* [PATCH BlueZ] bap: Fix use-after-free of device referenced by session
@ 2026-09-19 0:14 Pauli Virtanen
2026-09-19 1:24 ` [BlueZ] " bluez.test.bot
2026-09-21 14:30 ` [PATCH BlueZ] " patchwork-bot+bluetooth
0 siblings, 2 replies; 3+ messages in thread
From: Pauli Virtanen @ 2026-09-19 0:14 UTC (permalink / raw)
To: linux-bluetooth; +Cc: Pauli Virtanen
bap_attached() creates bap_data that are not bound to btd_service, and
can outlive the device (eg if ATT POLLHUP -> bap_detached is late).
This then crashes when accessing bap_data::device later.
Fix by having bap_data hold btd_device_ref(). This is similar to what
avdtp.c etc. do.
Remove no-op assign to ep->data->device in ep_register_bcast() +
bap_bcast_probe() -- these just assign the same device pointer.
Log:
ERROR: AddressSanitizer: heap-use-after-free on address 0x7d6513de0208
READ of size 8 at 0x7d6513de0208 thread T0
#0 0x5594209b7e9b in device_get_adapter src/device.c:6917
#1 0x55942086020e in find_cig_session profiles/audio/bap.c:2500
#2 0x559420a3f070 in queue_find src/shared/queue.c:230
#3 0x559420866cd3 in find_cig_enumerate profiles/audio/bap.c:2539
#4 0x559420866cd3 in bap_update_cigs_cb profiles/audio/bap.c:2688
#5 0x7ff515a46b9a
#6 0x7ff515a481d6
#7 0x7ff515a48576 in g_main_loop_run
#8 0x559420b9af48 in mainloop_run src/shared/mainloop-glib.c:65
#9 0x559420b9b87a in mainloop_run_with_signal src/shared/mainloop-notify.c:196
#10 0x5594207192ba in main src/main.c:1713
0x7d6513de0208 is located 392 bytes inside of 752-byte region [0x7d6513de0080,0x7d6513de0370)
freed by thread T0 here:
#0 0x7ff515d2d3ff in free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:51
#1 0x559420a29a39 in remove_interface gdbus/object.c:742
previously allocated by thread T0 here:
#0 0x7ff515d2e40f in calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:74
#1 0x5594209cd302 in device_new src/device.c:5008
Assisted-by: opencode:qwen3.8-flash-next
---
Notes:
This is another test-functional crash seen in CI. Triaged with LLM,
reviewed by myself.
profiles/audio/bap.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
diff --git a/profiles/audio/bap.c b/profiles/audio/bap.c
index 5771c9ae0..928796e1e 100644
--- a/profiles/audio/bap.c
+++ b/profiles/audio/bap.c
@@ -207,6 +207,9 @@ static void bap_data_free(struct bap_data *data)
if (data->cig_update_id)
g_source_remove(data->cig_update_id);
+ if (data->device)
+ btd_device_unref(data->device);
+
free(data);
}
@@ -1785,9 +1788,6 @@ static struct bap_ep *ep_register_bcast(struct bap_data *data,
ep->lpac = lpac;
ep->rpac = rpac;
- if (device)
- ep->data->device = device;
-
switch (bt_bap_pac_get_type(lpac)) {
case BT_BAP_BCAST_SOURCE:
err = asprintf(&ep->path, "%s/pac_%s%d",
@@ -3463,7 +3463,8 @@ static struct bap_data *bap_data_new(struct btd_device *device)
struct bap_data *data;
data = new0(struct bap_data, 1);
- data->device = device;
+ /* Hold reference: sessions may outlive device removal */
+ data->device = device ? btd_device_ref(device) : NULL;
data->srcs = queue_new();
data->snks = queue_new();
data->bcast = queue_new();
@@ -3888,7 +3889,6 @@ static int bap_bcast_probe(struct btd_service *service)
data = bap_data_new(device);
data->service = service;
data->adapter = adapter;
- data->device = device;
data->bap = bap;
data->bcast_snks = queue_new();
@@ -3985,6 +3985,7 @@ static int bap_probe(struct btd_service *service)
btd_device_get_gatt_db(device));
if (!data->bap) {
error("Unable to create BAP instance");
+ btd_device_unref(data->device);
free(data);
return -EINVAL;
}
--
2.55.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* RE: [BlueZ] bap: Fix use-after-free of device referenced by session
2026-09-19 0:14 [PATCH BlueZ] bap: Fix use-after-free of device referenced by session Pauli Virtanen
@ 2026-09-19 1:24 ` bluez.test.bot
2026-09-21 14:30 ` [PATCH BlueZ] " patchwork-bot+bluetooth
1 sibling, 0 replies; 3+ messages in thread
From: bluez.test.bot @ 2026-09-19 1:24 UTC (permalink / raw)
To: linux-bluetooth, pav
[-- Attachment #1: Type: text/plain, Size: 152385 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1169068/
---Test result---
Test Summary:
CheckPatch FAIL 0.37 seconds
GitLint FAIL 0.26 seconds
BuildEll PASS 18.29 seconds
BluezMake PASS 307.80 seconds
MakeCheck PASS 3.23 seconds
MakeDistcheck PASS 130.44 seconds
CheckValgrind PASS 143.32 seconds
CheckSmatch PASS 247.06 seconds
bluezmakeextell PASS 88.00 seconds
TestFunctional FAIL 1001.04 seconds
IncrementalBuild PASS 315.07 seconds
ScanBuild PASS 999.74 seconds
Details
##############################
Test: CheckPatch - FAIL
Desc: Run checkpatch.pl script
Output:
[BlueZ] bap: Fix use-after-free of device referenced by session
WARNING:COMMIT_LOG_LONG_LINE: Prefer a maximum 75 chars per line (possible unwrapped commit description?)
#104:
#9 0x559420b9b87a in mainloop_run_with_signal src/shared/mainloop-notify.c:196
/home/runner/work/bluez/bluez/src/patch/14830663.patch total: 0 errors, 1 warnings, 41 lines checked
NOTE: For some of the reported defects, checkpatch may be able to
mechanically convert to the typical style using --fix or --fix-inplace.
/home/runner/work/bluez/bluez/src/patch/14830663.patch has style problems, please review.
NOTE: Ignored message types: COMMIT_MESSAGE COMPLEX_MACRO CONST_STRUCT FILE_PATH_CHANGES MISSING_SIGN_OFF PREFER_PACKED SPDX_LICENSE_TAG SPLIT_STRING SSCANF_TO_KSTRTO
NOTE: If any of the errors are false positives, please report
them to the maintainer, see CHECKPATCH in MAINTAINERS.
##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
[BlueZ] bap: Fix use-after-free of device referenced by session
26: B1 Line exceeds max length (82>80): " #9 0x559420b9b87a in mainloop_run_with_signal src/shared/mainloop-notify.c:196"
29: B1 Line exceeds max length (93>80): "0x7d6513de0208 is located 392 bytes inside of 752-byte region [0x7d6513de0080,0x7d6513de0370)"
31: B1 Line exceeds max length (88>80): " #0 0x7ff515d2d3ff in free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:51"
35: B1 Line exceeds max length (90>80): " #0 0x7ff515d2e40f in calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:74"
##############################
Test: TestFunctional - FAIL
Desc: Run test-functional
Output:
FAIL functional.test_bap::test_bap_unicast_set_transport_created[hosts8-vm3-sc]: failed on teardown with "pytest_bluezenv.plugin.CoredumpWarning: Core dump: test-bluezenv-hosts8.0-bluetoothd-1789779689-52.core
/usr/bin/gdb: warning: Couldn't determine a path for the index cache directory.
[New LWP 52]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/usr/lib/x86_64-linux-gnu/libthread_db.so.1".
Core was generated by `/home/runner/work/bluez/bluez/src/src/src/bluetoothd --nodetach -f /run/bluetoo'.
Program terminated with signal SIGABRT, Aborted.
#0 __pthread_kill_implementation (threadid=<optimized out>, signo=6, no_tid=0) at ./nptl/pthread_kill.c:44
warning: 44 ./nptl/pthread_kill.c: No such file or directory
Thread 1 (Thread 0x7fdf93498900 (LWP 52)):
#0 __pthread_kill_implementation (threadid=<optimized out>, signo=6, no_tid=0) at ./nptl/pthread_kill.c:44
tid = <optimized out>
ret = 0
pd = <optimized out>
old_mask = {__val = {0}}
ret = <optimized out>
#1 __pthread_kill_internal (threadid=<optimized out>, signo=6) at ./nptl/pthread_kill.c:89
No locals.
#2 __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ./nptl/pthread_kill.c:100
No locals.
#3 0x00007fdf93bf3b7e in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
ret = <optimized out>
#4 0x00007fdf93bd68ec in __GI_abort () at ./stdlib/abort.c:77
act = {__sigaction_handler = {sa_handler = 0x0, sa_sigaction = 0x0}, sa_mask = {__val = {0 <repeats 16 times>}}, sa_flags = 0, sa_restorer = 0x0}
#5 0x00007fdf947fea0f in __sanitizer::Abort () at ../../../../src/libsanitizer/sanitizer_common/sanitizer_posix_libcdep.cpp:165
No locals.
#6 0x00007fdf94924c2d in __sanitizer::Die () at ../../../../src/libsanitizer/sanitizer_common/sanitizer_termination.cpp:58
No locals.
#7 0x00007fdf948f993c in __asan::ScopedInErrorReport::~ScopedInErrorReport (this=0x7ffc613893b6) at ../../../../src/libsanitizer/asan/asan_report.cpp:221
buffer_copy = {buffer_ = {<__sanitizer::InternalMmapVectorNoCtor<char, false>> = {data_ = 0x7fdf93002000 '=' <repeats 65 times>, "\n==52==ERROR: AddressSanitizer: heap-use-after-free on address 0x7d4f928e040b at pc 0x7fdf948ae445 bp 0x7ffc6138a8b0 sp 0x7ffc6138a058\n"..., capacity_bytes_ = 4096, size_ = 3838}, <No data fields>}}
buffer_copy = <optimized out>
l = <optimized out>
#8 0x00007fdf948f8e02 in __asan::ReportGenericError (pc=140598246564933, bp=140721939589296, sp=sp@entry=140721939587160, addr=addr@entry=137780714669067, is_write=is_write@entry=false, access_size=6, fatal=false, exp=<optimized out>) at ../../../../src/libsanitizer/asan/asan_report.cpp:536
in_report = {error_report_lock_ = {<No data fields>}, static current_error_ = {kind = __asan::kErrorKindGeneric, {Base = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000!K\265\211\323\316\"nal] org\200\2368a\374\177\000\0000\2248a\374\177\000\000.l\315\223\337\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\260\2348a\374\177\000\000\211M\304\223\337\177\000\000l\2248a\374\177\000\000l\2248a\374\177\000\000l\2348a\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\337\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, DeadlySignal = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000!K\265\211\323\316\"nal] org\200\2368a\374\177\000\0000\2248a\374\177\000\000.l\315\223\337\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\260\2348a\374\177\000\000\211M\304\223\337\177\000\000l\2248a\374\177\000\000l\2248a\374\177\000\000l\2348a\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\337\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, signal = {siginfo = 0xffffffff00000002, context = 0x7d4f928e040b, addr = 0, pc = 0, sp = 11832634902079, bp = 137780714669067, is_memory_access = 11, write_flag = __sanitizer::SignalContext::Unknown, is_true_faulting_addr = false}}, DoubleFree = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000!K\265\211\323\316\"nal] org\200\2368a\374\177\000\0000\2248a\374\177\000\000.l\315\223\337\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\260\2348a\374\177\000\000\211M\304\223\337\177\000\000l\2248a\374\177\000\000l\2248a\374\177\000\000l\2348a\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\337\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, second_free_stack = 0xffffffff00000002, addr_description = {addr = 137780714669067, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1599, free_stack_id = 2755, chunk_access = {bad_addr = 137780714669067, offset = 11, chunk_begin = 137780714669056, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}}, NewDeleteTypeMismatch = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000!K\265\211\323\316\"nal] org\200\2368a\374\177\000\0000\2248a\374\177\000\000.l\315\223\337\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\260\2348a\374\177\000\000\211M\304\223\337\177\000\000l\2248a\374\177\000\000l\2248a\374\177\000\000l\2348a\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\337\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, free_stack = 0xffffffff00000002, addr_description = {addr = 137780714669067, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1599, free_stack_id = 2755, chunk_access = {bad_addr = 137780714669067, offset = 11, chunk_begin = 137780714669056, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, delete_size = 136200148138272, delete_alignment = 140721939585088}, FreeNotMalloced = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000!K\265\211\323\316\"nal] org\200\2368a\374\177\000\0000\2248a\374\177\000\000.l\315\223\337\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\260\2348a\374\177\000\000\211M\304\223\337\177\000\000l\2248a\374\177\000\000l\2248a\374\177\000\000l\2348a\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\337\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, free_stack = 0xffffffff00000002, addr_description = {data = {kind = 2458780683, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11832634902079, alloc_stack_id = 2458780683, free_stack_id = 32079, chunk_access = {bad_addr = 11, offset = 137780714669056, chunk_begin = 752, chunk_size = 140721939570696, user_requested_alignment = 2336, access_type = 3, alloc_type = 2}}, stack = {addr = 0, tid = 0, offset = 11832634902079, frame_pc = 137780714669067, access_size = 11, frame_descr = 0x7d4f928e0400 "\303\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11832634902079, size_with_redzone = 137780714669067, name = 0xb <error: Cannot access memory at address 0xb>, module_name = 0x7d4f928e0400 "\303\n", has_dynamic_init = 752, gcc_location = 0x7ffc61386008, odr_indicator = 136200148138272}, {beg = 140721939585088, size = 140598245862175, size_with_redzone = 1, name = 0x7bdf9172b920 "\340t\225\222?|", module_name = 0x7ffc6138a090 "\240\2408a\374\177", has_dynamic_init = 140598246819282, gcc_location = 0x7fdf930dd0d0, odr_indicator = 130480117920}, {beg = 140721939585136, size = 3, size_with_redzone = 140598246819344, name = 0x7fdf93c44b8f <__vasprintf_internal+255> "I\211\004$H\205\300t(H\213\265\330\376\377\377L\211\352H\211\307\350\366\032\371\377H\211\301\353\212\350\254\346\n", module_name = 0x55ff4eeea57b <bt_log_vprintf+171> "\205\300\017\210=\001", has_dynamic_init = 140721939587920, gcc_location = 0x7ffc61389930, odr_indicator = 2}, {beg = 140598247534528, size = 136612484051984, size_with_redzone = 140721939585280, name = 0x7fdf94808738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", module_name = 0x3e <error: Cannot access memory at address 0x3e>, has_dynamic_init = 136612484051984, gcc_location = 0x7fdf930dd0d0, odr_indicator = 140721939585312}}, reg_sites = {2459268128, 31807, 81, 0}, access_size = 140721939587472, size = 69 'E'}, wild = {addr = 0, access_size = 0}}}}}, AllocTypeMismatch = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000!K\265\211\323\316\"nal] org\200\2368a\374\177\000\0000\2248a\374\177\000\000.l\315\223\337\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\260\2348a\374\177\000\000\211M\304\223\337\177\000\000l\2248a\374\177\000\000l\2248a\374\177\000\000l\2348a\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\337\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, dealloc_stack = 0xffffffff00000002, alloc_type = 2458780683, dealloc_type = 32079, addr_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 0, kind = (__asan::kShadowKindGap | __asan::kShadowKindHigh | unknown: 0x3c), shadow_byte = 6 '\006'}, heap = {addr = 0, alloc_tid = 11832634902079, free_tid = 137780714669067, alloc_stack_id = 11, free_stack_id = 0, chunk_access = {bad_addr = 137780714669056, offset = 752, chunk_begin = 140721939570696, chunk_size = 136200148138272, user_requested_alignment = 2112, access_type = 1, alloc_type = 2}}, stack = {addr = 0, tid = 11832634902079, offset = 137780714669067, frame_pc = 11, access_size = 137780714669056, frame_descr = 0x2f0 <error: Cannot access memory at address 0x2f0>}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 11832634902079, size = 137780714669067, size_with_redzone = 11, name = 0x7d4f928e0400 "\303\n", module_name = 0x2f0 <error: Cannot access memory at address 0x2f0>, has_dynamic_init = 140721939570696, gcc_location = 0x7bdf9172b920, odr_indicator = 140721939585088}, {beg = 140598245862175, size = 1, size_with_redzone = 136200148138272, name = 0x7ffc6138a090 "\240\2408a\374\177", module_name = 0x7fdf948ec5d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", has_dynamic_init = 140598221590736, gcc_location = 0x1e613898a0, odr_indicator = 140721939585136}, {beg = 3, size = 140598246819344, size_with_redzone = 140598233549711, name = 0x55ff4eeea57b <bt_log_vprintf+171> "\205\300\017\210=\001", module_name = 0x7ffc6138a350 "\364\2448a\374\177", has_dynamic_init = 140721939585328, gcc_location = 0x2, odr_indicator = 140598247534528}, {beg = 136612484051984, size = 140721939585280, size_with_redzone = 140598245885752, name = 0x3e <error: Cannot access memory at address 0x3e>, module_name = 0x7c3f92957410 "\003\021", has_dynamic_init = 140598221590736, gcc_location = 0x7ffc61389920, odr_indicator = 136612484052000}}, reg_sites = {81, 0, 1631101328, 32764}, access_size = 140598246564933, size = 176 '\260'}, wild = {addr = 0, access_size = 11832634902079}}}}}, MallocUsableSizeNotOwned = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000!K\265\211\323\316\"nal] org\200\2368a\374\177\000\0000\2248a\374\177\000\000.l\315\223\337\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\260\2348a\374\177\000\000\211M\304\223\337\177\000\000l\2248a\374\177\000\000l\2248a\374\177\000\000l\2348a\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\337\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, addr_description = {data = {kind = 2458780683, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11832634902079, alloc_stack_id = 2458780683, free_stack_id = 32079, chunk_access = {bad_addr = 11, offset = 137780714669056, chunk_begin = 752, chunk_size = 140721939570696, user_requested_alignment = 2336, access_type = 3, alloc_type = 2}}, stack = {addr = 0, tid = 0, offset = 11832634902079, frame_pc = 137780714669067, access_size = 11, frame_descr = 0x7d4f928e0400 "\303\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11832634902079, size_with_redzone = 137780714669067, name = 0xb <error: Cannot access memory at address 0xb>, module_name = 0x7d4f928e0400 "\303\n", has_dynamic_init = 752, gcc_location = 0x7ffc61386008, odr_indicator = 136200148138272}, {beg = 140721939585088, size = 140598245862175, size_with_redzone = 1, name = 0x7bdf9172b920 "\340t\225\222?|", module_name = 0x7ffc6138a090 "\240\2408a\374\177", has_dynamic_init = 140598246819282, gcc_location = 0x7fdf930dd0d0, odr_indicator = 130480117920}, {beg = 140721939585136, size = 3, size_with_redzone = 140598246819344, name = 0x7fdf93c44b8f <__vasprintf_internal+255> "I\211\004$H\205\300t(H\213\265\330\376\377\377L\211\352H\211\307\350\366\032\371\377H\211\301\353\212\350\254\346\n", module_name = 0x55ff4eeea57b <bt_log_vprintf+171> "\205\300\017\210=\001", has_dynamic_init = 140721939587920, gcc_location = 0x7ffc61389930, odr_indicator = 2}, {beg = 140598247534528, size = 136612484051984, size_with_redzone = 140721939585280, name = 0x7fdf94808738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", module_name = 0x3e <error: Cannot access memory at address 0x3e>, has_dynamic_init = 136612484051984, gcc_location = 0x7fdf930dd0d0, odr_indicator = 140721939585312}}, reg_sites = {2459268128, 31807, 81, 0}, access_size = 140721939587472, size = 69 'E'}, wild = {addr = 0, access_size = 0}}}}}, SanitizerGetAllocatedSizeNotOwned = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000!K\265\211\323\316\"nal] org\200\2368a\374\177\000\0000\2248a\374\177\000\000.l\315\223\337\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\260\2348a\374\177\000\000\211M\304\223\337\177\000\000l\2248a\374\177\000\000l\2248a\374\177\000\000l\2348a\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\337\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, addr_description = {data = {kind = 2458780683, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11832634902079, alloc_stack_id = 2458780683, free_stack_id = 32079, chunk_access = {bad_addr = 11, offset = 137780714669056, chunk_begin = 752, chunk_size = 140721939570696, user_requested_alignment = 2336, access_type = 3, alloc_type = 2}}, stack = {addr = 0, tid = 0, offset = 11832634902079, frame_pc = 137780714669067, access_size = 11, frame_descr = 0x7d4f928e0400 "\303\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11832634902079, size_with_redzone = 137780714669067, name = 0xb <error: Cannot access memory at address 0xb>, module_name = 0x7d4f928e0400 "\303\n", has_dynamic_init = 752, gcc_location = 0x7ffc61386008, odr_indicator = 136200148138272}, {beg = 140721939585088, size = 140598245862175, size_with_redzone = 1, name = 0x7bdf9172b920 "\340t\225\222?|", module_name = 0x7ffc6138a090 "\240\2408a\374\177", has_dynamic_init = 140598246819282, gcc_location = 0x7fdf930dd0d0, odr_indicator = 130480117920}, {beg = 140721939585136, size = 3, size_with_redzone = 140598246819344, name = 0x7fdf93c44b8f <__vasprintf_internal+255> "I\211\004$H\205\300t(H\213\265\330\376\377\377L\211\352H\211\307\350\366\032\371\377H\211\301\353\212\350\254\346\n", module_name = 0x55ff4eeea57b <bt_log_vprintf+171> "\205\300\017\210=\001", has_dynamic_init = 140721939587920, gcc_location = 0x7ffc61389930, odr_indicator = 2}, {beg = 140598247534528, size = 136612484051984, size_with_redzone = 140721939585280, name = 0x7fdf94808738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", module_name = 0x3e <error: Cannot access memory at address 0x3e>, has_dynamic_init = 136612484051984, gcc_location = 0x7fdf930dd0d0, odr_indicator = 140721939585312}}, reg_sites = {2459268128, 31807, 81, 0}, access_size = 140721939587472, size = 69 'E'}, wild = {addr = 0, access_size = 0}}}}}, CallocOverflow = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000!K\265\211\323\316\"nal] org\200\2368a\374\177\000\0000\2248a\374\177\000\000.l\315\223\337\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\260\2348a\374\177\000\000\211M\304\223\337\177\000\000l\2248a\374\177\000\000l\2248a\374\177\000\000l\2348a\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\337\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, count = 137780714669067, size = 0}, ReallocArrayOverflow = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000!K\265\211\323\316\"nal] org\200\2368a\374\177\000\0000\2248a\374\177\000\000.l\315\223\337\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\260\2348a\374\177\000\000\211M\304\223\337\177\000\000l\2248a\374\177\000\000l\2248a\374\177\000\000l\2348a\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\337\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, count = 137780714669067, size = 0}, PvallocOverflow = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000!K\265\211\323\316\"nal] org\200\2368a\374\177\000\0000\2248a\374\177\000\000.l\315\223\337\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\260\2348a\374\177\000\000\211M\304\223\337\177\000\000l\2248a\374\177\000\000l\2248a\374\177\000\000l\2348a\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\337\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, size = 137780714669067}, InvalidAllocationAlignment = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000!K\265\211\323\316\"nal] org\200\2368a\374\177\000\0000\2248a\374\177\000\000.l\315\223\337\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\260\2348a\374\177\000\000\211M\304\223\337\177\000\000l\2248a\374\177\000\000l\2248a\374\177\000\000l\2348a\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\337\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, alignment = 137780714669067}, InvalidAlignedAllocAlignment = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000!K\265\211\323\316\"nal] org\200\2368a\374\177\000\0000\2248a\374\177\000\000.l\315\223\337\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\260\2348a\374\177\000\000\211M\304\223\337\177\000\000l\2248a\374\177\000\000l\2248a\374\177\000\000l\2348a\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\337\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, size = 137780714669067, alignment = 0}, InvalidPosixMemalignAlignment = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000!K\265\211\323\316\"nal] org\200\2368a\374\177\000\0000\2248a\374\177\000\000.l\315\223\337\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\260\2348a\374\177\000\000\211M\304\223\337\177\000\000l\2248a\374\177\000\000l\2248a\374\177\000\000l\2348a\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\337\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, alignment = 137780714669067}, AllocationSizeTooBig = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000!K\265\211\323\316\"nal] org\200\2368a\374\177\000\0000\2248a\374\177\000\000.l\315\223\337\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\260\2348a\374\177\000\000\211M\304\223\337\177\000\000l\2248a\374\177\000\000l\2248a\374\177\000\000l\2348a\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\337\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, user_size = 137780714669067, total_size = 0, max_size = 0}, RssLimitExceeded = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000!K\265\211\323\316\"nal] org\200\2368a\374\177\000\0000\2248a\374\177\000\000.l\315\223\337\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\260\2348a\374\177\000\000\211M\304\223\337\177\000\000l\2248a\374\177\000\000l\2248a\374\177\000\000l\2348a\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\337\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002}, OutOfMemory = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000!K\265\211\323\316\"nal] org\200\2368a\374\177\000\0000\2248a\374\177\000\000.l\315\223\337\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\260\2348a\374\177\000\000\211M\304\223\337\177\000\000l\2248a\374\177\000\000l\2248a\374\177\000\000l\2348a\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\337\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, requested_size = 137780714669067}, StringFunctionMemoryRangesOverlap = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000!K\265\211\323\316\"nal] org\200\2368a\374\177\000\0000\2248a\374\177\000\000.l\315\223\337\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\260\2348a\374\177\000\000\211M\304\223\337\177\000\000l\2248a\374\177\000\000l\2248a\374\177\000\000l\2348a\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\337\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, length1 = 137780714669067, length2 = 0, addr1_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 11832634902079, kind = (__asan::kShadowKindGap | __asan::kShadowKindHigh | unknown: 0x8), shadow_byte = 4 '\004'}, heap = {addr = 11832634902079, alloc_tid = 137780714669067, free_tid = 11, alloc_stack_id = 2458780672, free_stack_id = 32079, chunk_access = {bad_addr = 752, offset = 140721939570696, chunk_begin = 136200148138272, chunk_size = 140721939585088, user_requested_alignment = 2847, access_type = 2, alloc_type = 0}}, stack = {addr = 11832634902079, tid = 137780714669067, offset = 11, frame_pc = 137780714669056, access_size = 752, frame_descr = 0x7ffc61386008 "\025\035\211\224\337\177"}, global = {addr = 11832634902079, static kMaxGlobals = 4, globals = {{beg = 137780714669067, size = 11, size_with_redzone = 137780714669056, name = 0x2f0 <error: Cannot access memory at address 0x2f0>, module_name = 0x7ffc61386008 "\025\035\211\224\337\177", has_dynamic_init = 136200148138272, gcc_location = 0x7ffc61389840, odr_indicator = 140598245862175}, {beg = 1, size = 136200148138272, size_with_redzone = 140721939587216, name = 0x7fdf948ec5d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", module_name = 0x7fdf930dd0d0 "", has_dynamic_init = 130480117920, gcc_location = 0x7ffc61389870, odr_indicator = 3}, {beg = 140598246819344, size = 140598233549711, size_with_redzone = 94555029284219, name = 0x7ffc6138a350 "\364\2448a\374\177", module_name = 0x7ffc61389930 "\030", has_dynamic_init = 2, gcc_location = 0x7fdf9499afc0 <__asan::instance>, odr_indicator = 136612484051984}, {beg = 140721939585280, size = 140598245885752, size_with_redzone = 62, name = 0x7c3f92957410 "\003\021", module_name = 0x7fdf930dd0d0 "", has_dynamic_init = 140721939585312, gcc_location = 0x7c3f92957420, odr_indicator = 81}}, reg_sites = {1631101328, 32764, 2492130373, 32735}, access_size = 140721939589296, size = 88 'X'}, wild = {addr = 11832634902079, access_size = 137780714669067}}}}, addr2_description = {data = {kind = 6, {shadow = {addr = 140598247245719, kind = __asan::kShadowKindLow, shadow_byte = 253 '\375'}, heap = {addr = 140598247245719, alloc_tid = 140598247554304, free_tid = 140721939588848, alloc_stack_id = 2492384722, free_stack_id = 32735, chunk_access = {bad_addr = 8315162673665959470, offset = 130735371371, chunk_begin = 140721939586768, chunk_size = 3, user_requested_alignment = 1552, access_type = 0, alloc_type = 3}}, stack = {addr = 140598247245719, tid = 140598247554304, offset = 140721939588848, frame_pc = 140598246819282, access_size = 8315162673665959470, frame_descr = 0x1e706f746b <error: Cannot access memory at address 0x1e706f746b>}, global = {addr = 140598247245719, static kMaxGlobals = 4, globals = {{beg = 140598247554304, size = 140721939588848, size_with_redzone = 140598246819282, name = 0x736564656572662e <error: Cannot access memory at address 0x736564656572662e>, module_name = 0x1e706f746b <error: Cannot access memory at address 0x1e706f746b>, has_dynamic_init = 140721939586768, gcc_location = 0x3, odr_indicator = 140598246819344}, {beg = 140598233549711, size = 94555029284219, size_with_redzone = 140721939589552, name = 0x7ffc61389f50 "p\2378a\374\177", module_name = 0x7fdf94994f78 "\001", has_dynamic_init = 140721939586960, gcc_location = 0x55ff4f02b5c0, odr_indicator = 140598225504440}, {beg = 65535, size = 140721939586880, size_with_redzone = 140598246650713, name = 0x40 <error: Cannot access memory at address 0x40>, module_name = 0x7bdf91958e00 "\0166\340E", has_dynamic_init = 140721939586928, gcc_location = 0x7fdf9480f74a <__asan_stack_malloc_0(__sanitizer::uptr)+234>, odr_indicator = 140721939586928}, {beg = 140598247075709, size = 140721939586960, size_with_redzone = 140598246919526, name = 0x7ffc6138a010 "", module_name = 0x2 <error: Cannot access memory at address 0x2>, has_dynamic_init = 140598247534528, gcc_location = 0x7c1f9294cb00, odr_indicator = 140721939587040}}, reg_sites = {2491451192, 32735, 40, 0}, access_size = 140598247025181, size = 208 '\320'}, wild = {addr = 140598247245719, access_size = 140598247554304}}}}, function = 0x7ffc6138a000 "\260\2508a\374\177"}, StringFunctionSizeOverflow = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000!K\265\211\323\316\"nal] org\200\2368a\374\177\000\0000\2248a\374\177\000\000.l\315\223\337\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\260\2348a\374\177\000\000\211M\304\223\337\177\000\000l\2248a\374\177\000\000l\2248a\374\177\000\000l\2348a\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\337\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, addr_description = {data = {kind = 2458780683, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11832634902079, alloc_stack_id = 2458780683, free_stack_id = 32079, chunk_access = {bad_addr = 11, offset = 137780714669056, chunk_begin = 752, chunk_size = 140721939570696, user_requested_alignment = 2336, access_type = 3, alloc_type = 2}}, stack = {addr = 0, tid = 0, offset = 11832634902079, frame_pc = 137780714669067, access_size = 11, frame_descr = 0x7d4f928e0400 "\303\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11832634902079, size_with_redzone = 137780714669067, name = 0xb <error: Cannot access memory at address 0xb>, module_name = 0x7d4f928e0400 "\303\n", has_dynamic_init = 752, gcc_location = 0x7ffc61386008, odr_indicator = 136200148138272}, {beg = 140721939585088, size = 140598245862175, size_with_redzone = 1, name = 0x7bdf9172b920 "\340t\225\222?|", module_name = 0x7ffc6138a090 "\240\2408a\374\177", has_dynamic_init = 140598246819282, gcc_location = 0x7fdf930dd0d0, odr_indicator = 130480117920}, {beg = 140721939585136, size = 3, size_with_redzone = 140598246819344, name = 0x7fdf93c44b8f <__vasprintf_internal+255> "I\211\004$H\205\300t(H\213\265\330\376\377\377L\211\352H\211\307\350\366\032\371\377H\211\301\353\212\350\254\346\n", module_name = 0x55ff4eeea57b <bt_log_vprintf+171> "\205\300\017\210=\001", has_dynamic_init = 140721939587920, gcc_location = 0x7ffc61389930, odr_indicator = 2}, {beg = 140598247534528, size = 136612484051984, size_with_redzone = 140721939585280, name = 0x7fdf94808738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", module_name = 0x3e <error: Cannot access memory at address 0x3e>, has_dynamic_init = 136612484051984, gcc_location = 0x7fdf930dd0d0, odr_indicator = 140721939585312}}, reg_sites = {2459268128, 31807, 81, 0}, access_size = 140721939587472, size = 69 'E'}, wild = {addr = 0, access_size = 0}}}}, size = 140721939589296}, BadParamsToAnnotateContiguousContainer = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000!K\265\211\323\316\"nal] org\200\2368a\374\177\000\0000\2248a\374\177\000\000.l\315\223\337\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\260\2348a\374\177\000\000\211M\304\223\337\177\000\000l\2248a\374\177\000\000l\2248a\374\177\000\000l\2348a\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\337\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, beg = 137780714669067, end = 0, old_mid = 0, new_mid = 11832634902079}, BadParamsToAnnotateDoubleEndedContiguousContainer = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000!K\265\211\323\316\"nal] org\200\2368a\374\177\000\0000\2248a\374\177\000\000.l\315\223\337\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\260\2348a\374\177\000\000\211M\304\223\337\177\000\000l\2248a\374\177\000\000l\2248a\374\177\000\000l\2348a\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\337\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, storage_beg = 137780714669067, storage_end = 0, old_container_beg = 0, old_container_end = 11832634902079, new_container_beg = 137780714669067, new_container_end = 11}, BadParamsToCopyContiguousContainerAnnotations = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000!K\265\211\323\316\"nal] org\200\2368a\374\177\000\0000\2248a\374\177\000\000.l\315\223\337\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\260\2348a\374\177\000\000\211M\304\223\337\177\000\000l\2248a\374\177\000\000l\2248a\374\177\000\000l\2348a\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\337\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, old_storage_beg = 137780714669067, old_storage_end = 0, new_storage_beg = 0, new_storage_end = 11832634902079}, ODRViolation = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000!K\265\211\323\316\"nal] org\200\2368a\374\177\000\0000\2248a\374\177\000\000.l\315\223\337\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\260\2348a\374\177\000\000\211M\304\223\337\177\000\000l\2248a\374\177\000\000l\2248a\374\177\000\000l\2348a\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\337\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, global1 = {beg = 18446744069414584322, size = 137780714669067, size_with_redzone = 0, name = 0x0, module_name = 0xac30000063f <error: Cannot access memory at address 0xac30000063f>, has_dynamic_init = 137780714669067, gcc_location = 0xb, odr_indicator = 137780714669056}, global2 = {beg = 752, size = 140721939570696, size_with_redzone = 136200148138272, name = 0x7ffc61389840 "\220\2408a\374\177", module_name = 0x7fdf94802b1f <__asan::asan_malloc(unsigned long, __sanitizer::BufferedStackTrace*)+47> "H\205\300t\f\311\303f.\017\037\204", has_dynamic_init = 1, gcc_location = 0x7bdf9172b920, odr_indicator = 140721939587216}, stack_id1 = 2492384722, stack_id2 = 32735}, InvalidPointerPair = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000!K\265\211\323\316\"nal] org\200\2368a\374\177\000\0000\2248a\374\177\000\000.l\315\223\337\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\260\2348a\374\177\000\000\211M\304\223\337\177\000\000l\2248a\374\177\000\000l\2248a\374\177\000\000l\2348a\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\337\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, pc = 18446744069414584322, bp = 137780714669067, sp = 0, addr1_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 11832634902079, kind = (__asan::kShadowKindGap | __asan::kShadowKindHigh | unknown: 0x8), shadow_byte = 4 '\004'}, heap = {addr = 11832634902079, alloc_tid = 137780714669067, free_tid = 11, alloc_stack_id = 2458780672, free_stack_id = 32079, chunk_access = {bad_addr = 752, offset = 140721939570696, chunk_begin = 136200148138272, chunk_size = 140721939585088, user_requested_alignment = 2847, access_type = 2, alloc_type = 0}}, stack = {addr = 11832634902079, tid = 137780714669067, offset = 11, frame_pc = 137780714669056, access_size = 752, frame_descr = 0x7ffc61386008 "\025\035\211\224\337\177"}, global = {addr = 11832634902079, static kMaxGlobals = 4, globals = {{beg = 137780714669067, size = 11, size_with_redzone = 137780714669056, name = 0x2f0 <error: Cannot access memory at address 0x2f0>, module_name = 0x7ffc61386008 "\025\035\211\224\337\177", has_dynamic_init = 136200148138272, gcc_location = 0x7ffc61389840, odr_indicator = 140598245862175}, {beg = 1, size = 136200148138272, size_with_redzone = 140721939587216, name = 0x7fdf948ec5d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", module_name = 0x7fdf930dd0d0 "", has_dynamic_init = 130480117920, gcc_location = 0x7ffc61389870, odr_indicator = 3}, {beg = 140598246819344, size = 140598233549711, size_with_redzone = 94555029284219, name = 0x7ffc6138a350 "\364\2448a\374\177", module_name = 0x7ffc61389930 "\030", has_dynamic_init = 2, gcc_location = 0x7fdf9499afc0 <__asan::instance>, odr_indicator = 136612484051984}, {beg = 140721939585280, size = 140598245885752, size_with_redzone = 62, name = 0x7c3f92957410 "\003\021", module_name = 0x7fdf930dd0d0 "", has_dynamic_init = 140721939585312, gcc_location = 0x7c3f92957420, odr_indicator = 81}}, reg_sites = {1631101328, 32764, 2492130373, 32735}, access_size = 140721939589296, size = 88 'X'}, wild = {addr = 11832634902079, access_size = 137780714669067}}}}, addr2_description = {data = {kind = 6, {shadow = {addr = 140598247245719, kind = __asan::kShadowKindLow, shadow_byte = 253 '\375'}, heap = {addr = 140598247245719, alloc_tid = 140598247554304, free_tid = 140721939588848, alloc_stack_id = 2492384722, free_stack_id = 32735, chunk_access = {bad_addr = 8315162673665959470, offset = 130735371371, chunk_begin = 140721939586768, chunk_size = 3, user_requested_alignment = 1552, access_type = 0, alloc_type = 3}}, stack = {addr = 140598247245719, tid = 140598247554304, offset = 140721939588848, frame_pc = 140598246819282, access_size = 8315162673665959470, frame_descr = 0x1e706f746b <error: Cannot access memory at address 0x1e706f746b>}, global = {addr = 140598247245719, static kMaxGlobals = 4, globals = {{beg = 140598247554304, size = 140721939588848, size_with_redzone = 140598246819282, name = 0x736564656572662e <error: Cannot access memory at address 0x736564656572662e>, module_name = 0x1e706f746b <error: Cannot access memory at address 0x1e706f746b>, has_dynamic_init = 140721939586768, gcc_location = 0x3, odr_indicator = 140598246819344}, {beg = 140598233549711, size = 94555029284219, size_with_redzone = 140721939589552, name = 0x7ffc61389f50 "p\2378a\374\177", module_name = 0x7fdf94994f78 "\001", has_dynamic_init = 140721939586960, gcc_location = 0x55ff4f02b5c0, odr_indicator = 140598225504440}, {beg = 65535, size = 140721939586880, size_with_redzone = 140598246650713, name = 0x40 <error: Cannot access memory at address 0x40>, module_name = 0x7bdf91958e00 "\0166\340E", has_dynamic_init = 140721939586928, gcc_location = 0x7fdf9480f74a <__asan_stack_malloc_0(__sanitizer::uptr)+234>, odr_indicator = 140721939586928}, {beg = 140598247075709, size = 140721939586960, size_with_redzone = 140598246919526, name = 0x7ffc6138a010 "", module_name = 0x2 <error: Cannot access memory at address 0x2>, has_dynamic_init = 140598247534528, gcc_location = 0x7c1f9294cb00, odr_indicator = 140721939587040}}, reg_sites = {2491451192, 32735, 40, 0}, access_size = 140598247025181, size = 208 '\320'}, wild = {addr = 140598247245719, access_size = 140598247554304}}}}}, Generic = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000!K\265\211\323\316\"nal] org\200\2368a\374\177\000\0000\2248a\374\177\000\000.l\315\223\337\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\260\2348a\374\177\000\000\211M\304\223\337\177\000\000l\2248a\374\177\000\000l\2248a\374\177\000\000l\2348a\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\337\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, addr_description = {data = {kind = __asan::kAddressKindHeap, {shadow = {addr = 137780714669067, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 137780714669067, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1599, free_stack_id = 2755, chunk_access = {bad_addr = 137780714669067, offset = 11, chunk_begin = 137780714669056, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, stack = {addr = 137780714669067, tid = 0, offset = 0, frame_pc = 11832634902079, access_size = 137780714669067, frame_descr = 0xb <error: Cannot access memory at address 0xb>}, global = {addr = 137780714669067, static kMaxGlobals = 4, globals = {{beg = 0, size = 0, size_with_redzone = 11832634902079, name = 0x7d4f928e040b "B", module_name = 0xb <error: Cannot access memory at address 0xb>, has_dynamic_init = 137780714669056, gcc_location = 0x2f0, odr_indicator = 140721939570696}, {beg = 136200148138272, size = 140721939585088, size_with_redzone = 140598245862175, name = 0x1 <error: Cannot access memory at address 0x1>, module_name = 0x7bdf9172b920 "\340t\225\222?|", has_dynamic_init = 140721939587216, gcc_location = 0x7fdf948ec5d2 <___interceptor_malloc(__sanitizer::uptr)+130>, odr_indicator = 140598221590736}, {beg = 130480117920, size = 140721939585136, size_with_redzone = 3, name = 0x7fdf948ec610 <___interceptor_malloc(__sanitizer::uptr)+192> "D\213\215\314\367\377\377E\205\311tTH\211m\330A\203\371\001t*E\017\276\3061\311H\211\352H\211\306H\215\275\320\367\377\377\350\"\004\001", module_name = 0x7fdf93c44b8f <__vasprintf_internal+255> "I\211\004$H\205\300t(H\213\265\330\376\377\377L\211\352H\211\307\350\366\032\371\377H\211\301\353\212\350\254\346\n", has_dynamic_init = 94555029284219, gcc_location = 0x7ffc6138a350, odr_indicator = 140721939585328}, {beg = 2, size = 140598247534528, size_with_redzone = 136612484051984, name = 0x7ffc61389900 "\260\2508a\374\177", module_name = 0x7fdf94808738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", has_dynamic_init = 62, gcc_location = 0x7c3f92957410, odr_indicator = 140598221590736}}, reg_sites = {1631099168, 32764, 2459268128, 31807}, access_size = 81, size = 144 '\220'}, wild = {addr = 137780714669067, access_size = 0}}}}, pc = 140598246564933, bp = 140721939589296, sp = 140721939587160, access_size = 6, bug_descr = 0x7fdf94954797 "heap-use-after-free", is_write = false, shadow_val = 253 '\375'}}}, halt_on_error_ = true}
error = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\374\177\000\000\002\000\000\000bluetoothd[5\000!K\265\211\323\316\"nal] org\200\2368a\374\177\000\0000\2248a\374\177\000\000.l\315\223\337\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\260\2348a\374\177\000\000\211M\304\223\337\177\000\000l\2248a\374\177\000\000l\2248a\374\177\000\000l\2348a\374\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\337\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, addr_description = {data = {kind = __asan::kAddressKindHeap, {shadow = {addr = 137780714669067, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 137780714669067, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1599, free_stack_id = 2755, chunk_access = {bad_addr = 137780714669067, offset = 11, chunk_begin = 137780714669056, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, stack = {addr = 137780714669067, tid = 0, offset = 0, frame_pc = 11832634902079, access_size = 137780714669067, frame_descr = 0xb <error: Cannot access memory at address 0xb>}, global = {addr = 137780714669067, static kMaxGlobals = 4, globals = {{beg = 0, size = 0, size_with_redzone = 11832634902079, name = 0x7d4f928e040b "B", module_name = 0xb <error: Cannot access memory at address 0xb>, has_dynamic_init = 137780714669056, gcc_location = 0x2f0, odr_indicator = 140721939570696}, {beg = 136200148138272, size = 140721939585088, size_with_redzone = 140598245862175, name = 0x1 <error: Cannot access memory at address 0x1>, module_name = 0x7bdf9172b920 "\340t\225\222?|", has_dynamic_init = 140721939587216, gcc_location = 0x7fdf948ec5d2 <___interceptor_malloc(__sanitizer::uptr)+130>, odr_indicator = 140598221590736}, {beg = 130480117920, size = 140721939585136, size_with_redzone = 3, name = 0x7fdf948ec610 <___interceptor_malloc(__sanitizer::uptr)+192> "D\213\215\314\367\377\377E\205\311tTH\211m\330A\203\371\001t*E\017\276\3061\311H\211\352H\211\306H\215\275\320\367\377\377\350\"\004\001", module_name = 0x7fdf93c44b8f <__vasprintf_internal+255> "I\211\004$H\205\300t(H\213\265\330\376\377\377L\211\352H\211\307\350\366\032\371\377H\211\301\353\212\350\254\346\n", has_dynamic_init = 94555029284219, gcc_location = 0x7ffc6138a350, odr_indicator = 140721939585328}, {beg = 2, size = 140598247534528, size_with_redzone = 136612484051984, name = 0x7ffc61389900 "\260\2508a\374\177", module_name = 0x7fdf94808738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", has_dynamic_init = 62, gcc_location = 0x7c3f92957410, odr_indicator = 140598221590736}}, reg_sites = {1631099168, 32764, 2459268128, 31807}, access_size = 81, size = 144 '\220'}, wild = {addr = 137780714669067, access_size = 0}}}}, pc = 140598246564933, bp = 140721939589296, sp = 140721939587160, access_size = 6, bug_descr = 0x7fdf94954797 "heap-use-after-free", is_write = false, shadow_val = 253 '\375'}
#9 0x00007fdf948f8f8d in __asan::ReportGenericError (pc=<optimized out>, bp=bp@entry=140721939589296, sp=sp@entry=140721939587160, addr=addr@entry=137780714669067, is_write=is_write@entry=false, access_size=access_size@entry=6, exp=<optimized out>, fatal=false) at ../../../../src/libsanitizer/asan/asan_report.cpp:536
in_report = <optimized out>
error = <optimized out>
enable_fp = <optimized out>
#10 0x00007fdf948ae468 in MemcmpInterceptorCommon (ctx=ctx@entry=0x7ffc6138a8c0, real_fn=<optimized out>, a1=a1@entry=0x7d4f928e040b, a2=a2@entry=0x7bdf9168afe0, size=size@entry=6) at ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:848
bp = 140721939589296
pc = <optimized out>
local_stack = 137437117284416
sp = 140721939587160
_ctx = 0x7ffc6138a8c0
suppressed = <optimized out>
__offset = 137780714669067
__size = 6
__bad = <optimized out>
result = <optimized out>
#11 0x00007fdf948ae835 in ___interceptor_memcmp (a1=0x7d4f928e040b, a2=0x7bdf9168afe0, size=6) at ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:880
ctx = 0x7ffc6138a8c0
_ctx = {interceptor_name = 0x7fdf949586b6 "memcmp"}
#12 ___interceptor_memcmp (a1=0x7d4f928e040b, a2=0x7bdf9168afe0, size=6) at ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:875
ctx = <optimized out>
_ctx = <optimized out>
#13 0x000055ff4edce048 in bacmp (ba1=0x7d4f928e040b, ba2=0x7bdf9168afe0) at ./lib/bluetooth/bluetooth.h:438
No locals.
#14 device_addr_type_cmp (a=0x7d4f928e0400, b=0x7bdf9168afe0) at src/device.c:5657
dev = 0x7d4f928e0400
addr = 0x7bdf9168afe0
cmp = <optimized out>
#15 0x00007fdf946284c2 in g_slist_find_custom () from /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
No symbol table info available.
#16 0x000055ff4ed4d704 in btd_adapter_find_device (adapter=<optimized out>, dst=dst@entry=0x7c1f92923518, bdaddr_type=1 '\001') at src/adapter.c:1055
addr = <optimized out>
device = <optimized out>
list = <optimized out>
#17 0x000055ff4ecefc17 in att_disconnected (err=<optimized out>, user_data=0x7c1f92923510) at src/gatt-database.c:335
state = 0x7c1f92923510
device = <optimized out>
__func__ = "att_disconnected"
#18 0x000055ff4ed06b44 in btd_gatt_database_att_disconnected (database=<optimized out>, device=<optimized out>) at src/gatt-database.c:4238
server = <optimized out>
att = <optimized out>
state = <optimized out>
addr = <optimized out>
type = <optimized out>
__func__ = "btd_gatt_database_att_disconnected"
#19 0x000055ff4edb00f6 in gatt_server_cleanup (device=device@entry=0x7d4f928e0080) at src/device.c:842
No locals.
#20 0x000055ff4edc47ec in attio_cleanup (device=0x7d4f928e0080) at src/device.c:862
No locals.
#21 0x000055ff4edc4e37 in device_free (user_data=0x7d4f928e0080) at src/device.c:918
device = 0x7d4f928e0080
__func__ = "device_free"
#22 0x000055ff4ee42a4a in remove_interface (data=0x7c4f928eb000, name=name@entry=0x55ff4f04fa80 "org.bluez.Device1") at gdbus/object.c:742
iface = 0x7c3f928fe380
#23 0x000055ff4ee4560c in g_dbus_unregister_interface (connection=<optimized out>, path=<optimized out>, name=<optimized out>) at gdbus/object.c:1499
data = <optimized out>
#24 0x000055ff4ed801c3 in adapter_remove (adapter=adapter@entry=0x7d0f928e0200) at src/adapter.c:7307
l = 0x7bff9290b410 = {0x7d4f928e0080}
db = <optimized out>
ranging_manager = <optimized out>
__func__ = "adapter_remove"
#25 0x000055ff4ed80d58 in adapter_cleanup () at src/adapter.c:11263
adapter = 0x7d0f928e0200
#26 0x000055ff4eb322f0 in main (argc=<optimized out>, argv=<optimized out>) at src/main.c:1723
context = <optimized out>
err = <optimized out>
sdp_mtu = 0
sdp_flags = <optimized out>
gdbus_flags = <optimized out>
__func__ = "main""
FAIL functional.test_bap::test_bap_unicast_set_transport_created[hosts8-vm3-legacy]: failed on teardown with "pytest_bluezenv.plugin.CoredumpWarning: Core dump: test-bluezenv-hosts8.0-bluetoothd-1789779710-72.core
/usr/bin/gdb: warning: Couldn't determine a path for the index cache directory.
[New LWP 72]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/usr/lib/x86_64-linux-gnu/libthread_db.so.1".
Core was generated by `/home/runner/work/bluez/bluez/src/src/src/bluetoothd --nodetach -f /run/bluetoo'.
Program terminated with signal SIGABRT, Aborted.
#0 __pthread_kill_implementation (threadid=<optimized out>, signo=6, no_tid=0) at ./nptl/pthread_kill.c:44
warning: 44 ./nptl/pthread_kill.c: No such file or directory
Thread 1 (Thread 0x7fcc434f2900 (LWP 72)):
#0 __pthread_kill_implementation (threadid=<optimized out>, signo=6, no_tid=0) at ./nptl/pthread_kill.c:44
tid = <optimized out>
ret = 0
pd = <optimized out>
old_mask = {__val = {0}}
ret = <optimized out>
#1 __pthread_kill_internal (threadid=<optimized out>, signo=6) at ./nptl/pthread_kill.c:89
No locals.
#2 __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ./nptl/pthread_kill.c:100
No locals.
#3 0x00007fcc43c4db7e in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
ret = <optimized out>
#4 0x00007fcc43c308ec in __GI_abort () at ./stdlib/abort.c:77
act = {__sigaction_handler = {sa_handler = 0x0, sa_sigaction = 0x0}, sa_mask = {__val = {0 <repeats 16 times>}}, sa_flags = 0, sa_restorer = 0x0}
#5 0x00007fcc44858a0f in __sanitizer::Abort () at ../../../../src/libsanitizer/sanitizer_common/sanitizer_posix_libcdep.cpp:165
No locals.
#6 0x00007fcc4497ec2d in __sanitizer::Die () at ../../../../src/libsanitizer/sanitizer_common/sanitizer_termination.cpp:58
No locals.
#7 0x00007fcc4495393c in __asan::ScopedInErrorReport::~ScopedInErrorReport (this=0x7fff81abf1a6) at ../../../../src/libsanitizer/asan/asan_report.cpp:221
buffer_copy = {buffer_ = {<__sanitizer::InternalMmapVectorNoCtor<char, false>> = {data_ = 0x7fcc43105000 '=' <repeats 65 times>, "\n==72==ERROR: AddressSanitizer: heap-use-after-free on address 0x7d3c429e350b at pc 0x7fcc44908445 bp 0x7fff81ac06a0 sp 0x7fff81abfe48\n"..., capacity_bytes_ = 4096, size_ = 3838}, <No data fields>}}
buffer_copy = <optimized out>
l = <optimized out>
#8 0x00007fcc44952e02 in __asan::ReportGenericError (pc=140515300377669, bp=140735368922784, sp=sp@entry=140735368920648, addr=addr@entry=137697769174283, is_write=is_write@entry=false, access_size=6, fatal=false, exp=<optimized out>) at ../../../../src/libsanitizer/asan/asan_report.cpp:536
in_report = {error_report_lock_ = {<No data fields>}, static current_error_ = {kind = __asan::kErrorKindGeneric, {Base = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\377\177\000\000\002\000\000\000bluetoothd[7\000\356R\375\360t\345\335nal] orgp\374\253\201\377\177\000\000 \362\253\201\377\177\000\000.\f\323C\314\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\240\372\253\201\377\177\000\000\211\355\311C\314\177\000\000\\\362\253\201\377\177\000\000\\\362\253\201\377\177\000\000\\\372\253\201\377\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\314\177\000\000\002\000\000\000bluetoothd[72]: [signal] org.fre"...}, tid = 0}, DeadlySignal = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\377\177\000\000\002\000\000\000bluetoothd[7\000\356R\375\360t\345\335nal] orgp\374\253\201\377\177\000\000 \362\253\201\377\177\000\000.\f\323C\314\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\240\372\253\201\377\177\000\000\211\355\311C\314\177\000\000\\\362\253\201\377\177\000\000\\\362\253\201\377\177\000\000\\\372\253\201\377\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\314\177\000\000\002\000\000\000bluetoothd[72]: [signal] org.fre"...}, tid = 0}, signal = {siginfo = 0xffffffff00000002, context = 0x7d3c429e350b, addr = 0, pc = 0, sp = 11063835756020, bp = 137697769174283, is_memory_access = 11, write_flag = __sanitizer::SignalContext::Unknown, is_true_faulting_addr = false}}, DoubleFree = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\377\177\000\000\002\000\000\000bluetoothd[7\000\356R\375\360t\345\335nal] orgp\374\253\201\377\177\000\000 \362\253\201\377\177\000\000.\f\323C\314\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\240\372\253\201\377\177\000\000\211\355\311C\314\177\000\000\\\362\253\201\377\177\000\000\\\362\253\201\377\177\000\000\\\372\253\201\377\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\314\177\000\000\002\000\000\000bluetoothd[72]: [signal] org.fre"...}, tid = 0}, second_free_stack = 0xffffffff00000002, addr_description = {addr = 137697769174283, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1524, free_stack_id = 2576, chunk_access = {bad_addr = 137697769174283, offset = 11, chunk_begin = 137697769174272, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}}, NewDeleteTypeMismatch = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\377\177\000\000\002\000\000\000bluetoothd[7\000\356R\375\360t\345\335nal] orgp\374\253\201\377\177\000\000 \362\253\201\377\177\000\000.\f\323C\314\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\240\372\253\201\377\177\000\000\211\355\311C\314\177\000\000\\\362\253\201\377\177\000\000\\\362\253\201\377\177\000\000\\\372\253\201\377\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\314\177\000\000\002\000\000\000bluetoothd[72]: [signal] org.fre"...}, tid = 0}, free_stack = 0xffffffff00000002, addr_description = {addr = 137697769174283, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1524, free_stack_id = 2576, chunk_access = {bad_addr = 137697769174283, offset = 11, chunk_begin = 137697769174272, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, delete_size = 136117203174048, delete_alignment = 140735368918576}, FreeNotMalloced = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\377\177\000\000\002\000\000\000bluetoothd[7\000\356R\375\360t\345\335nal] orgp\374\253\201\377\177\000\000 \362\253\201\377\177\000\000.\f\323C\314\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\240\372\253\201\377\177\000\000\211\355\311C\314\177\000\000\\\362\253\201\377\177\000\000\\\362\253\201\377\177\000\000\\\372\253\201\377\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\314\177\000\000\002\000\000\000bluetoothd[72]: [signal] org.fre"...}, tid = 0}, free_stack = 0xffffffff00000002, addr_description = {data = {kind = 1117664523, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11063835756020, alloc_stack_id = 1117664523, free_stack_id = 32060, chunk_access = {bad_addr = 11, offset = 137697769174272, chunk_begin = 752, chunk_size = 140735368880136, user_requested_alignment = 672, access_type = 0, alloc_type = 0}}, stack = {addr = 0, tid = 0, offset = 11063835756020, frame_pc = 137697769174283, access_size = 11, frame_descr = 0x7d3c429e3500 "\020\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11063835756020, size_with_redzone = 137697769174283, name = 0xb <error: Cannot access memory at address 0xb>, module_name = 0x7d3c429e3500 "\020\n", has_dynamic_init = 752, gcc_location = 0x7fff81ab6008, odr_indicator = 136117203174048}, {beg = 140735368918576, size = 140515299674911, size_with_redzone = 1, name = 0x7bcc418b02a0 "`\316\255B,|", module_name = 0x7fff81abfe80 "\220\376\253\201\377\177", has_dynamic_init = 140515300632018, gcc_location = 0x7fcc431370d0, odr_indicator = 131024549520}, {beg = 140735368918624, size = 3, size_with_redzone = 140515300632080, name = 0x7fcc43c9eb8f <__vasprintf_internal+255> "I\211\004$H\205\300t(H\213\265\330\376\377\377L\211\352H\211\307\350\366\032\371\377H\211\301\353\212\350\254\346\n", module_name = 0x561fd08f557b <bt_log_vprintf+171> "\205\300\017\210=\001", has_dynamic_init = 140735368921408, gcc_location = 0x7fff81abf720, odr_indicator = 2}, {beg = 140515301347264, size = 136529539091856, size_with_redzone = 140735368918768, name = 0x7fcc44862738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", module_name = 0x3e <error: Cannot access memory at address 0x3e>, has_dynamic_init = 136529539091856, gcc_location = 0x7fcc431370d0, odr_indicator = 140735368918800}}, reg_sites = {1118686624, 31788, 81, 0}, access_size = 140735368920960, size = 69 'E'}, wild = {addr = 0, access_size = 0}}}}}, AllocTypeMismatch = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\377\177\000\000\002\000\000\000bluetoothd[7\000\356R\375\360t\345\335nal] orgp\374\253\201\377\177\000\000 \362\253\201\377\177\000\000.\f\323C\314\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\240\372\253\201\377\177\000\000\211\355\311C\314\177\000\000\\\362\253\201\377\177\000\000\\\362\253\201\377\177\000\000\\\372\253\201\377\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\314\177\000\000\002\000\000\000bluetoothd[72]: [signal] org.fre"...}, tid = 0}, dealloc_stack = 0xffffffff00000002, alloc_type = 1117664523, dealloc_type = 32060, addr_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 0, kind = (unknown: 0xf4), shadow_byte = 5 '\005'}, heap = {addr = 0, alloc_tid = 11063835756020, free_tid = 137697769174283, alloc_stack_id = 11, free_stack_id = 0, chunk_access = {bad_addr = 137697769174272, offset = 752, chunk_begin = 140735368880136, chunk_size = 136117203174048, user_requested_alignment = 1584, access_type = 3, alloc_type = 3}}, stack = {addr = 0, tid = 11063835756020, offset = 137697769174283, frame_pc = 11, access_size = 137697769174272, frame_descr = 0x2f0 <error: Cannot access memory at address 0x2f0>}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 11063835756020, size = 137697769174283, size_with_redzone = 11, name = 0x7d3c429e3500 "\020\n", module_name = 0x2f0 <error: Cannot access memory at address 0x2f0>, has_dynamic_init = 140735368880136, gcc_location = 0x7bcc418b02a0, odr_indicator = 140735368918576}, {beg = 140515299674911, size = 1, size_with_redzone = 136117203174048, name = 0x7fff81abfe80 "\220\376\253\201\377\177", module_name = 0x7fcc449465d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", has_dynamic_init = 140515275403472, gcc_location = 0x1e81abf690, odr_indicator = 140735368918624}, {beg = 3, size = 140515300632080, size_with_redzone = 140515287362447, name = 0x561fd08f557b <bt_log_vprintf+171> "\205\300\017\210=\001", module_name = 0x7fff81ac0140 "\344\002\254\201\377\177", has_dynamic_init = 140735368918816, gcc_location = 0x2, odr_indicator = 140515301347264}, {beg = 136529539091856, size = 140735368918768, size_with_redzone = 140515299698488, name = 0x3e <error: Cannot access memory at address 0x3e>, module_name = 0x7c2c42adcd90 "\003\021", has_dynamic_init = 140515275403472, gcc_location = 0x7fff81abf710, odr_indicator = 136529539091872}}, reg_sites = {81, 0, 2175532928, 32767}, access_size = 140515300377669, size = 160 '\240'}, wild = {addr = 0, access_size = 11063835756020}}}}}, MallocUsableSizeNotOwned = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\377\177\000\000\002\000\000\000bluetoothd[7\000\356R\375\360t\345\335nal] orgp\374\253\201\377\177\000\000 \362\253\201\377\177\000\000.\f\323C\314\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\240\372\253\201\377\177\000\000\211\355\311C\314\177\000\000\\\362\253\201\377\177\000\000\\\362\253\201\377\177\000\000\\\372\253\201\377\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\314\177\000\000\002\000\000\000bluetoothd[72]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, addr_description = {data = {kind = 1117664523, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11063835756020, alloc_stack_id = 1117664523, free_stack_id = 32060, chunk_access = {bad_addr = 11, offset = 137697769174272, chunk_begin = 752, chunk_size = 140735368880136, user_requested_alignment = 672, access_type = 0, alloc_type = 0}}, stack = {addr = 0, tid = 0, offset = 11063835756020, frame_pc = 137697769174283, access_size = 11, frame_descr = 0x7d3c429e3500 "\020\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11063835756020, size_with_redzone = 137697769174283, name = 0xb <error: Cannot access memory at address 0xb>, module_name = 0x7d3c429e3500 "\020\n", has_dynamic_init = 752, gcc_location = 0x7fff81ab6008, odr_indicator = 136117203174048}, {beg = 140735368918576, size = 140515299674911, size_with_redzone = 1, name = 0x7bcc418b02a0 "`\316\255B,|", module_name = 0x7fff81abfe80 "\220\376\253\201\377\177", has_dynamic_init = 140515300632018, gcc_location = 0x7fcc431370d0, odr_indicator = 131024549520}, {beg = 140735368918624, size = 3, size_with_redzone = 140515300632080, name = 0x7fcc43c9eb8f <__vasprintf_internal+255> "I\211\004$H\205\300t(H\213\265\330\376\377\377L\211\352H\211\307\350\366\032\371\377H\211\301\353\212\350\254\346\n", module_name = 0x561fd08f557b <bt_log_vprintf+171> "\205\300\017\210=\001", has_dynamic_init = 140735368921408, gcc_location = 0x7fff81abf720, odr_indicator = 2}, {beg = 140515301347264, size = 136529539091856, size_with_redzone = 140735368918768, name = 0x7fcc44862738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", module_name = 0x3e <error: Cannot access memory at address 0x3e>, has_dynamic_init = 136529539091856, gcc_location = 0x7fcc431370d0, odr_indicator = 140735368918800}}, reg_sites = {1118686624, 31788, 81, 0}, access_size = 140735368920960, size = 69 'E'}, wild = {addr = 0, access_size = 0}}}}}, SanitizerGetAllocatedSizeNotOwned = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\377\177\000\000\002\000\000\000bluetoothd[7\000\356R\375\360t\345\335nal] orgp\374\253\201\377\177\000\000 \362\253\201\377\177\000\000.\f\323C\314\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\240\372\253\201\377\177\000\000\211\355\311C\314\177\000\000\\\362\253\201\377\177\000\000\\\362\253\201\377\177\000\000\\\372\253\201\377\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\314\177\000\000\002\000\000\000bluetoothd[72]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, addr_description = {data = {kind = 1117664523, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11063835756020, alloc_stack_id = 1117664523, free_stack_id = 32060, chunk_access = {bad_addr = 11, offset = 137697769174272, chunk_begin = 752, chunk_size = 140735368880136, user_requested_alignment = 672, access_type = 0, alloc_type = 0}}, stack = {addr = 0, tid = 0, offset = 11063835756020, frame_pc = 137697769174283, access_size = 11, frame_descr = 0x7d3c429e3500 "\020\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11063835756020, size_with_redzone = 137697769174283, name = 0xb <error: Cannot access memory at address 0xb>, module_name = 0x7d3c429e3500 "\020\n", has_dynamic_init = 752, gcc_location = 0x7fff81ab6008, odr_indicator = 136117203174048}, {beg = 140735368918576, size = 140515299674911, size_with_redzone = 1, name = 0x7bcc418b02a0 "`\316\255B,|", module_name = 0x7fff81abfe80 "\220\376\253\201\377\177", has_dynamic_init = 140515300632018, gcc_location = 0x7fcc431370d0, odr_indicator = 131024549520}, {beg = 140735368918624, size = 3, size_with_redzone = 140515300632080, name = 0x7fcc43c9eb8f <__vasprintf_internal+255> "I\211\004$H\205\300t(H\213\265\330\376\377\377L\211\352H\211\307\350\366\032\371\377H\211\301\353\212\350\254\346\n", module_name = 0x561fd08f557b <bt_log_vprintf+171> "\205\300\017\210=\001", has_dynamic_init = 140735368921408, gcc_location = 0x7fff81abf720, odr_indicator = 2}, {beg = 140515301347264, size = 136529539091856, size_with_redzone = 140735368918768, name = 0x7fcc44862738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", module_name = 0x3e <error: Cannot access memory at address 0x3e>, has_dynamic_init = 136529539091856, gcc_location = 0x7fcc431370d0, odr_indicator = 140735368918800}}, reg_sites = {1118686624, 31788, 81, 0}, access_size = 140735368920960, size = 69 'E'}, wild = {addr = 0, access_size = 0}}}}}, CallocOverflow = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\377\177\000\000\002\000\000\000bluetoothd[7\000\356R\375\360t\345\335nal] orgp\374\253\201\377\177\000\000 \362\253\201\377\177\000\000.\f\323C\314\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\240\372\253\201\377\177\000\000\211\355\311C\314\177\000\000\\\362\253\201\377\177\000\000\\\362\253\201\377\177\000\000\\\372\253\201\377\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\314\177\000\000\002\000\000\000bluetoothd[72]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, count = 137697769174283, size = 0}, ReallocArrayOverflow = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\377\177\000\000\002\000\000\000bluetoothd[7\000\356R\375\360t\345\335nal] orgp\374\253\201\377\177\000\000 \362\253\201\377\177\000\000.\f\323C\314\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\240\372\253\201\377\177\000\000\211\355\311C\314\177\000\000\\\362\253\201\377\177\000\000\\\362\253\201\377\177\000\000\\\372\253\201\377\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\314\177\000\000\002\000\000\000bluetoothd[72]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, count = 137697769174283, size = 0}, PvallocOverflow = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\377\177\000\000\002\000\000\000bluetoothd[7\000\356R\375\360t\345\335nal] orgp\374\253\201\377\177\000\000 \362\253\201\377\177\000\000.\f\323C\314\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\240\372\253\201\377\177\000\000\211\355\311C\314\177\000\000\\\362\253\201\377\177\000\000\\\362\253\201\377\177\000\000\\\372\253\201\377\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\314\177\000\000\002\000\000\000bluetoothd[72]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, size = 137697769174283}, InvalidAllocationAlignment = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\377\177\000\000\002\000\000\000bluetoothd[7\000\356R\375\360t\345\335nal] orgp\374\253\201\377\177\000\000 \362\253\201\377\177\000\000.\f\323C\314\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\240\372\253\201\377\177\000\000\211\355\311C\314\177\000\000\\\362\253\201\377\177\000\000\\\362\253\201\377\177\000\000\\\372\253\201\377\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\314\177\000\000\002\000\000\000bluetoothd[72]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, alignment = 137697769174283}, InvalidAlignedAllocAlignment = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\377\177\000\000\002\000\000\000bluetoothd[7\000\356R\375\360t\345\335nal] orgp\374\253\201\377\177\000\000 \362\253\201\377\177\000\000.\f\323C\314\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\240\372\253\201\377\177\000\000\211\355\311C\314\177\000\000\\\362\253\201\377\177\000\000\\\362\253\201\377\177\000\000\\\372\253\201\377\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\314\177\000\000\002\000\000\000bluetoothd[72]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, size = 137697769174283, alignment = 0}, InvalidPosixMemalignAlignment = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\377\177\000\000\002\000\000\000bluetoothd[7\000\356R\375\360t\345\335nal] orgp\374\253\201\377\177\000\000 \362\253\201\377\177\000\000.\f\323C\314\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\240\372\253\201\377\177\000\000\211\355\311C\314\177\000\000\\\362\253\201\377\177\000\000\\\362\253\201\377\177\000\000\\\372\253\201\377\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\314\177\000\000\002\000\000\000bluetoothd[72]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, alignment = 137697769174283}, AllocationSizeTooBig = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\377\177\000\000\002\000\000\000bluetoothd[7\000\356R\375\360t\345\335nal] orgp\374\253\201\377\177\000\000 \362\253\201\377\177\000\000.\f\323C\314\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\240\372\253\201\377\177\000\000\211\355\311C\314\177\000\000\\\362\253\201\377\177\000\000\\\362\253\201\377\177\000\000\\\372\253\201\377\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\314\177\000\000\002\000\000\000bluetoothd[72]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, user_size = 137697769174283, total_size = 0, max_size = 0}, RssLimitExceeded = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\377\177\000\000\002\000\000\000bluetoothd[7\000\356R\375\360t\345\335nal] orgp\374\253\201\377\177\000\000 \362\253\201\377\177\000\000.\f\323C\314\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\240\372\253\201\377\177\000\000\211\355\311C\314\177\000\000\\\362\253\201\377\177\000\000\\\362\253\201\377\177\000\000\\\372\253\201\377\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\314\177\000\000\002\000\000\000bluetoothd[72]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002}, OutOfMemory = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\377\177\000\000\002\000\000\000bluetoothd[7\000\356R\375\360t\345\335nal] orgp\374\253\201\377\177\000\000 \362\253\201\377\177\000\000.\f\323C\314\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\240\372\253\201\377\177\000\000\211\355\311C\314\177\000\000\\\362\253\201\377\177\000\000\\\362\253\201\377\177\000\000\\\372\253\201\377\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\314\177\000\000\002\000\000\000bluetoothd[72]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, requested_size = 137697769174283}, StringFunctionMemoryRangesOverlap = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\377\177\000\000\002\000\000\000bluetoothd[7\000\356R\375\360t\345\335nal] orgp\374\253\201\377\177\000\000 \362\253\201\377\177\000\000.\f\323C\314\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\240\372\253\201\377\177\000\000\211\355\311C\314\177\000\000\\\362\253\201\377\177\000\000\\\362\253\201\377\177\000\000\\\372\253\201\377\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\314\177\000\000\002\000\000\000bluetoothd[72]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, length1 = 137697769174283, length2 = 0, addr1_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 11063835756020, kind = (__asan::kShadowKindGap | __asan::kShadowKindHigh | unknown: 0x8), shadow_byte = 53 '5'}, heap = {addr = 11063835756020, alloc_tid = 137697769174283, free_tid = 11, alloc_stack_id = 1117664512, free_stack_id = 32060, chunk_access = {bad_addr = 752, offset = 140735368880136, chunk_begin = 136117203174048, chunk_size = 140735368918576, user_requested_alignment = 2847, access_type = 0, alloc_type = 3}}, stack = {addr = 11063835756020, tid = 137697769174283, offset = 11, frame_pc = 137697769174272, access_size = 752, frame_descr = 0x7fff81ab6008 ""}, global = {addr = 11063835756020, static kMaxGlobals = 4, globals = {{beg = 137697769174283, size = 11, size_with_redzone = 137697769174272, name = 0x2f0 <error: Cannot access memory at address 0x2f0>, module_name = 0x7fff81ab6008 "", has_dynamic_init = 136117203174048, gcc_location = 0x7fff81abf630, odr_indicator = 140515299674911}, {beg = 1, size = 136117203174048, size_with_redzone = 140735368920704, name = 0x7fcc449465d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", module_name = 0x7fcc431370d0 "", has_dynamic_init = 131024549520, gcc_location = 0x7fff81abf660, odr_indicator = 3}, {beg = 140515300632080, size = 140515287362447, size_with_redzone = 94694643029371, name = 0x7fff81ac0140 "\344\002\254\201\377\177", module_name = 0x7fff81abf720 "\030", has_dynamic_init = 2, gcc_location = 0x7fcc449f4fc0 <__asan::instance>, odr_indicator = 136529539091856}, {beg = 140735368918768, size = 140515299698488, size_with_redzone = 62, name = 0x7c2c42adcd90 "\003\021", module_name = 0x7fcc431370d0 "", has_dynamic_init = 140735368918800, gcc_location = 0x7c2c42adcda0, odr_indicator = 81}}, reg_sites = {2175532928, 32767, 1150321733, 32716}, access_size = 140735368922784, size = 72 'H'}, wild = {addr = 11063835756020, access_size = 137697769174283}}}}, addr2_description = {data = {kind = 6, {shadow = {addr = 140515301058455, kind = __asan::kShadowKindLow, shadow_byte = 253 '\375'}, heap = {addr = 140515301058455, alloc_tid = 140515301391616, free_tid = 140735368922336, alloc_stack_id = 1150576082, free_stack_id = 32716, chunk_access = {bad_addr = 8315162673665959470, offset = 130735371371, chunk_begin = 140735368920256, chunk_size = 3, user_requested_alignment = 1552, access_type = 2, alloc_type = 1}}, stack = {addr = 140515301058455, tid = 140515301391616, offset = 140735368922336, frame_pc = 140515300632018, access_size = 8315162673665959470, frame_descr = 0x1e706f746b <error: Cannot access memory at address 0x1e706f746b>}, global = {addr = 140515301058455, static kMaxGlobals = 4, globals = {{beg = 140515301391616, size = 140735368922336, size_with_redzone = 140515300632018, name = 0x736564656572662e <error: Cannot access memory at address 0x736564656572662e>, module_name = 0x1e706f746b <error: Cannot access memory at address 0x1e706f746b>, has_dynamic_init = 140735368920256, gcc_location = 0x3, odr_indicator = 140515300632080}, {beg = 140515287362447, size = 94694643029371, size_with_redzone = 140735368923040, name = 0x7fff81abfd40 "`\375\253\201\377\177", module_name = 0x7fcc449eef78 "\001", has_dynamic_init = 140735368920448, gcc_location = 0x561fd0a365c0, odr_indicator = 140515279317176}, {beg = 65535, size = 140735368920368, size_with_redzone = 140515300463449, name = 0x40 <error: Cannot access memory at address 0x40>, module_name = 0x7bcc41aadc00 "\0166\340E", has_dynamic_init = 140735368920416, gcc_location = 0x7fcc4486974a <__asan_stack_malloc_0(__sanitizer::uptr)+234>, odr_indicator = 140735368920416}, {beg = 140515300888445, size = 140735368920448, size_with_redzone = 140515300732262, name = 0x7fff81abfe00 "", module_name = 0x2 <error: Cannot access memory at address 0x2>, has_dynamic_init = 140515301347264, gcc_location = 0x7c0c42aa2e40, odr_indicator = 140735368920528}}, reg_sites = {1149642552, 32716, 40, 0}, access_size = 140515300837917, size = 208 '\320'}, wild = {addr = 140515301058455, access_size = 140515301391616}}}}, function = 0x7fff81abfdf0 "\240\006\254\201\377\177"}, StringFunctionSizeOverflow = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\377\177\000\000\002\000\000\000bluetoothd[7\000\356R\375\360t\345\335nal] orgp\374\253\201\377\177\000\000 \362\253\201\377\177\000\000.\f\323C\314\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\240\372\253\201\377\177\000\000\211\355\311C\314\177\000\000\\\362\253\201\377\177\000\000\\\362\253\201\377\177\000\000\\\372\253\201\377\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\314\177\000\000\002\000\000\000bluetoothd[72]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, addr_description = {data = {kind = 1117664523, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11063835756020, alloc_stack_id = 1117664523, free_stack_id = 32060, chunk_access = {bad_addr = 11, offset = 137697769174272, chunk_begin = 752, chunk_size = 140735368880136, user_requested_alignment = 672, access_type = 0, alloc_type = 0}}, stack = {addr = 0, tid = 0, offset = 11063835756020, frame_pc = 137697769174283, access_size = 11, frame_descr = 0x7d3c429e3500 "\020\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11063835756020, size_with_redzone = 137697769174283, name = 0xb <error: Cannot access memory at address 0xb>, module_name = 0x7d3c429e3500 "\020\n", has_dynamic_init = 752, gcc_location = 0x7fff81ab6008, odr_indicator = 136117203174048}, {beg = 140735368918576, size = 140515299674911, size_with_redzone = 1, name = 0x7bcc418b02a0 "`\316\255B,|", module_name = 0x7fff81abfe80 "\220\376\253\201\377\177", has_dynamic_init = 140515300632018, gcc_location = 0x7fcc431370d0, odr_indicator = 131024549520}, {beg = 140735368918624, size = 3, size_with_redzone = 140515300632080, name = 0x7fcc43c9eb8f <__vasprintf_internal+255> "I\211\004$H\205\300t(H\213\265\330\376\377\377L\211\352H\211\307\350\366\032\371\377H\211\301\353\212\350\254\346\n", module_name = 0x561fd08f557b <bt_log_vprintf+171> "\205\300\017\210=\001", has_dynamic_init = 140735368921408, gcc_location = 0x7fff81abf720, odr_indicator = 2}, {beg = 140515301347264, size = 136529539091856, size_with_redzone = 140735368918768, name = 0x7fcc44862738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", module_name = 0x3e <error: Cannot access memory at address 0x3e>, has_dynamic_init = 136529539091856, gcc_location = 0x7fcc431370d0, odr_indicator = 140735368918800}}, reg_sites = {1118686624, 31788, 81, 0}, access_size = 140735368920960, size = 69 'E'}, wild = {addr = 0, access_size = 0}}}}, size = 140735368922784}, BadParamsToAnnotateContiguousContainer = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\377\177\000\000\002\000\000\000bluetoothd[7\000\356R\375\360t\345\335nal] orgp\374\253\201\377\177\000\000 \362\253\201\377\177\000\000.\f\323C\314\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\240\372\253\201\377\177\000\000\211\355\311C\314\177\000\000\\\362\253\201\377\177\000\000\\\362\253\201\377\177\000\000\\\372\253\201\377\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\314\177\000\000\002\000\000\000bluetoothd[72]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, beg = 137697769174283, end = 0, old_mid = 0, new_mid = 11063835756020}, BadParamsToAnnotateDoubleEndedContiguousContainer = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\377\177\000\000\002\000\000\000bluetoothd[7\000\356R\375\360t\345\335nal] orgp\374\253\201\377\177\000\000 \362\253\201\377\177\000\000.\f\323C\314\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\240\372\253\201\377\177\000\000\211\355\311C\314\177\000\000\\\362\253\201\377\177\000\000\\\362\253\201\377\177\000\000\\\372\253\201\377\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\314\177\000\000\002\000\000\000bluetoothd[72]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, storage_beg = 137697769174283, storage_end = 0, old_container_beg = 0, old_container_end = 11063835756020, new_container_beg = 137697769174283, new_container_end = 11}, BadParamsToCopyContiguousContainerAnnotations = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\377\177\000\000\002\000\000\000bluetoothd[7\000\356R\375\360t\345\335nal] orgp\374\253\201\377\177\000\000 \362\253\201\377\177\000\000.\f\323C\314\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\240\372\253\201\377\177\000\000\211\355\311C\314\177\000\000\\\362\253\201\377\177\000\000\\\362\253\201\377\177\000\000\\\372\253\201\377\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\314\177\000\000\002\000\000\000bluetoothd[72]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, old_storage_beg = 137697769174283, old_storage_end = 0, new_storage_beg = 0, new_storage_end = 11063835756020}, ODRViolation = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\377\177\000\000\002\000\000\000bluetoothd[7\000\356R\375\360t\345\335nal] orgp\374\253\201\377\177\000\000 \362\253\201\377\177\000\000.\f\323C\314\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\240\372\253\201\377\177\000\000\211\355\311C\314\177\000\000\\\362\253\201\377\177\000\000\\\362\253\201\377\177\000\000\\\372\253\201\377\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\314\177\000\000\002\000\000\000bluetoothd[72]: [signal] org.fre"...}, tid = 0}, global1 = {beg = 18446744069414584322, size = 137697769174283, size_with_redzone = 0, name = 0x0, module_name = 0xa10000005f4 <error: Cannot access memory at address 0xa10000005f4>, has_dynamic_init = 137697769174283, gcc_location = 0xb, odr_indicator = 137697769174272}, global2 = {beg = 752, size = 140735368880136, size_with_redzone = 136117203174048, name = 0x7fff81abf630 "\200\376\253\201\377\177", module_name = 0x7fcc4485cb1f <__asan::asan_malloc(unsigned long, __sanitizer::BufferedStackTrace*)+47> "H\205\300t\f\311\303f.\017\037\204", has_dynamic_init = 1, gcc_location = 0x7bcc418b02a0, odr_indicator = 140735368920704}, stack_id1 = 1150576082, stack_id2 = 32716}, InvalidPointerPair = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\377\177\000\000\002\000\000\000bluetoothd[7\000\356R\375\360t\345\335nal] orgp\374\253\201\377\177\000\000 \362\253\201\377\177\000\000.\f\323C\314\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\240\372\253\201\377\177\000\000\211\355\311C\314\177\000\000\\\362\253\201\377\177\000\000\\\362\253\201\377\177\000\000\\\372\253\201\377\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\314\177\000\000\002\000\000\000bluetoothd[72]: [signal] org.fre"...}, tid = 0}, pc = 18446744069414584322, bp = 137697769174283, sp = 0, addr1_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 11063835756020, kind = (__asan::kShadowKindGap | __asan::kShadowKindHigh | unknown: 0x8), shadow_byte = 53 '5'}, heap = {addr = 11063835756020, alloc_tid = 137697769174283, free_tid = 11, alloc_stack_id = 1117664512, free_stack_id = 32060, chunk_access = {bad_addr = 752, offset = 140735368880136, chunk_begin = 136117203174048, chunk_size = 140735368918576, user_requested_alignment = 2847, access_type = 0, alloc_type = 3}}, stack = {addr = 11063835756020, tid = 137697769174283, offset = 11, frame_pc = 137697769174272, access_size = 752, frame_descr = 0x7fff81ab6008 ""}, global = {addr = 11063835756020, static kMaxGlobals = 4, globals = {{beg = 137697769174283, size = 11, size_with_redzone = 137697769174272, name = 0x2f0 <error: Cannot access memory at address 0x2f0>, module_name = 0x7fff81ab6008 "", has_dynamic_init = 136117203174048, gcc_location = 0x7fff81abf630, odr_indicator = 140515299674911}, {beg = 1, size = 136117203174048, size_with_redzone = 140735368920704, name = 0x7fcc449465d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", module_name = 0x7fcc431370d0 "", has_dynamic_init = 131024549520, gcc_location = 0x7fff81abf660, odr_indicator = 3}, {beg = 140515300632080, size = 140515287362447, size_with_redzone = 94694643029371, name = 0x7fff81ac0140 "\344\002\254\201\377\177", module_name = 0x7fff81abf720 "\030", has_dynamic_init = 2, gcc_location = 0x7fcc449f4fc0 <__asan::instance>, odr_indicator = 136529539091856}, {beg = 140735368918768, size = 140515299698488, size_with_redzone = 62, name = 0x7c2c42adcd90 "\003\021", module_name = 0x7fcc431370d0 "", has_dynamic_init = 140735368918800, gcc_location = 0x7c2c42adcda0, odr_indicator = 81}}, reg_sites = {2175532928, 32767, 1150321733, 32716}, access_size = 140735368922784, size = 72 'H'}, wild = {addr = 11063835756020, access_size = 137697769174283}}}}, addr2_description = {data = {kind = 6, {shadow = {addr = 140515301058455, kind = __asan::kShadowKindLow, shadow_byte = 253 '\375'}, heap = {addr = 140515301058455, alloc_tid = 140515301391616, free_tid = 140735368922336, alloc_stack_id = 1150576082, free_stack_id = 32716, chunk_access = {bad_addr = 8315162673665959470, offset = 130735371371, chunk_begin = 140735368920256, chunk_size = 3, user_requested_alignment = 1552, access_type = 2, alloc_type = 1}}, stack = {addr = 140515301058455, tid = 140515301391616, offset = 140735368922336, frame_pc = 140515300632018, access_size = 8315162673665959470, frame_descr = 0x1e706f746b <error: Cannot access memory at address 0x1e706f746b>}, global = {addr = 140515301058455, static kMaxGlobals = 4, globals = {{beg = 140515301391616, size = 140735368922336, size_with_redzone = 140515300632018, name = 0x736564656572662e <error: Cannot access memory at address 0x736564656572662e>, module_name = 0x1e706f746b <error: Cannot access memory at address 0x1e706f746b>, has_dynamic_init = 140735368920256, gcc_location = 0x3, odr_indicator = 140515300632080}, {beg = 140515287362447, size = 94694643029371, size_with_redzone = 140735368923040, name = 0x7fff81abfd40 "`\375\253\201\377\177", module_name = 0x7fcc449eef78 "\001", has_dynamic_init = 140735368920448, gcc_location = 0x561fd0a365c0, odr_indicator = 140515279317176}, {beg = 65535, size = 140735368920368, size_with_redzone = 140515300463449, name = 0x40 <error: Cannot access memory at address 0x40>, module_name = 0x7bcc41aadc00 "\0166\340E", has_dynamic_init = 140735368920416, gcc_location = 0x7fcc4486974a <__asan_stack_malloc_0(__sanitizer::uptr)+234>, odr_indicator = 140735368920416}, {beg = 140515300888445, size = 140735368920448, size_with_redzone = 140515300732262, name = 0x7fff81abfe00 "", module_name = 0x2 <error: Cannot access memory at address 0x2>, has_dynamic_init = 140515301347264, gcc_location = 0x7c0c42aa2e40, odr_indicator = 140735368920528}}, reg_sites = {1149642552, 32716, 40, 0}, access_size = 140515300837917, size = 208 '\320'}, wild = {addr = 140515301058455, access_size = 140515301391616}}}}}, Generic = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\377\177\000\000\002\000\000\000bluetoothd[7\000\356R\375\360t\345\335nal] orgp\374\253\201\377\177\000\000 \362\253\201\377\177\000\000.\f\323C\314\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\240\372\253\201\377\177\000\000\211\355\311C\314\177\000\000\\\362\253\201\377\177\000\000\\\362\253\201\377\177\000\000\\\372\253\201\377\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\314\177\000\000\002\000\000\000bluetoothd[72]: [signal] org.fre"...}, tid = 0}, addr_description = {data = {kind = __asan::kAddressKindHeap, {shadow = {addr = 137697769174283, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 137697769174283, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1524, free_stack_id = 2576, chunk_access = {bad_addr = 137697769174283, offset = 11, chunk_begin = 137697769174272, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, stack = {addr = 137697769174283, tid = 0, offset = 0, frame_pc = 11063835756020, access_size = 137697769174283, frame_descr = 0xb <error: Cannot access memory at address 0xb>}, global = {addr = 137697769174283, static kMaxGlobals = 4, globals = {{beg = 0, size = 0, size_with_redzone = 11063835756020, name = 0x7d3c429e350b "B", module_name = 0xb <error: Cannot access memory at address 0xb>, has_dynamic_init = 137697769174272, gcc_location = 0x2f0, odr_indicator = 140735368880136}, {beg = 136117203174048, size = 140735368918576, size_with_redzone = 140515299674911, name = 0x1 <error: Cannot access memory at address 0x1>, module_name = 0x7bcc418b02a0 "`\316\255B,|", has_dynamic_init = 140735368920704, gcc_location = 0x7fcc449465d2 <___interceptor_malloc(__sanitizer::uptr)+130>, odr_indicator = 140515275403472}, {beg = 131024549520, size = 140735368918624, size_with_redzone = 3, name = 0x7fcc44946610 <___interceptor_malloc(__sanitizer::uptr)+192> "D\213\215\314\367\377\377E\205\311tTH\211m\330A\203\371\001t*E\017\276\3061\311H\211\352H\211\306H\215\275\320\367\377\377\350\"\004\001", module_name = 0x7fcc43c9eb8f <__vasprintf_internal+255> "I\211\004$H\205\300t(H\213\265\330\376\377\377L\211\352H\211\307\350\366\032\371\377H\211\301\353\212\350\254\346\n", has_dynamic_init = 94694643029371, gcc_location = 0x7fff81ac0140, odr_indicator = 140735368918816}, {beg = 2, size = 140515301347264, size_with_redzone = 136529539091856, name = 0x7fff81abf6f0 "\240\006\254\201\377\177", module_name = 0x7fcc44862738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", has_dynamic_init = 62, gcc_location = 0x7c2c42adcd90, odr_indicator = 140515275403472}}, reg_sites = {2175530768, 32767, 1118686624, 31788}, access_size = 81, size = 128 '\200'}, wild = {addr = 137697769174283, access_size = 0}}}}, pc = 140515300377669, bp = 140735368922784, sp = 140735368920648, access_size = 6, bug_descr = 0x7fcc449ae797 "heap-use-after-free", is_write = false, shadow_val = 253 '\375'}}}, halt_on_error_ = true}
error = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\377\177\000\000\002\000\000\000bluetoothd[7\000\356R\375\360t\345\335nal] orgp\374\253\201\377\177\000\000 \362\253\201\377\177\000\000.\f\323C\314\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\240\372\253\201\377\177\000\000\211\355\311C\314\177\000\000\\\362\253\201\377\177\000\000\\\362\253\201\377\177\000\000\\\372\253\201\377\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\314\177\000\000\002\000\000\000bluetoothd[72]: [signal] org.fre"...}, tid = 0}, addr_description = {data = {kind = __asan::kAddressKindHeap, {shadow = {addr = 137697769174283, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 137697769174283, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1524, free_stack_id = 2576, chunk_access = {bad_addr = 137697769174283, offset = 11, chunk_begin = 137697769174272, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, stack = {addr = 137697769174283, tid = 0, offset = 0, frame_pc = 11063835756020, access_size = 137697769174283, frame_descr = 0xb <error: Cannot access memory at address 0xb>}, global = {addr = 137697769174283, static kMaxGlobals = 4, globals = {{beg = 0, size = 0, size_with_redzone = 11063835756020, name = 0x7d3c429e350b "B", module_name = 0xb <error: Cannot access memory at address 0xb>, has_dynamic_init = 137697769174272, gcc_location = 0x2f0, odr_indicator = 140735368880136}, {beg = 136117203174048, size = 140735368918576, size_with_redzone = 140515299674911, name = 0x1 <error: Cannot access memory at address 0x1>, module_name = 0x7bcc418b02a0 "`\316\255B,|", has_dynamic_init = 140735368920704, gcc_location = 0x7fcc449465d2 <___interceptor_malloc(__sanitizer::uptr)+130>, odr_indicator = 140515275403472}, {beg = 131024549520, size = 140735368918624, size_with_redzone = 3, name = 0x7fcc44946610 <___interceptor_malloc(__sanitizer::uptr)+192> "D\213\215\314\367\377\377E\205\311tTH\211m\330A\203\371\001t*E\017\276\3061\311H\211\352H\211\306H\215\275\320\367\377\377\350\"\004\001", module_name = 0x7fcc43c9eb8f <__vasprintf_internal+255> "I\211\004$H\205\300t(H\213\265\330\376\377\377L\211\352H\211\307\350\366\032\371\377H\211\301\353\212\350\254\346\n", has_dynamic_init = 94694643029371, gcc_location = 0x7fff81ac0140, odr_indicator = 140735368918816}, {beg = 2, size = 140515301347264, size_with_redzone = 136529539091856, name = 0x7fff81abf6f0 "\240\006\254\201\377\177", module_name = 0x7fcc44862738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", has_dynamic_init = 62, gcc_location = 0x7c2c42adcd90, odr_indicator = 140515275403472}}, reg_sites = {2175530768, 32767, 1118686624, 31788}, access_size = 81, size = 128 '\200'}, wild = {addr = 137697769174283, access_size = 0}}}}, pc = 140515300377669, bp = 140735368922784, sp = 140735368920648, access_size = 6, bug_descr = 0x7fcc449ae797 "heap-use-after-free", is_write = false, shadow_val = 253 '\375'}
#9 0x00007fcc44952f8d in __asan::ReportGenericError (pc=<optimized out>, bp=bp@entry=140735368922784, sp=sp@entry=140735368920648, addr=addr@entry=137697769174283, is_write=is_write@entry=false, access_size=access_size@entry=6, exp=<optimized out>, fatal=false) at ../../../../src/libsanitizer/asan/asan_report.cpp:536
in_report = <optimized out>
error = <optimized out>
enable_fp = <optimized out>
#10 0x00007fcc44908468 in MemcmpInterceptorCommon (ctx=ctx@entry=0x7fff81ac06b0, real_fn=<optimized out>, a1=a1@entry=0x7d3c429e350b, a2=a2@entry=0x7bcc417402a0, size=size@entry=6) at ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:848
bp = 140735368922784
pc = <optimized out>
local_stack = 137354171777088
sp = 140735368920648
_ctx = 0x7fff81ac06b0
suppressed = <optimized out>
__offset = 137697769174283
__size = 6
__bad = <optimized out>
result = <optimized out>
#11 0x00007fcc44908835 in ___interceptor_memcmp (a1=0x7d3c429e350b, a2=0x7bcc417402a0, size=6) at ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:880
ctx = 0x7fff81ac06b0
_ctx = {interceptor_name = 0x7fcc449b26b6 "memcmp"}
#12 ___interceptor_memcmp (a1=0x7d3c429e350b, a2=0x7bcc417402a0, size=6) at ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:875
ctx = <optimized out>
_ctx = <optimized out>
#13 0x0000561fd07d9048 in bacmp (ba1=0x7d3c429e350b, ba2=0x7bcc417402a0) at ./lib/bluetooth/bluetooth.h:438
No locals.
#14 device_addr_type_cmp (a=0x7d3c429e3500, b=0x7bcc417402a0) at src/device.c:5657
dev = 0x7d3c429e3500
addr = 0x7bcc417402a0
cmp = <optimized out>
#15 0x00007fcc446824c2 in g_slist_find_custom () from /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
No symbol table info available.
#16 0x0000561fd0758704 in btd_adapter_find_device (adapter=<optimized out>, dst=dst@entry=0x7c0c42a65a98, bdaddr_type=1 '\001') at src/adapter.c:1055
addr = <optimized out>
device = <optimized out>
list = <optimized out>
#17 0x0000561fd06fac17 in att_disconnected (err=<optimized out>, user_data=0x7c0c42a65a90) at src/gatt-database.c:335
state = 0x7c0c42a65a90
device = <optimized out>
__func__ = "att_disconnected"
#18 0x0000561fd0711b44 in btd_gatt_database_att_disconnected (database=<optimized out>, device=<optimized out>) at src/gatt-database.c:4238
server = <optimized out>
att = <optimized out>
state = <optimized out>
addr = <optimized out>
type = <optimized out>
__func__ = "btd_gatt_database_att_disconnected"
#19 0x0000561fd07bb0f6 in gatt_server_cleanup (device=device@entry=0x7d3c429e3180) at src/device.c:842
No locals.
#20 0x0000561fd07cf7ec in attio_cleanup (device=0x7d3c429e3180) at src/device.c:862
No locals.
#21 0x0000561fd07cfe37 in device_free (user_data=0x7d3c429e3180) at src/device.c:918
device = 0x7d3c429e3180
__func__ = "device_free"
#22 0x0000561fd084da4a in remove_interface (data=0x7c3c42a171b0, name=name@entry=0x561fd0a5aa80 "org.bluez.Device1") at gdbus/object.c:742
iface = 0x7c2c42a86c40
#23 0x0000561fd085060c in g_dbus_unregister_interface (connection=<optimized out>, path=<optimized out>, name=<optimized out>) at gdbus/object.c:1499
data = <optimized out>
#24 0x0000561fd078b1c3 in adapter_remove (adapter=adapter@entry=0x7cfc429e0200) at src/adapter.c:7307
l = 0x7bec42b240b0 = {0x7d3c429e3180}
db = <optimized out>
ranging_manager = <optimized out>
__func__ = "adapter_remove"
#25 0x0000561fd078bd58 in adapter_cleanup () at src/adapter.c:11263
adapter = 0x7cfc429e0200
#26 0x0000561fd053d2f0 in main (argc=<optimized out>, argv=<optimized out>) at src/main.c:1723
context = <optimized out>
err = <optimized out>
sdp_mtu = 0
sdp_flags = <optimized out>
gdbus_flags = <optimized out>
__func__ = "main""
FAIL functional.test_bap::test_bap_unicast_set_transport_acquire[hosts8-vm3]: failed on teardown with "pytest_bluezenv.plugin.CoredumpWarning: Core dump: test-bluezenv-hosts8.0-bluetoothd-1789779730-91.core
/usr/bin/gdb: warning: Couldn't determine a path for the index cache directory.
[New LWP 91]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/usr/lib/x86_64-linux-gnu/libthread_db.so.1".
Core was generated by `/home/runner/work/bluez/bluez/src/src/src/bluetoothd --nodetach -f /run/bluetoo'.
Program terminated with signal SIGABRT, Aborted.
#0 __pthread_kill_implementation (threadid=<optimized out>, signo=6, no_tid=0) at ./nptl/pthread_kill.c:44
warning: 44 ./nptl/pthread_kill.c: No such file or directory
Thread 1 (Thread 0x7f42107b8900 (LWP 91)):
#0 __pthread_kill_implementation (threadid=<optimized out>, signo=6, no_tid=0) at ./nptl/pthread_kill.c:44
tid = <optimized out>
ret = 0
pd = <optimized out>
old_mask = {__val = {0}}
ret = <optimized out>
#1 __pthread_kill_internal (threadid=<optimized out>, signo=6) at ./nptl/pthread_kill.c:89
No locals.
#2 __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ./nptl/pthread_kill.c:100
No locals.
#3 0x00007f4210f13b7e in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
ret = <optimized out>
#4 0x00007f4210ef68ec in __GI_abort () at ./stdlib/abort.c:77
act = {__sigaction_handler = {sa_handler = 0x0, sa_sigaction = 0x0}, sa_mask = {__val = {0 <repeats 16 times>}}, sa_flags = 0, sa_restorer = 0x0}
#5 0x00007f4211b1ea0f in __sanitizer::Abort () at ../../../../src/libsanitizer/sanitizer_common/sanitizer_posix_libcdep.cpp:165
No locals.
#6 0x00007f4211c44c2d in __sanitizer::Die () at ../../../../src/libsanitizer/sanitizer_common/sanitizer_termination.cpp:58
No locals.
#7 0x00007f4211c1993c in __asan::ScopedInErrorReport::~ScopedInErrorReport (this=0x7ffede5549c6) at ../../../../src/libsanitizer/asan/asan_report.cpp:221
buffer_copy = {buffer_ = {<__sanitizer::InternalMmapVectorNoCtor<char, false>> = {data_ = 0x7f4210400000 '=' <repeats 65 times>, "\n==91==ERROR: AddressSanitizer: heap-use-after-free on address 0x7cb20fce318b at pc 0x7f4211bce445 bp 0x7ffede555ec0 sp 0x7ffede555668\n"..., capacity_bytes_ = 4096, size_ = 3838}, <No data fields>}}
buffer_copy = <optimized out>
l = <optimized out>
#8 0x00007f4211c18e02 in __asan::ReportGenericError (pc=139921742160965, bp=140732628557504, sp=sp@entry=140732628555368, addr=addr@entry=137104211194251, is_write=is_write@entry=false, access_size=6, fatal=false, exp=<optimized out>) at ../../../../src/libsanitizer/asan/asan_report.cpp:536
in_report = {error_report_lock_ = {<No data fields>}, static current_error_ = {kind = __asan::kErrorKindGeneric, {Base = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[9\000/El\b\351\205\362nal] org\220TU\336\376\177\000\000@JU\336\376\177\000\000.l\377\020B\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\300RU\336\376\177\000\000\211M\366\020B\177\000\000|JU\336\376\177\000\000|JU\336\376\177\000\000|RU\336\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000B\177\000\000\002\000\000\000bluetoothd[91]: [signal] org.fre"...}, tid = 0}, DeadlySignal = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[9\000/El\b\351\205\362nal] org\220TU\336\376\177\000\000@JU\336\376\177\000\000.l\377\020B\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\300RU\336\376\177\000\000\211M\366\020B\177\000\000|JU\336\376\177\000\000|JU\336\376\177\000\000|RU\336\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000B\177\000\000\002\000\000\000bluetoothd[91]: [signal] org.fre"...}, tid = 0}, signal = {siginfo = 0xffffffff00000002, context = 0x7cb20fce318b, addr = 0, pc = 0, sp = 11072425690612, bp = 137104211194251, is_memory_access = 11, write_flag = __sanitizer::SignalContext::Unknown, is_true_faulting_addr = 128}}, DoubleFree = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[9\000/El\b\351\205\362nal] org\220TU\336\376\177\000\000@JU\336\376\177\000\000.l\377\020B\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\300RU\336\376\177\000\000\211M\366\020B\177\000\000|JU\336\376\177\000\000|JU\336\376\177\000\000|RU\336\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000B\177\000\000\002\000\000\000bluetoothd[91]: [signal] org.fre"...}, tid = 0}, second_free_stack = 0xffffffff00000002, addr_description = {addr = 137104211194251, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1524, free_stack_id = 2578, chunk_access = {bad_addr = 137104211194251, offset = 11, chunk_begin = 137104211194240, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}}, NewDeleteTypeMismatch = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[9\000/El\b\351\205\362nal] org\220TU\336\376\177\000\000@JU\336\376\177\000\000.l\377\020B\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\300RU\336\376\177\000\000\211M\366\020B\177\000\000|JU\336\376\177\000\000|JU\336\376\177\000\000|RU\336\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000B\177\000\000\002\000\000\000bluetoothd[91]: [signal] org.fre"...}, tid = 0}, free_stack = 0xffffffff00000002, addr_description = {addr = 137104211194251, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1524, free_stack_id = 2578, chunk_access = {bad_addr = 137104211194251, offset = 11, chunk_begin = 137104211194240, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, delete_size = 135523645228448, delete_alignment = 140732628553296}, FreeNotMalloced = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[9\000/El\b\351\205\362nal] org\220TU\336\376\177\000\000@JU\336\376\177\000\000.l\377\020B\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\300RU\336\376\177\000\000\211M\366\020B\177\000\000|JU\336\376\177\000\000|JU\336\376\177\000\000|RU\336\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000B\177\000\000\002\000\000\000bluetoothd[91]: [signal] org.fre"...}, tid = 0}, free_stack = 0xffffffff00000002, addr_description = {data = {kind = 265171339, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11072425690612, alloc_stack_id = 265171339, free_stack_id = 31922, chunk_access = {bad_addr = 11, offset = 137104211194240, chunk_begin = 752, chunk_size = 140732628557832, user_requested_alignment = 1440, access_type = 0, alloc_type = 2}}, stack = {addr = 0, tid = 0, offset = 11072425690612, frame_pc = 137104211194251, access_size = 11, frame_descr = 0x7cb20fce3180 "\022\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11072425690612, size_with_redzone = 137104211194251, name = 0xb <error: Cannot access memory at address 0xb>, module_name = 0x7cb20fce3180 "\022\n", has_dynamic_init = 752, gcc_location = 0x7ffede556008, odr_indicator = 135523645228448}, {beg = 140732628553296, size = 139921741458207, size_with_redzone = 1, name = 0x7b420ebb85a0 "\200\314\335\017\242{", module_name = 0x7ffede5556a0 "\260VU\336\376\177", has_dynamic_init = 139921742415314, gcc_location = 0x7f42102f20d0, odr_indicator = 132579151536}, {beg = 140732628553344, size = 3, size_with_redzone = 139921742415376, name = 0x7f4210f64b8f <__vasprintf_internal+255> "I\211\004$H\205\300t(H\213\265\330\376\377\377L\211\352H\211\307\350\366\032\371\377H\211\301\353\212\350\254\346\n", module_name = 0x558862e0357b <bt_log_vprintf+171> "\205\300\017\210=\001", has_dynamic_init = 140732628556128, gcc_location = 0x7ffede554f40, odr_indicator = 2}, {beg = 139921743130560, size = 135935981112240, size_with_redzone = 140732628553488, name = 0x7f4211b28738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", module_name = 0x3e <error: Cannot access memory at address 0x3e>, has_dynamic_init = 135935981112240, gcc_location = 0x7f42102f20d0, odr_indicator = 140732628553520}}, reg_sites = {266193856, 31650, 81, 0}, access_size = 140732628555680, size = 69 'E'}, wild = {addr = 0, access_size = 0}}}}}, AllocTypeMismatch = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[9\000/El\b\351\205\362nal] org\220TU\336\376\177\000\000@JU\336\376\177\000\000.l\377\020B\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\300RU\336\376\177\000\000\211M\366\020B\177\000\000|JU\336\376\177\000\000|JU\336\376\177\000\000|RU\336\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000B\177\000\000\002\000\000\000bluetoothd[91]: [signal] org.fre"...}, tid = 0}, dealloc_stack = 0xffffffff00000002, alloc_type = 265171339, dealloc_type = 31922, addr_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 0, kind = (unknown: 0xf4), shadow_byte = 5 '\005'}, heap = {addr = 0, alloc_tid = 11072425690612, free_tid = 137104211194251, alloc_stack_id = 11, free_stack_id = 0, chunk_access = {bad_addr = 137104211194240, offset = 752, chunk_begin = 140732628557832, chunk_size = 135523645228448, user_requested_alignment = 3664, access_type = 0, alloc_type = 1}}, stack = {addr = 0, tid = 11072425690612, offset = 137104211194251, frame_pc = 11, access_size = 137104211194240, frame_descr = 0x2f0 <error: Cannot access memory at address 0x2f0>}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 11072425690612, size = 137104211194251, size_with_redzone = 11, name = 0x7cb20fce3180 "\022\n", module_name = 0x2f0 <error: Cannot access memory at address 0x2f0>, has_dynamic_init = 140732628557832, gcc_location = 0x7b420ebb85a0, odr_indicator = 140732628553296}, {beg = 139921741458207, size = 1, size_with_redzone = 135523645228448, name = 0x7ffede5556a0 "\260VU\336\376\177", module_name = 0x7f4211c0c5d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", has_dynamic_init = 139921716093136, gcc_location = 0x1ede554eb0, odr_indicator = 140732628553344}, {beg = 3, size = 139921742415376, size_with_redzone = 139921729145743, name = 0x558862e0357b <bt_log_vprintf+171> "\205\300\017\210=\001", module_name = 0x7ffede555960 "\004[U\336\376\177", has_dynamic_init = 140732628553536, gcc_location = 0x2, odr_indicator = 139921743130560}, {beg = 135935981112240, size = 140732628553488, size_with_redzone = 139921741481784, name = 0x3e <error: Cannot access memory at address 0x3e>, module_name = 0x7ba20fddcbb0 "\003\021", has_dynamic_init = 139921716093136, gcc_location = 0x7ffede554f30, odr_indicator = 135935981112256}}, reg_sites = {81, 0, 3730134944, 32766}, access_size = 139921742160965, size = 192 '\300'}, wild = {addr = 0, access_size = 11072425690612}}}}}, MallocUsableSizeNotOwned = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[9\000/El\b\351\205\362nal] org\220TU\336\376\177\000\000@JU\336\376\177\000\000.l\377\020B\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\300RU\336\376\177\000\000\211M\366\020B\177\000\000|JU\336\376\177\000\000|JU\336\376\177\000\000|RU\336\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000B\177\000\000\002\000\000\000bluetoothd[91]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, addr_description = {data = {kind = 265171339, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11072425690612, alloc_stack_id = 265171339, free_stack_id = 31922, chunk_access = {bad_addr = 11, offset = 137104211194240, chunk_begin = 752, chunk_size = 140732628557832, user_requested_alignment = 1440, access_type = 0, alloc_type = 2}}, stack = {addr = 0, tid = 0, offset = 11072425690612, frame_pc = 137104211194251, access_size = 11, frame_descr = 0x7cb20fce3180 "\022\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11072425690612, size_with_redzone = 137104211194251, name = 0xb <error: Cannot access memory at address 0xb>, module_name = 0x7cb20fce3180 "\022\n", has_dynamic_init = 752, gcc_location = 0x7ffede556008, odr_indicator = 135523645228448}, {beg = 140732628553296, size = 139921741458207, size_with_redzone = 1, name = 0x7b420ebb85a0 "\200\314\335\017\242{", module_name = 0x7ffede5556a0 "\260VU\336\376\177", has_dynamic_init = 139921742415314, gcc_location = 0x7f42102f20d0, odr_indicator = 132579151536}, {beg = 140732628553344, size = 3, size_with_redzone = 139921742415376, name = 0x7f4210f64b8f <__vasprintf_internal+255> "I\211\004$H\205\300t(H\213\265\330\376\377\377L\211\352H\211\307\350\366\032\371\377H\211\301\353\212\350\254\346\n", module_name = 0x558862e0357b <bt_log_vprintf+171> "\205\300\017\210=\001", has_dynamic_init = 140732628556128, gcc_location = 0x7ffede554f40, odr_indicator = 2}, {beg = 139921743130560, size = 135935981112240, size_with_redzone = 140732628553488, name = 0x7f4211b28738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", module_name = 0x3e <error: Cannot access memory at address 0x3e>, has_dynamic_init = 135935981112240, gcc_location = 0x7f42102f20d0, odr_indicator = 140732628553520}}, reg_sites = {266193856, 31650, 81, 0}, access_size = 140732628555680, size = 69 'E'}, wild = {addr = 0, access_size = 0}}}}}, SanitizerGetAllocatedSizeNotOwned = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[9\000/El\b\351\205\362nal] org\220TU\336\376\177\000\000@JU\336\376\177\000\000.l\377\020B\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\300RU\336\376\177\000\000\211M\366\020B\177\000\000|JU\336\376\177\000\000|JU\336\376\177\000\000|RU\336\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000B\177\000\000\002\000\000\000bluetoothd[91]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, addr_description = {data = {kind = 265171339, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11072425690612, alloc_stack_id = 265171339, free_stack_id = 31922, chunk_access = {bad_addr = 11, offset = 137104211194240, chunk_begin = 752, chunk_size = 140732628557832, user_requested_alignment = 1440, access_type = 0, alloc_type = 2}}, stack = {addr = 0, tid = 0, offset = 11072425690612, frame_pc = 137104211194251, access_size = 11, frame_descr = 0x7cb20fce3180 "\022\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11072425690612, size_with_redzone = 137104211194251, name = 0xb <error: Cannot access memory at address 0xb>, module_name = 0x7cb20fce3180 "\022\n", has_dynamic_init = 752, gcc_location = 0x7ffede556008, odr_indicator = 135523645228448}, {beg = 140732628553296, size = 139921741458207, size_with_redzone = 1, name = 0x7b420ebb85a0 "\200\314\335\017\242{", module_name = 0x7ffede5556a0 "\260VU\336\376\177", has_dynamic_init = 139921742415314, gcc_location = 0x7f42102f20d0, odr_indicator = 132579151536}, {beg = 140732628553344, size = 3, size_with_redzone = 139921742415376, name = 0x7f4210f64b8f <__vasprintf_internal+255> "I\211\004$H\205\300t(H\213\265\330\376\377\377L\211\352H\211\307\350\366\032\371\377H\211\301\353\212\350\254\346\n", module_name = 0x558862e0357b <bt_log_vprintf+171> "\205\300\017\210=\001", has_dynamic_init = 140732628556128, gcc_location = 0x7ffede554f40, odr_indicator = 2}, {beg = 139921743130560, size = 135935981112240, size_with_redzone = 140732628553488, name = 0x7f4211b28738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", module_name = 0x3e <error: Cannot access memory at address 0x3e>, has_dynamic_init = 135935981112240, gcc_location = 0x7f42102f20d0, odr_indicator = 140732628553520}}, reg_sites = {266193856, 31650, 81, 0}, access_size = 140732628555680, size = 69 'E'}, wild = {addr = 0, access_size = 0}}}}}, CallocOverflow = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[9\000/El\b\351\205\362nal] org\220TU\336\376\177\000\000@JU\336\376\177\000\000.l\377\020B\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\300RU\336\376\177\000\000\211M\366\020B\177\000\000|JU\336\376\177\000\000|JU\336\376\177\000\000|RU\336\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000B\177\000\000\002\000\000\000bluetoothd[91]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, count = 137104211194251, size = 0}, ReallocArrayOverflow = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[9\000/El\b\351\205\362nal] org\220TU\336\376\177\000\000@JU\336\376\177\000\000.l\377\020B\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\300RU\336\376\177\000\000\211M\366\020B\177\000\000|JU\336\376\177\000\000|JU\336\376\177\000\000|RU\336\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000B\177\000\000\002\000\000\000bluetoothd[91]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, count = 137104211194251, size = 0}, PvallocOverflow = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[9\000/El\b\351\205\362nal] org\220TU\336\376\177\000\000@JU\336\376\177\000\000.l\377\020B\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\300RU\336\376\177\000\000\211M\366\020B\177\000\000|JU\336\376\177\000\000|JU\336\376\177\000\000|RU\336\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000B\177\000\000\002\000\000\000bluetoothd[91]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, size = 137104211194251}, InvalidAllocationAlignment = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[9\000/El\b\351\205\362nal] org\220TU\336\376\177\000\000@JU\336\376\177\000\000.l\377\020B\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\300RU\336\376\177\000\000\211M\366\020B\177\000\000|JU\336\376\177\000\000|JU\336\376\177\000\000|RU\336\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000B\177\000\000\002\000\000\000bluetoothd[91]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, alignment = 137104211194251}, InvalidAlignedAllocAlignment = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[9\000/El\b\351\205\362nal] org\220TU\336\376\177\000\000@JU\336\376\177\000\000.l\377\020B\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\300RU\336\376\177\000\000\211M\366\020B\177\000\000|JU\336\376\177\000\000|JU\336\376\177\000\000|RU\336\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000B\177\000\000\002\000\000\000bluetoothd[91]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, size = 137104211194251, alignment = 0}, InvalidPosixMemalignAlignment = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[9\000/El\b\351\205\362nal] org\220TU\336\376\177\000\000@JU\336\376\177\000\000.l\377\020B\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\300RU\336\376\177\000\000\211M\366\020B\177\000\000|JU\336\376\177\000\000|JU\336\376\177\000\000|RU\336\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000B\177\000\000\002\000\000\000bluetoothd[91]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, alignment = 137104211194251}, AllocationSizeTooBig = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[9\000/El\b\351\205\362nal] org\220TU\336\376\177\000\000@JU\336\376\177\000\000.l\377\020B\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\300RU\336\376\177\000\000\211M\366\020B\177\000\000|JU\336\376\177\000\000|JU\336\376\177\000\000|RU\336\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000B\177\000\000\002\000\000\000bluetoothd[91]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, user_size = 137104211194251, total_size = 0, max_size = 0}, RssLimitExceeded = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[9\000/El\b\351\205\362nal] org\220TU\336\376\177\000\000@JU\336\376\177\000\000.l\377\020B\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\300RU\336\376\177\000\000\211M\366\020B\177\000\000|JU\336\376\177\000\000|JU\336\376\177\000\000|RU\336\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000B\177\000\000\002\000\000\000bluetoothd[91]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002}, OutOfMemory = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[9\000/El\b\351\205\362nal] org\220TU\336\376\177\000\000@JU\336\376\177\000\000.l\377\020B\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\300RU\336\376\177\000\000\211M\366\020B\177\000\000|JU\336\376\177\000\000|JU\336\376\177\000\000|RU\336\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000B\177\000\000\002\000\000\000bluetoothd[91]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, requested_size = 137104211194251}, StringFunctionMemoryRangesOverlap = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[9\000/El\b\351\205\362nal] org\220TU\336\376\177\000\000@JU\336\376\177\000\000.l\377\020B\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\300RU\336\376\177\000\000\211M\366\020B\177\000\000|JU\336\376\177\000\000|JU\336\376\177\000\000|RU\336\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000B\177\000\000\002\000\000\000bluetoothd[91]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, length1 = 137104211194251, length2 = 0, addr1_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 11072425690612, kind = (__asan::kShadowKindGap | __asan::kShadowKindHigh | unknown: 0x88), shadow_byte = 49 '1'}, heap = {addr = 11072425690612, alloc_tid = 137104211194251, free_tid = 11, alloc_stack_id = 265171328, free_stack_id = 31922, chunk_access = {bad_addr = 752, offset = 140732628557832, chunk_begin = 135523645228448, chunk_size = 140732628553296, user_requested_alignment = 2847, access_type = 2, alloc_type = 0}}, stack = {addr = 11072425690612, tid = 137104211194251, offset = 11, frame_pc = 137104211194240, access_size = 752, frame_descr = 0x7ffede556008 ""}, global = {addr = 11072425690612, static kMaxGlobals = 4, globals = {{beg = 137104211194251, size = 11, size_with_redzone = 137104211194240, name = 0x2f0 <error: Cannot access memory at address 0x2f0>, module_name = 0x7ffede556008 "", has_dynamic_init = 135523645228448, gcc_location = 0x7ffede554e50, odr_indicator = 139921741458207}, {beg = 1, size = 135523645228448, size_with_redzone = 140732628555424, name = 0x7f4211c0c5d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", module_name = 0x7f42102f20d0 "", has_dynamic_init = 132579151536, gcc_location = 0x7ffede554e80, odr_indicator = 3}, {beg = 139921742415376, size = 139921729145743, size_with_redzone = 94044262774139, name = 0x7ffede555960 "\004[U\336\376\177", module_name = 0x7ffede554f40 "\030", has_dynamic_init = 2, gcc_location = 0x7f4211cbafc0 <__asan::instance>, odr_indicator = 135935981112240}, {beg = 140732628553488, size = 139921741481784, size_with_redzone = 62, name = 0x7ba20fddcbb0 "\003\021", module_name = 0x7f42102f20d0 "", has_dynamic_init = 140732628553520, gcc_location = 0x7ba20fddcbc0, odr_indicator = 81}}, reg_sites = {3730134944, 32766, 297591877, 32578}, access_size = 140732628557504, size = 104 'h'}, wild = {addr = 11072425690612, access_size = 137104211194251}}}}, addr2_description = {data = {kind = 6, {shadow = {addr = 139921742841751, kind = __asan::kShadowKindLow, shadow_byte = 253 '\375'}, heap = {addr = 139921742841751, alloc_tid = 139921743150336, free_tid = 140732628557056, alloc_stack_id = 297846226, free_stack_id = 32578, chunk_access = {bad_addr = 8315162673665959470, offset = 130735371371, chunk_begin = 140732628554976, chunk_size = 3, user_requested_alignment = 1552, access_type = 0, alloc_type = 3}}, stack = {addr = 139921742841751, tid = 139921743150336, offset = 140732628557056, frame_pc = 139921742415314, access_size = 8315162673665959470, frame_descr = 0x1e706f746b <error: Cannot access memory at address 0x1e706f746b>}, global = {addr = 139921742841751, static kMaxGlobals = 4, globals = {{beg = 139921743150336, size = 140732628557056, size_with_redzone = 139921742415314, name = 0x736564656572662e <error: Cannot access memory at address 0x736564656572662e>, module_name = 0x1e706f746b <error: Cannot access memory at address 0x1e706f746b>, has_dynamic_init = 140732628554976, gcc_location = 0x3, odr_indicator = 139921742415376}, {beg = 139921729145743, size = 94044262774139, size_with_redzone = 140732628557760, name = 0x7ffede555560 "\200UU\336\376\177", module_name = 0x7f4211cb4f78 "\001", has_dynamic_init = 140732628555168, gcc_location = 0x558862f445c0, odr_indicator = 139921721100472}, {beg = 65535, size = 140732628555088, size_with_redzone = 139921742246745, name = 0x40 <error: Cannot access memory at address 0x40>, module_name = 0x7b420edbe600 "\0166\340E", has_dynamic_init = 140732628555136, gcc_location = 0x7f4211b2f74a <__asan_stack_malloc_0(__sanitizer::uptr)+234>, odr_indicator = 140732628555136}, {beg = 139921742671741, size = 140732628555168, size_with_redzone = 139921742515558, name = 0x7ffede555620 "", module_name = 0x2 <error: Cannot access memory at address 0x2>, has_dynamic_init = 139921743130560, gcc_location = 0x7b820fda3980, odr_indicator = 140732628555248}}, reg_sites = {296912696, 32578, 40, 0}, access_size = 139921742621213, size = 208 '\320'}, wild = {addr = 139921742841751, access_size = 139921743150336}}}}, function = 0x7ffede555610 "\300^U\336\376\177"}, StringFunctionSizeOverflow = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[9\000/El\b\351\205\362nal] org\220TU\336\376\177\000\000@JU\336\376\177\000\000.l\377\020B\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\300RU\336\376\177\000\000\211M\366\020B\177\000\000|JU\336\376\177\000\000|JU\336\376\177\000\000|RU\336\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000B\177\000\000\002\000\000\000bluetoothd[91]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, addr_description = {data = {kind = 265171339, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11072425690612, alloc_stack_id = 265171339, free_stack_id = 31922, chunk_access = {bad_addr = 11, offset = 137104211194240, chunk_begin = 752, chunk_size = 140732628557832, user_requested_alignment = 1440, access_type = 0, alloc_type = 2}}, stack = {addr = 0, tid = 0, offset = 11072425690612, frame_pc = 137104211194251, access_size = 11, frame_descr = 0x7cb20fce3180 "\022\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11072425690612, size_with_redzone = 137104211194251, name = 0xb <error: Cannot access memory at address 0xb>, module_name = 0x7cb20fce3180 "\022\n", has_dynamic_init = 752, gcc_location = 0x7ffede556008, odr_indicator = 135523645228448}, {beg = 140732628553296, size = 139921741458207, size_with_redzone = 1, name = 0x7b420ebb85a0 "\200\314\335\017\242{", module_name = 0x7ffede5556a0 "\260VU\336\376\177", has_dynamic_init = 139921742415314, gcc_location = 0x7f42102f20d0, odr_indicator = 132579151536}, {beg = 140732628553344, size = 3, size_with_redzone = 139921742415376, name = 0x7f4210f64b8f <__vasprintf_internal+255> "I\211\004$H\205\300t(H\213\265\330\376\377\377L\211\352H\211\307\350\366\032\371\377H\211\301\353\212\350\254\346\n", module_name = 0x558862e0357b <bt_log_vprintf+171> "\205\300\017\210=\001", has_dynamic_init = 140732628556128, gcc_location = 0x7ffede554f40, odr_indicator = 2}, {beg = 139921743130560, size = 135935981112240, size_with_redzone = 140732628553488, name = 0x7f4211b28738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", module_name = 0x3e <error: Cannot access memory at address 0x3e>, has_dynamic_init = 135935981112240, gcc_location = 0x7f42102f20d0, odr_indicator = 140732628553520}}, reg_sites = {266193856, 31650, 81, 0}, access_size = 140732628555680, size = 69 'E'}, wild = {addr = 0, access_size = 0}}}}, size = 140732628557504}, BadParamsToAnnotateContiguousContainer = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[9\000/El\b\351\205\362nal] org\220TU\336\376\177\000\000@JU\336\376\177\000\000.l\377\020B\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\300RU\336\376\177\000\000\211M\366\020B\177\000\000|JU\336\376\177\000\000|JU\336\376\177\000\000|RU\336\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000B\177\000\000\002\000\000\000bluetoothd[91]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, beg = 137104211194251, end = 0, old_mid = 0, new_mid = 11072425690612}, BadParamsToAnnotateDoubleEndedContiguousContainer = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[9\000/El\b\351\205\362nal] org\220TU\336\376\177\000\000@JU\336\376\177\000\000.l\377\020B\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\300RU\336\376\177\000\000\211M\366\020B\177\000\000|JU\336\376\177\000\000|JU\336\376\177\000\000|RU\336\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000B\177\000\000\002\000\000\000bluetoothd[91]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, storage_beg = 137104211194251, storage_end = 0, old_container_beg = 0, old_container_end = 11072425690612, new_container_beg = 137104211194251, new_container_end = 11}, BadParamsToCopyContiguousContainerAnnotations = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[9\000/El\b\351\205\362nal] org\220TU\336\376\177\000\000@JU\336\376\177\000\000.l\377\020B\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\300RU\336\376\177\000\000\211M\366\020B\177\000\000|JU\336\376\177\000\000|JU\336\376\177\000\000|RU\336\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000B\177\000\000\002\000\000\000bluetoothd[91]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, old_storage_beg = 137104211194251, old_storage_end = 0, new_storage_beg = 0, new_storage_end = 11072425690612}, ODRViolation = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[9\000/El\b\351\205\362nal] org\220TU\336\376\177\000\000@JU\336\376\177\000\000.l\377\020B\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\300RU\336\376\177\000\000\211M\366\020B\177\000\000|JU\336\376\177\000\000|JU\336\376\177\000\000|RU\336\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000B\177\000\000\002\000\000\000bluetoothd[91]: [signal] org.fre"...}, tid = 0}, global1 = {beg = 18446744069414584322, size = 137104211194251, size_with_redzone = 0, name = 0x0, module_name = 0xa12000005f4 <error: Cannot access memory at address 0xa12000005f4>, has_dynamic_init = 137104211194251, gcc_location = 0xb, odr_indicator = 137104211194240}, global2 = {beg = 752, size = 140732628557832, size_with_redzone = 135523645228448, name = 0x7ffede554e50 "\240VU\336\376\177", module_name = 0x7f4211b22b1f <__asan::asan_malloc(unsigned long, __sanitizer::BufferedStackTrace*)+47> "H\205\300t\f\311\303f.\017\037\204", has_dynamic_init = 1, gcc_location = 0x7b420ebb85a0, odr_indicator = 140732628555424}, stack_id1 = 297846226, stack_id2 = 32578}, InvalidPointerPair = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[9\000/El\b\351\205\362nal] org\220TU\336\376\177\000\000@JU\336\376\177\000\000.l\377\020B\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\300RU\336\376\177\000\000\211M\366\020B\177\000\000|JU\336\376\177\000\000|JU\336\376\177\000\000|RU\336\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000B\177\000\000\002\000\000\000bluetoothd[91]: [signal] org.fre"...}, tid = 0}, pc = 18446744069414584322, bp = 137104211194251, sp = 0, addr1_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 11072425690612, kind = (__asan::kShadowKindGap | __asan::kShadowKindHigh | unknown: 0x88), shadow_byte = 49 '1'}, heap = {addr = 11072425690612, alloc_tid = 137104211194251, free_tid = 11, alloc_stack_id = 265171328, free_stack_id = 31922, chunk_access = {bad_addr = 752, offset = 140732628557832, chunk_begin = 135523645228448, chunk_size = 140732628553296, user_requested_alignment = 2847, access_type = 2, alloc_type = 0}}, stack = {addr = 11072425690612, tid = 137104211194251, offset = 11, frame_pc = 137104211194240, access_size = 752, frame_descr = 0x7ffede556008 ""}, global = {addr = 11072425690612, static kMaxGlobals = 4, globals = {{beg = 137104211194251, size = 11, size_with_redzone = 137104211194240, name = 0x2f0 <error: Cannot access memory at address 0x2f0>, module_name = 0x7ffede556008 "", has_dynamic_init = 135523645228448, gcc_location = 0x7ffede554e50, odr_indicator = 139921741458207}, {beg = 1, size = 135523645228448, size_with_redzone = 140732628555424, name = 0x7f4211c0c5d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", module_name = 0x7f42102f20d0 "", has_dynamic_init = 132579151536, gcc_location = 0x7ffede554e80, odr_indicator = 3}, {beg = 139921742415376, size = 139921729145743, size_with_redzone = 94044262774139, name = 0x7ffede555960 "\004[U\336\376\177", module_name = 0x7ffede554f40 "\030", has_dynamic_init = 2, gcc_location = 0x7f4211cbafc0 <__asan::instance>, odr_indicator = 135935981112240}, {beg = 140732628553488, size = 139921741481784, size_with_redzone = 62, name = 0x7ba20fddcbb0 "\003\021", module_name = 0x7f42102f20d0 "", has_dynamic_init = 140732628553520, gcc_location = 0x7ba20fddcbc0, odr_indicator = 81}}, reg_sites = {3730134944, 32766, 297591877, 32578}, access_size = 140732628557504, size = 104 'h'}, wild = {addr = 11072425690612, access_size = 137104211194251}}}}, addr2_description = {data = {kind = 6, {shadow = {addr = 139921742841751, kind = __asan::kShadowKindLow, shadow_byte = 253 '\375'}, heap = {addr = 139921742841751, alloc_tid = 139921743150336, free_tid = 140732628557056, alloc_stack_id = 297846226, free_stack_id = 32578, chunk_access = {bad_addr = 8315162673665959470, offset = 130735371371, chunk_begin = 140732628554976, chunk_size = 3, user_requested_alignment = 1552, access_type = 0, alloc_type = 3}}, stack = {addr = 139921742841751, tid = 139921743150336, offset = 140732628557056, frame_pc = 139921742415314, access_size = 8315162673665959470, frame_descr = 0x1e706f746b <error: Cannot access memory at address 0x1e706f746b>}, global = {addr = 139921742841751, static kMaxGlobals = 4, globals = {{beg = 139921743150336, size = 140732628557056, size_with_redzone = 139921742415314, name = 0x736564656572662e <error: Cannot access memory at address 0x736564656572662e>, module_name = 0x1e706f746b <error: Cannot access memory at address 0x1e706f746b>, has_dynamic_init = 140732628554976, gcc_location = 0x3, odr_indicator = 139921742415376}, {beg = 139921729145743, size = 94044262774139, size_with_redzone = 140732628557760, name = 0x7ffede555560 "\200UU\336\376\177", module_name = 0x7f4211cb4f78 "\001", has_dynamic_init = 140732628555168, gcc_location = 0x558862f445c0, odr_indicator = 139921721100472}, {beg = 65535, size = 140732628555088, size_with_redzone = 139921742246745, name = 0x40 <error: Cannot access memory at address 0x40>, module_name = 0x7b420edbe600 "\0166\340E", has_dynamic_init = 140732628555136, gcc_location = 0x7f4211b2f74a <__asan_stack_malloc_0(__sanitizer::uptr)+234>, odr_indicator = 140732628555136}, {beg = 139921742671741, size = 140732628555168, size_with_redzone = 139921742515558, name = 0x7ffede555620 "", module_name = 0x2 <error: Cannot access memory at address 0x2>, has_dynamic_init = 139921743130560, gcc_location = 0x7b820fda3980, odr_indicator = 140732628555248}}, reg_sites = {296912696, 32578, 40, 0}, access_size = 139921742621213, size = 208 '\320'}, wild = {addr = 139921742841751, access_size = 139921743150336}}}}}, Generic = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[9\000/El\b\351\205\362nal] org\220TU\336\376\177\000\000@JU\336\376\177\000\000.l\377\020B\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\300RU\336\376\177\000\000\211M\366\020B\177\000\000|JU\336\376\177\000\000|JU\336\376\177\000\000|RU\336\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000B\177\000\000\002\000\000\000bluetoothd[91]: [signal] org.fre"...}, tid = 0}, addr_description = {data = {kind = __asan::kAddressKindHeap, {shadow = {addr = 137104211194251, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 137104211194251, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1524, free_stack_id = 2578, chunk_access = {bad_addr = 137104211194251, offset = 11, chunk_begin = 137104211194240, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, stack = {addr = 137104211194251, tid = 0, offset = 0, frame_pc = 11072425690612, access_size = 137104211194251, frame_descr = 0xb <error: Cannot access memory at address 0xb>}, global = {addr = 137104211194251, static kMaxGlobals = 4, globals = {{beg = 0, size = 0, size_with_redzone = 11072425690612, name = 0x7cb20fce318b "B", module_name = 0xb <error: Cannot access memory at address 0xb>, has_dynamic_init = 137104211194240, gcc_location = 0x2f0, odr_indicator = 140732628557832}, {beg = 135523645228448, size = 140732628553296, size_with_redzone = 139921741458207, name = 0x1 <error: Cannot access memory at address 0x1>, module_name = 0x7b420ebb85a0 "\200\314\335\017\242{", has_dynamic_init = 140732628555424, gcc_location = 0x7f4211c0c5d2 <___interceptor_malloc(__sanitizer::uptr)+130>, odr_indicator = 139921716093136}, {beg = 132579151536, size = 140732628553344, size_with_redzone = 3, name = 0x7f4211c0c610 <___interceptor_malloc(__sanitizer::uptr)+192> "D\213\215\314\367\377\377E\205\311tTH\211m\330A\203\371\001t*E\017\276\3061\311H\211\352H\211\306H\215\275\320\367\377\377\350\"\004\001", module_name = 0x7f4210f64b8f <__vasprintf_internal+255> "I\211\004$H\205\300t(H\213\265\330\376\377\377L\211\352H\211\307\350\366\032\371\377H\211\301\353\212\350\254\346\n", has_dynamic_init = 94044262774139, gcc_location = 0x7ffede555960, odr_indicator = 140732628553536}, {beg = 2, size = 139921743130560, size_with_redzone = 135935981112240, name = 0x7ffede554f10 "\300^U\336\376\177", module_name = 0x7f4211b28738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", has_dynamic_init = 62, gcc_location = 0x7ba20fddcbb0, odr_indicator = 139921716093136}}, reg_sites = {3730132784, 32766, 266193856, 31650}, access_size = 81, size = 160 '\240'}, wild = {addr = 137104211194251, access_size = 0}}}}, pc = 139921742160965, bp = 140732628557504, sp = 140732628555368, access_size = 6, bug_descr = 0x7f4211c74797 "heap-use-after-free", is_write = false, shadow_val = 253 '\375'}}}, halt_on_error_ = true}
error = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[9\000/El\b\351\205\362nal] org\220TU\336\376\177\000\000@JU\336\376\177\000\000.l\377\020B\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\300RU\336\376\177\000\000\211M\366\020B\177\000\000|JU\336\376\177\000\000|JU\336\376\177\000\000|RU\336\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000B\177\000\000\002\000\000\000bluetoothd[91]: [signal] org.fre"...}, tid = 0}, addr_description = {data = {kind = __asan::kAddressKindHeap, {shadow = {addr = 137104211194251, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 137104211194251, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1524, free_stack_id = 2578, chunk_access = {bad_addr = 137104211194251, offset = 11, chunk_begin = 137104211194240, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, stack = {addr = 137104211194251, tid = 0, offset = 0, frame_pc = 11072425690612, access_size = 137104211194251, frame_descr = 0xb <error: Cannot access memory at address 0xb>}, global = {addr = 137104211194251, static kMaxGlobals = 4, globals = {{beg = 0, size = 0, size_with_redzone = 11072425690612, name = 0x7cb20fce318b "B", module_name = 0xb <error: Cannot access memory at address 0xb>, has_dynamic_init = 137104211194240, gcc_location = 0x2f0, odr_indicator = 140732628557832}, {beg = 135523645228448, size = 140732628553296, size_with_redzone = 139921741458207, name = 0x1 <error: Cannot access memory at address 0x1>, module_name = 0x7b420ebb85a0 "\200\314\335\017\242{", has_dynamic_init = 140732628555424, gcc_location = 0x7f4211c0c5d2 <___interceptor_malloc(__sanitizer::uptr)+130>, odr_indicator = 139921716093136}, {beg = 132579151536, size = 140732628553344, size_with_redzone = 3, name = 0x7f4211c0c610 <___interceptor_malloc(__sanitizer::uptr)+192> "D\213\215\314\367\377\377E\205\311tTH\211m\330A\203\371\001t*E\017\276\3061\311H\211\352H\211\306H\215\275\320\367\377\377\350\"\004\001", module_name = 0x7f4210f64b8f <__vasprintf_internal+255> "I\211\004$H\205\300t(H\213\265\330\376\377\377L\211\352H\211\307\350\366\032\371\377H\211\301\353\212\350\254\346\n", has_dynamic_init = 94044262774139, gcc_location = 0x7ffede555960, odr_indicator = 140732628553536}, {beg = 2, size = 139921743130560, size_with_redzone = 135935981112240, name = 0x7ffede554f10 "\300^U\336\376\177", module_name = 0x7f4211b28738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", has_dynamic_init = 62, gcc_location = 0x7ba20fddcbb0, odr_indicator = 139921716093136}}, reg_sites = {3730132784, 32766, 266193856, 31650}, access_size = 81, size = 160 '\240'}, wild = {addr = 137104211194251, access_size = 0}}}}, pc = 139921742160965, bp = 140732628557504, sp = 140732628555368, access_size = 6, bug_descr = 0x7f4211c74797 "heap-use-after-free", is_write = false, shadow_val = 253 '\375'}
#9 0x00007f4211c18f8d in __asan::ReportGenericError (pc=<optimized out>, bp=bp@entry=140732628557504, sp=sp@entry=140732628555368, addr=addr@entry=137104211194251, is_write=is_write@entry=false, access_size=access_size@entry=6, exp=<optimized out>, fatal=false) at ../../../../src/libsanitizer/asan/asan_report.cpp:536
in_report = <optimized out>
error = <optimized out>
enable_fp = <optimized out>
#10 0x00007f4211bce468 in MemcmpInterceptorCommon (ctx=ctx@entry=0x7ffede555ed0, real_fn=<optimized out>, a1=a1@entry=0x7cb20fce318b, a2=a2@entry=0x7b420ea43860, size=size@entry=6) at ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:848
bp = 140732628557504
pc = <optimized out>
local_stack = 136760613797952
sp = 140732628555368
_ctx = 0x7ffede555ed0
suppressed = <optimized out>
__offset = 137104211194251
__size = 6
__bad = <optimized out>
result = <optimized out>
#11 0x00007f4211bce835 in ___interceptor_memcmp (a1=0x7cb20fce318b, a2=0x7b420ea43860, size=6) at ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:880
ctx = 0x7ffede555ed0
_ctx = {interceptor_name = 0x7f4211c786b6 "memcmp"}
#12 ___interceptor_memcmp (a1=0x7cb20fce318b, a2=0x7b420ea43860, size=6) at ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:875
ctx = <optimized out>
_ctx = <optimized out>
#13 0x0000558862ce7048 in bacmp (ba1=0x7cb20fce318b, ba2=0x7b420ea43860) at ./lib/bluetooth/bluetooth.h:438
No locals.
#14 device_addr_type_cmp (a=0x7cb20fce3180, b=0x7b420ea43860) at src/device.c:5657
dev = 0x7cb20fce3180
addr = 0x7b420ea43860
cmp = <optimized out>
#15 0x00007f42119484c2 in g_slist_find_custom () from /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
No symbol table info available.
#16 0x0000558862c66704 in btd_adapter_find_device (adapter=<optimized out>, dst=dst@entry=0x7b820fd664d8, bdaddr_type=1 '\001') at src/adapter.c:1055
addr = <optimized out>
device = <optimized out>
list = <optimized out>
#17 0x0000558862c08c17 in att_disconnected (err=<optimized out>, user_data=0x7b820fd664d0) at src/gatt-database.c:335
state = 0x7b820fd664d0
device = <optimized out>
__func__ = "att_disconnected"
#18 0x0000558862c1fb44 in btd_gatt_database_att_disconnected (database=<optimized out>, device=<optimized out>) at src/gatt-database.c:4238
server = <optimized out>
att = <optimized out>
state = <optimized out>
addr = <optimized out>
type = <optimized out>
__func__ = "btd_gatt_database_att_disconnected"
#19 0x0000558862cc90f6 in gatt_server_cleanup (device=device@entry=0x7cb20fce2e00) at src/device.c:842
No locals.
#20 0x0000558862cdd7ec in attio_cleanup (device=0x7cb20fce2e00) at src/device.c:862
No locals.
#21 0x0000558862cdde37 in device_free (user_data=0x7cb20fce2e00) at src/device.c:918
device = 0x7cb20fce2e00
__func__ = "device_free"
#22 0x0000558862d5ba4a in remove_interface (data=0x7bb20fd169d0, name=name@entry=0x558862f68a80 "org.bluez.Device1") at gdbus/object.c:742
iface = 0x7ba20fd867c0
#23 0x0000558862d5e60c in g_dbus_unregister_interface (connection=<optimized out>, path=<optimized out>, name=<optimized out>) at gdbus/object.c:1499
data = <optimized out>
#24 0x0000558862c991c3 in adapter_remove (adapter=adapter@entry=0x7c720fce0200) at src/adapter.c:7307
l = 0x7b620fe234f0 = {0x7cb20fce2e00}
db = <optimized out>
ranging_manager = <optimized out>
__func__ = "adapter_remove"
#25 0x0000558862c99d58 in adapter_cleanup () at src/adapter.c:11263
adapter = 0x7c720fce0200
#26 0x0000558862a4b2f0 in main (argc=<optimized out>, argv=<optimized out>) at src/main.c:1723
context = <optimized out>
err = <optimized out>
sdp_mtu = 0
sdp_flags = <optimized out>
gdbus_flags = <optimized out>
__func__ = "main""
https://github.com/bluez/bluez/pull/2552
---
Regards,
Linux Bluetooth
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH BlueZ] bap: Fix use-after-free of device referenced by session
2026-09-19 0:14 [PATCH BlueZ] bap: Fix use-after-free of device referenced by session Pauli Virtanen
2026-09-19 1:24 ` [BlueZ] " bluez.test.bot
@ 2026-09-21 14:30 ` patchwork-bot+bluetooth
1 sibling, 0 replies; 3+ messages in thread
From: patchwork-bot+bluetooth @ 2026-09-21 14:30 UTC (permalink / raw)
To: Pauli Virtanen; +Cc: linux-bluetooth
Hello:
This patch was applied to bluetooth/bluez.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:
On Sat, 19 Sep 2026 03:14:05 +0300 you wrote:
> bap_attached() creates bap_data that are not bound to btd_service, and
> can outlive the device (eg if ATT POLLHUP -> bap_detached is late).
> This then crashes when accessing bap_data::device later.
>
> Fix by having bap_data hold btd_device_ref(). This is similar to what
> avdtp.c etc. do.
>
> [...]
Here is the summary with links:
- [BlueZ] bap: Fix use-after-free of device referenced by session
https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=8a1c53517399
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-09-21 14:31 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-09-19 0:14 [PATCH BlueZ] bap: Fix use-after-free of device referenced by session Pauli Virtanen
2026-09-19 1:24 ` [BlueZ] " bluez.test.bot
2026-09-21 14:30 ` [PATCH BlueZ] " patchwork-bot+bluetooth
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox