\304\017\001\374\177\000\000\301\323`EK\177\000\000\"\272Z+\346U\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffc00000002, storage_beg = 137143732011528, storage_end = 0, old_container_beg = 0, old_container_end = 11033770984949, new_container_beg = 137143732011528, new_container_end = 392}, BadParamsToCopyContiguousContainerAnnotations = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000K{\000\000\377\000\000\000\000\000\000\000\240\227a+\346U\000\000fmbEK\177\000\000 \274\017\001\374\177\000\000\002\000\000\000\000\000\000\000\300\317kEK\177\000\000\220\noC\313{\000\000\360\273\017\001\374\177\000\0008\247REK\177\000\000^\000\000\000\000\000\000\000\220\noC\313{\000\000\320@\340CK\177\000\000\020\274\017\001\374\177\000\000\240\noC\313{\000\000q\000\000\000\000\000\000\000\200\304\017\001\374\177\000\000^\000\000\000\000\000\000\000@\304\017\001\374\177\000\000\301\323`EK\177\000\000\"\272Z+\346U\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffc00000002, old_storage_beg = 137143732011528, old_storage_end = 0, new_storage_beg = 0, new_storage_end = 11033770984949}, ODRViolation = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000K{\000\000\377\000\000\000\000\000\000\000\240\227a+\346U\000\000fmbEK\177\000\000 \274\017\001\374\177\000\000\002\000\000\000\000\000\000\000\300\317kEK\177\000\000\220\noC\313{\000\000\360\273\017\001\374\177\000\0008\247REK\177\000\000^\000\000\000\000\000\000\000\220\noC\313{\000\000\320@\340CK\177\000\000\020\274\017\001\374\177\000\000\240\noC\313{\000\000q\000\000\000\000\000\000\000\200\304\017\001\374\177\000\000^\000\000\000\000\000\000\000@\304\017\001\374\177\000\000\301\323`EK\177\000\000\"\272Z+\346U\000\000\270\377\377\377"...}, tid = 0}, global1 = {beg = 140720308486146, size = 137143732011528, size_with_redzone = 0, name = 0x0, module_name = 0xa09000005f5 <error: Cannot access memory at address 0xa09000005f5>, has_dynamic_init = 137143732011528, gcc_location = 0x188, odr_indicator = 137143732011136}, global2 = {beg = 752, size = 140720326270984, size_with_redzone = 139961262295839, name = 0x1 <error: Cannot access memory at address 0x1>, module_name = 0x7c0b437053c0 "", has_dynamic_init = 140720326297600, gcc_location = 0x7f4b4560e5d2 <___interceptor_malloc(__sanitizer::uptr)+130>, odr_indicator = 3}, stack_id1 = 1138769920, stack_id2 = 30}, InvalidPointerPair = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000K{\000\000\377\000\000\000\000\000\000\000\240\227a+\346U\000\000fmbEK\177\000\000 \274\017\001\374\177\000\000\002\000\000\000\000\000\000\000\300\317kEK\177\000\000\220\noC\313{\000\000\360\273\017\001\374\177\000\0008\247REK\177\000\000^\000\000\000\000\000\000\000\220\noC\313{\000\000\320@\340CK\177\000\000\020\274\017\001\374\177\000\000\240\noC\313{\000\000q\000\000\000\000\000\000\000\200\304\017\001\374\177\000\000^\000\000\000\000\000\000\000@\304\017\001\374\177\000\000\301\323`EK\177\000\000\"\272Z+\346U\000\000\270\377\377\377"...}, tid = 0}, pc = 140720308486146, bp = 137143732011528, sp = 0, addr1_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 11033770984949, kind = (unknown: 0x8), shadow_byte = 2 '\002'}, heap = {addr = 11033770984949, alloc_tid = 137143732011528, free_tid = 392, alloc_stack_id = 1131282560, free_stack_id = 31931, chunk_access = {bad_addr = 752, offset = 140720326270984, chunk_begin = 139961262295839, chunk_size = 1, user_requested_alignment = 960, access_type = 1, alloc_type = 1}}, stack = {addr = 11033770984949, tid = 137143732011528, offset = 392, frame_pc = 137143732011136, access_size = 752, frame_descr = 0x7ffc010f6008 ""}, global = {addr = 11033770984949, static kMaxGlobals = 4, globals = {{beg = 137143732011528, size = 392, size_with_redzone = 137143732011136, name = 0x2f0 <error: Cannot access memory at address 0x2f0>, module_name = 0x7ffc010f6008 "", has_dynamic_init = 139961262295839, gcc_location = 0x1, odr_indicator = 136387817919424}, {beg = 140720326297600, size = 139961263252946, size_with_redzone = 3, name = 0x1e43e04000 <error: Cannot access memory at address 0x1e43e04000>, module_name = 0x7ffc010fbfe0 "\020\346`EK\177", has_dynamic_init = 2, gcc_location = 0x7f4b4560e610 <___interceptor_malloc(__sanitizer::uptr)+192>, odr_indicator = 94447056234102}, {beg = 140720326295696, size = 7, size_with_redzone = 139961263968192, name = 0x7b6b437e80e0 "\003\021", module_name = 0x7ffc010fc060 "\200\300\017\001\374\177", has_dynamic_init = 139961263353190, gcc_location = 0x7ffc010fc0c0, odr_indicator = 6}, {beg = 139961263968192, size = 136387817994288, size_with_redzone = 140720326295696, name = 0x7f4b4552a738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", module_name = 0x78 <error: Cannot access memory at address 0x78>, has_dynamic_init = 136387817994288, gcc_location = 0x7ffc010fc080, odr_indicator = 139961250578798}}, reg_sites = {0, 0, 724835964, 21990}, access_size = 140720326297520, size = 160 '\240'}, wild = {addr = 11033770984949, access_size = 137143732011528}}}}, addr2_description = {data = {kind = 8, {shadow = {addr = 139961263679383, kind = __asan::kShadowKindLow, shadow_byte = 253 '\375'}, heap = {addr = 139961263679383, alloc_tid = 139961260244224, free_tid = 140720326297168, alloc_stack_id = 1163765971, free_stack_id = 32587, chunk_access = {bad_addr = 140720326297168, offset = 1161140792, chunk_begin = 140720326297264, chunk_size = 139961260195414, user_requested_alignment = 384, access_type = 0, alloc_type = 0}}, stack = {addr = 139961263679383, tid = 139961260244224, offset = 140720326297168, frame_pc = 139961263040723, access_size = 140720326297168, frame_descr = 0x45359a38 <error: Cannot access memory at address 0x45359a38>}, global = {addr = 139961263679383, static kMaxGlobals = 4, globals = {{beg = 139961260244224, size = 140720326297168, size_with_redzone = 139961263040723, name = 0x7ffc010fc650 "\200\001nC[|", module_name = 0x45359a38 <error: Cannot access memory at address 0x45359a38>, has_dynamic_init = 140720326297264, gcc_location = 0x7f4b45323e56, odr_indicator = 136731415150976}, {beg = 139961260195364, size = 140720326297216, size_with_redzone = 6873078958752, name = 0x14 <error: Cannot access memory at address 0x14>, module_name = 0x2f40f15d <error: Cannot access memory at address 0x2f40f15d>, has_dynamic_init = 140720326297248, gcc_location = 0x7bab436e0aa0, odr_indicator = 140720326297280}, {beg = 136387817994304, size = 136731415150976, size_with_redzone = 135838062422544, name = 0x55e62b522740 <watch_destroy> "\363\017\036\372SH\211\373H\203\354\020H\205\377\017\2049\002", module_name = 0x7f4b45388dce "I\211\305L9\360tJH\205\300tUH\213E\310dH+\004%(", has_dynamic_init = 136387817994304, gcc_location = 0x7f4b45388dce, odr_indicator = 94447057643328}, {beg = 0, size = 140720326297376, size_with_redzone = 139961260608974, name = 0x7c4b436e0f40 "\001", module_name = 0x7b8b436f84d0 "\002", has_dynamic_init = 44, gcc_location = 0x0, odr_indicator = 135838062052568}}, reg_sites = {1131751976, 31627, 1131382000, 31627}, access_size = 94447057645198, size = 16 '\020'}, wild = {addr = 139961263679383, access_size = 139961260244224}}}}}, Generic = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000K{\000\000\377\000\000\000\000\000\000\000\240\227a+\346U\000\000fmbEK\177\000\000 \274\017\001\374\177\000\000\002\000\000\000\000\000\000\000\300\317kEK\177\000\000\220\noC\313{\000\000\360\273\017\001\374\177\000\0008\247REK\177\000\000^\000\000\000\000\000\000\000\220\noC\313{\000\000\320@\340CK\177\000\000\020\274\017\001\374\177\000\000\240\noC\313{\000\000q\000\000\000\000\000\000\000\200\304\017\001\374\177\000\000^\000\000\000\000\000\000\000@\304\017\001\374\177\000\000\301\323`EK\177\000\000\"\272Z+\346U\000\000\270\377\377\377"...}, tid = 0}, addr_description = {data = {kind = __asan::kAddressKindHeap, {shadow = {addr = 137143732011528, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 137143732011528, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1525, free_stack_id = 2569, chunk_access = {bad_addr = 137143732011528, offset = 392, chunk_begin = 137143732011136, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, stack = {addr = 137143732011528, tid = 0, offset = 0, frame_pc = 11033770984949, access_size = 137143732011528, frame_descr = 0x188 <error: Cannot access memory at address 0x188>}, global = {addr = 137143732011528, static kMaxGlobals = 4, globals = {{beg = 0, size = 0, size_with_redzone = 11033770984949, name = 0x7cbb436e0208 "", module_name = 0x188 <error: Cannot access memory at address 0x188>, has_dynamic_init = 137143732011136, gcc_location = 0x2f0, odr_indicator = 140720326270984}, {beg = 139961262295839, size = 1, size_with_redzone = 136387817919424, name = 0x7ffc010fc800 "\320\241\036+\346U", module_name = 0x7f4b4560e5d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", has_dynamic_init = 3, gcc_location = 0x1e43e04000, odr_indicator = 140720326295520}, {beg = 2, size = 139961263253008, size_with_redzone = 94447056234102, name = 0x7ffc010fc090 "\b", module_name = 0x7 <error: Cannot access memory at address 0x7>, has_dynamic_init = 139961263968192, gcc_location = 0x7b6b437e80e0, odr_indicator = 140720326295648}, {beg = 139961263353190, size = 140720326295744, size_with_redzone = 6, name = 0x7f4b456bcfc0 <__asan::instance> "", module_name = 0x7c0b43717830 "\003\021", has_dynamic_init = 140720326295696, gcc_location = 0x7f4b4552a738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248>, odr_indicator = 120}}, reg_sites = {1131509808, 31755, 17809536, 32764}, access_size = 139961250578798, size = 0 '\000'}, wild = {addr = 137143732011528, access_size = 0}}}}, pc = 94447055675004, bp = 140720326297520, sp = 140720326297504, access_size = 8, bug_descr = 0x7f4b45676797 "heap-use-after-free", is_write = false, shadow_val = 253 '\375'}}}, halt_on_error_ = true}
error = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000K{\000\000\377\000\000\000\000\000\000\000\240\227a+\346U\000\000fmbEK\177\000\000 \274\017\001\374\177\000\000\002\000\000\000\000\000\000\000\300\317kEK\177\000\000\220\noC\313{\000\000\360\273\017\001\374\177\000\0008\247REK\177\000\000^\000\000\000\000\000\000\000\220\noC\313{\000\000\320@\340CK\177\000\000\020\274\017\001\374\177\000\000\240\noC\313{\000\000q\000\000\000\000\000\000\000\200\304\017\001\374\177\000\000^\000\000\000\000\000\000\000@\304\017\001\374\177\000\000\301\323`EK\177\000\000\"\272Z+\346U\000\000\270\377\377\377"...}, tid = 0}, addr_description = {data = {kind = __asan::kAddressKindHeap, {shadow = {addr = 137143732011528, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 137143732011528, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1525, free_stack_id = 2569, chunk_access = {bad_addr = 137143732011528, offset = 392, chunk_begin = 137143732011136, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, stack = {addr = 137143732011528, tid = 0, offset = 0, frame_pc = 11033770984949, access_size = 137143732011528, frame_descr = 0x188 <error: Cannot access memory at address 0x188>}, global = {addr = 137143732011528, static kMaxGlobals = 4, globals = {{beg = 0, size = 0, size_with_redzone = 11033770984949, name = 0x7cbb436e0208 "", module_name = 0x188 <error: Cannot access memory at address 0x188>, has_dynamic_init = 137143732011136, gcc_location = 0x2f0, odr_indicator = 140720326270984}, {beg = 139961262295839, size = 1, size_with_redzone = 136387817919424, name = 0x7ffc010fc800 "\320\241\036+\346U", module_name = 0x7f4b4560e5d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", has_dynamic_init = 3, gcc_location = 0x1e43e04000, odr_indicator = 140720326295520}, {beg = 2, size = 139961263253008, size_with_redzone = 94447056234102, name = 0x7ffc010fc090 "\b", module_name = 0x7 <error: Cannot access memory at address 0x7>, has_dynamic_init = 139961263968192, gcc_location = 0x7b6b437e80e0, odr_indicator = 140720326295648}, {beg = 139961263353190, size = 140720326295744, size_with_redzone = 6, name = 0x7f4b456bcfc0 <__asan::instance> "", module_name = 0x7c0b43717830 "\003\021", has_dynamic_init = 140720326295696, gcc_location = 0x7f4b4552a738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248>, odr_indicator = 120}}, reg_sites = {1131509808, 31755, 17809536, 32764}, access_size = 139961250578798, size = 0 '\000'}, wild = {addr = 137143732011528, access_size = 0}}}}, pc = 94447055675004, bp = 140720326297520, sp = 140720326297504, access_size = 8, bug_descr = 0x7f4b45676797 "heap-use-after-free", is_write = false, shadow_val = 253 '\375'}
#9 0x00007f4b4561af8d in __asan::ReportGenericError (pc=<optimized out>, bp=bp@entry=140720326297520, sp=sp@entry=140720326297504, addr=<optimized out>, is_write=is_write@entry=false, access_size=access_size@entry=8, exp=<optimized out>, fatal=true) at ../../../../src/libsanitizer/asan/asan_report.cpp:536
in_report = <optimized out>
error = <optimized out>
enable_fp = <optimized out>
#10 0x00007f4b4561c3f9 in __asan::__asan_report_load8 (addr=<optimized out>) at ../../../../src/libsanitizer/asan/asan_rtl.cpp:131
bp = 140720326297520
pc = <optimized out>
local_stack = 140720326297632
sp = 140720326297504
#11 0x000055e62b341e7c in device_get_adapter (device=<optimized out>) at src/device.c:6917
No locals.
#12 0x000055e62b1ea20f in find_cig_session (data=0x7c0b4370bcc0, match_data=0x7b4b42584530) at profiles/audio/bap.c:2500
session = 0x7c0b4370bcc0
info = 0x7b4b42584530
#13 0x000055e62b3c9051 in queue_find (queue=<optimized out>, function=function@entry=0x55e62b1ea1d0 <find_cig_session>, match_data=match_data@entry=0x7b4b42584530) at src/shared/queue.c:230
entry = 0x7b6b4379cdf0
#14 0x000055e62b1f0cd4 in find_cig_enumerate (data=0x7c0b437053c0) at profiles/audio/bap.c:2539
info = <optimized out>
#15 bap_update_cigs_cb (user_data=0x7c0b437053c0) at profiles/audio/bap.c:2688
data = 0x7c0b437053c0
cigs = <optimized out>
unset = <optimized out>
#16 0x00007f4b45326b9b in ?? () from /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
No symbol table info available.
#17 0x00007f4b453281d7 in ?? () from /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
No symbol table info available.
#18 0x00007f4b45328577 in g_main_loop_run () from /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
No symbol table info available.
#19 0x000055e62b524f69 in mainloop_run () at src/shared/mainloop-glib.c:65
No locals.
#20 0x000055e62b52589b in mainloop_run_with_signal (func=func@entry=0x55e62b38a9b0 <signal_callback>, user_data=user_data@entry=0x0) at src/shared/mainloop-notify.c:196
data = 0x7b7b436e3490
io = 0x7b8b436f9b10
ret = <optimized out>
#21 0x000055e62b0a32cb in main (argc=<optimized out>, argv=<optimized out>) at src/main.c:1713
context = <optimized out>
err = <optimized out>
sdp_mtu = 0
sdp_flags = <optimized out>
gdbus_flags = <optimized out>
__func__ = "main""
https://github.com/bluez/bluez/pull/2551
---
Regards,
Linux Bluetooth
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH BlueZ v1] adapter: remove the devices from the list before freeing them
2026-09-18 21:59 [PATCH BlueZ v1] adapter: remove the devices from the list before freeing them Luiz Augusto von Dentz
2026-09-18 23:23 ` [BlueZ,v1] " bluez.test.bot
@ 2026-09-21 14:30 ` patchwork-bot+bluetooth
1 sibling, 0 replies; 3+ messages in thread
From: patchwork-bot+bluetooth @ 2026-09-21 14:30 UTC (permalink / raw)
To: Luiz Augusto von Dentz; +Cc: linux-bluetooth
Hello:
This patch was applied to bluetooth/bluez.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:
On Fri, 18 Sep 2026 17:59:15 -0400 you wrote:
> From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
>
> The devices of an adapter are freed one by one when it is removed, but
> the list keeps pointing at them until every one of them is gone, so it
> refers to freed devices while the remaining ones are being removed.
>
> Freeing a device looks devices up though, e.g. cleaning up its GATT
> server reports the disconnection, which searches the list for the
> device it belongs to, and the search reads the devices already freed:
>
> [...]
Here is the summary with links:
- [BlueZ,v1] adapter: remove the devices from the list before freeing them
https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=eb82d81bf26b
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-09-21 14:31 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-09-18 21:59 [PATCH BlueZ v1] adapter: remove the devices from the list before freeing them Luiz Augusto von Dentz
2026-09-18 23:23 ` [BlueZ,v1] " bluez.test.bot
2026-09-21 14:30 ` [PATCH BlueZ v1] " patchwork-bot+bluetooth
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox