* [PATCH BlueZ] adapter: Fix crash on short start discovery reply
@ 2026-09-19 18:44 Iaroslav Voitovych
2026-09-19 22:05 ` [BlueZ] " bluez.test.bot
0 siblings, 1 reply; 2+ messages in thread
From: Iaroslav Voitovych @ 2026-09-19 18:44 UTC (permalink / raw)
To: linux-bluetooth; +Cc: Iaroslav Voitovych
start_discovery_complete() validates the reply length before using the
returned parameters:
if (length < sizeof(*rp)) {
btd_error(adapter->dev_id,
"Wrong size of start discovery return parameters");
discovery_complete(adapter, MGMT_STATUS_FAILED);
return;
}
but that check sits below the branch taken when the discovery client
list has emptied while the command was pending, and that branch has
already dereferenced the reply:
if (!adapter->discovery_list) {
struct mgmt_cp_stop_discovery cp;
if (status != MGMT_STATUS_SUCCESS)
return;
/* Stop discovering as there are no clients left */
cp.type = rp->type; <-- rp may be NULL here
mgmt_cp_start_discovery is a single uint8_t, so rp->type is a one-byte
read at offset 0 and a NULL rp faults immediately.
The mgmt layer can invoke a command callback with no reply parameters:
src/shared/mgmt.c passes length 0 and a NULL param on the Command
Status path:
case MGMT_EV_CMD_STATUS:
...
DBG(mgmt, "[0x%04x] command 0x%02x status: 0x%02x", ...);
request_complete(mgmt, cs->status, opcode, index, 0, NULL);
Observed as a crash on a QCA9377 (13d3:3503) whose controller stops
answering HCI during audio use. The archived session logs show exactly
that sequence: the daemon's debug log (bluez 5.72) ends with the
Command Status delivery and the callback entry, for the Start Discovery
it had sent 2.05 s earlier, ten seconds after its last discovery client
had gone; the contemporaneous kernel log records the resulting fault:
bluetoothd:
21:03:16.750 discovery_remove() owner :1.125
21:03:24.943 send_request() [0x0000] command 0x0023
21:03:26.994 can_read_data() [0x0000] command 0x23 status: 0x00
21:03:26.994 start_discovery_complete() status 0x00
kernel:
21:03:26.995 bluetoothd[2821]: segfault at 0 ...
"command ... status:" is the Command Status branch (Command Complete
logs "complete:"), so the callback ran with status 0, length 0 and a
NULL param, found discovery_list empty, and faulted on rp->type. The
crash site was resolved from the shipped binary:
bluetoothd[2821]: segfault at 0 ip 00005d6eb1ad1986 sp 00007ffef8e784b0 \
error 4 in bluetoothd[a6986,5d6eb1a50000+f3000]
a6986: 41 0f b6 45 00 movzbl 0x0(%r13),%eax <-- cp.type = rp->type
a698b: 0f b7 53 04 movzwl 0x4(%rbx),%edx <-- adapter->dev_id
a6992: 4c 8d 45 d7 lea -0x29(%rbp),%r8 <-- &cp
The same delivery, a Command Status with status 0x00 answering a Start
Discovery just sent, was logged five more times on that machine: four
in the crashing daemon's own lifetime and once on a later day. On each
of those the client list was non-empty, so the existing check below
the branch handled it ("Wrong size of start discovery return
parameters"); when the list is empty the branch above is reached
first.
Why the kernel answers Start Discovery with a successful Command
Status rather than the usual one-byte Command Complete is not
established here. The crashing instance arrived while the controller
was timing out HCI commands; the fix does not depend on the cause.
Perform the same length validation before using the reply in the
no-clients branch. The check is added inside that branch rather than
hoisted above it, so that no other path changes behaviour.
Fixes: 3597d1377723 ("adapter: Fix not waiting for start discovery result")
---
Context, not part of the change: the crash was recorded on a QCA9377
(13d3:3503) laptop under Ubuntu 24.04 / bluez 5.72-0ubuntu5.5 and the
site was resolved from the stripped distro binary, then checked against
a retained core; the archived session record (daemon debug log and the
kernel log beside it) independently shows the same sequence: client
removed, Start Discovery sent, Command Status 0x00, fault. This guard
has not fired since it was installed; the delivery it guards against
was logged five more times with clients present, so the pre-existing
check caught those. The record and the crash-site method are public:
https://github.com/ivoitovych/qca9377-bt-hang (patches/bluez/README.md)
src/adapter.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/src/adapter.c b/src/adapter.c
--- a/src/adapter.c
+++ b/src/adapter.c
@@ -1863,6 +1863,12 @@
if (status != MGMT_STATUS_SUCCESS)
return;
+ if (length < sizeof(*rp)) {
+ btd_error(adapter->dev_id,
+ "Wrong size of start discovery return parameters");
+ return;
+ }
+
/* Stop discovering as there are no clients left */
cp.type = rp->type;
mgmt_send(adapter->mgmt, MGMT_OP_STOP_DISCOVERY,
--
2.43.0
^ permalink raw reply [flat|nested] 2+ messages in thread
* RE: [BlueZ] adapter: Fix crash on short start discovery reply
2026-09-19 18:44 [PATCH BlueZ] adapter: Fix crash on short start discovery reply Iaroslav Voitovych
@ 2026-09-19 22:05 ` bluez.test.bot
0 siblings, 0 replies; 2+ messages in thread
From: bluez.test.bot @ 2026-09-19 22:05 UTC (permalink / raw)
To: linux-bluetooth, yaroslav.voytovych
[-- Attachment #1: Type: text/plain, Size: 153906 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1169362/
---Test result---
Test Summary:
CheckPatch FAIL 0.52 seconds
GitLint FAIL 0.35 seconds
BuildEll PASS 19.68 seconds
BluezMake PASS 388.99 seconds
CheckSmatch PASS 292.31 seconds
bluezmakeextell PASS 93.29 seconds
TestFunctional FAIL 1157.65 seconds
IncrementalBuild PASS 396.37 seconds
ScanBuild PASS 1126.41 seconds
Details
##############################
Test: CheckPatch - FAIL
Desc: Run checkpatch.pl script
Output:
[BlueZ] adapter: Fix crash on short start discovery reply
WARNING:COMMIT_LOG_LONG_LINE: Prefer a maximum 75 chars per line (possible unwrapped commit description?)
#153:
a6986: 41 0f b6 45 00 movzbl 0x0(%r13),%eax <-- cp.type = rp->type
/home/runner/work/bluez/bluez/src/patch/14831546.patch total: 0 errors, 1 warnings, 12 lines checked
NOTE: For some of the reported defects, checkpatch may be able to
mechanically convert to the typical style using --fix or --fix-inplace.
/home/runner/work/bluez/bluez/src/patch/14831546.patch has style problems, please review.
NOTE: Ignored message types: COMMIT_MESSAGE COMPLEX_MACRO CONST_STRUCT FILE_PATH_CHANGES MISSING_SIGN_OFF PREFER_PACKED SPDX_LICENSE_TAG SPLIT_STRING SSCANF_TO_KSTRTO
NOTE: If any of the errors are false positives, please report
them to the maintainer, see CHECKPATCH in MAINTAINERS.
##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
[BlueZ] adapter: Fix crash on short start discovery reply
6: B3 Line contains hard tab characters (\t): " if (length < sizeof(*rp)) {"
7: B3 Line contains hard tab characters (\t): " btd_error(adapter->dev_id,"
8: B3 Line contains hard tab characters (\t): " "Wrong size of start discovery return parameters");"
9: B3 Line contains hard tab characters (\t): " discovery_complete(adapter, MGMT_STATUS_FAILED);"
10: B3 Line contains hard tab characters (\t): " return;"
11: B3 Line contains hard tab characters (\t): " }"
17: B3 Line contains hard tab characters (\t): " if (!adapter->discovery_list) {"
18: B3 Line contains hard tab characters (\t): " struct mgmt_cp_stop_discovery cp;"
20: B3 Line contains hard tab characters (\t): " if (status != MGMT_STATUS_SUCCESS)"
21: B3 Line contains hard tab characters (\t): " return;"
23: B3 Line contains hard tab characters (\t): " /* Stop discovering as there are no clients left */"
24: B3 Line contains hard tab characters (\t): " cp.type = rp->type; <-- rp may be NULL here"
33: B3 Line contains hard tab characters (\t): " case MGMT_EV_CMD_STATUS:"
34: B3 Line contains hard tab characters (\t): " ..."
35: B3 Line contains hard tab characters (\t): " DBG(mgmt, "[0x%04x] command 0x%02x status: 0x%02x", ...);"
36: B3 Line contains hard tab characters (\t): " request_complete(mgmt, cs->status, opcode, index, 0, NULL);"
##############################
Test: TestFunctional - FAIL
Desc: Run test-functional
Output:
FAIL functional.test_bap::test_bap_unicast_set_transport_created[hosts8-vm3-sc]: failed on teardown with "pytest_bluezenv.plugin.CoredumpWarning: Core dump: test-bluezenv-hosts8.0-bluetoothd-1789853871-52.core
/usr/bin/gdb: warning: Couldn't determine a path for the index cache directory.
[New LWP 52]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/usr/lib/x86_64-linux-gnu/libthread_db.so.1".
Core was generated by `/home/runner/work/bluez/bluez/src/src/src/bluetoothd --nodetach -f /run/bluetoo'.
Program terminated with signal SIGABRT, Aborted.
#0 __pthread_kill_implementation (threadid=<optimized out>, signo=6, no_tid=0) at ./nptl/pthread_kill.c:44
warning: 44 ./nptl/pthread_kill.c: No such file or directory
Thread 1 (Thread 0x7f28bd965900 (LWP 52)):
#0 __pthread_kill_implementation (threadid=<optimized out>, signo=6, no_tid=0) at ./nptl/pthread_kill.c:44
tid = <optimized out>
ret = 0
pd = <optimized out>
old_mask = {__val = {4412750543122677053}}
ret = <optimized out>
#1 __pthread_kill_internal (threadid=<optimized out>, signo=6) at ./nptl/pthread_kill.c:89
No locals.
#2 __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ./nptl/pthread_kill.c:100
No locals.
#3 0x00007f28be0c0b7e in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
ret = <optimized out>
#4 0x00007f28be0a38ec in __GI_abort () at ./stdlib/abort.c:77
act = {__sigaction_handler = {sa_handler = 0x0, sa_sigaction = 0x0}, sa_mask = {__val = {0, 0, 0, 0, 0, 140727779104048, 22, 139812960783312, 0, 140727779103984, 139812977628694, 139812947939328, 4096, 0, 15681749806120077824, 139812952121368}}, sa_flags = -1086406656, sa_restorer = 0x16}
#5 0x00007f28beccba0f in __sanitizer::Abort () at ../../../../src/libsanitizer/sanitizer_common/sanitizer_posix_libcdep.cpp:165
No locals.
#6 0x00007f28bedf1c2d in __sanitizer::Die () at ../../../../src/libsanitizer/sanitizer_common/sanitizer_termination.cpp:58
No locals.
#7 0x00007f28bedc693c in __asan::ScopedInErrorReport::~ScopedInErrorReport (this=0x7ffdbd489666) at ../../../../src/libsanitizer/asan/asan_report.cpp:221
buffer_copy = {buffer_ = {<__sanitizer::InternalMmapVectorNoCtor<char, false>> = {data_ = 0x7f28bd17d000 '=' <repeats 65 times>, "\n==52==ERROR: AddressSanitizer: heap-use-after-free on address 0x7c98bcde040b at pc 0x7f28bed7b445 bp 0x7ffdbd48ab60 sp 0x7ffdbd48a308\n"..., capacity_bytes_ = 4096, size_ = 3838}, <No data fields>}}
buffer_copy = <optimized out>
l = <optimized out>
#8 0x00007f28bedc5e02 in __asan::ReportGenericError (pc=139812977226821, bp=140727779109728, sp=sp@entry=140727779107592, addr=addr@entry=136995445539851, is_write=is_write@entry=false, access_size=6, fatal=false, exp=<optimized out>) at ../../../../src/libsanitizer/asan/asan_report.cpp:536
in_report = {error_report_lock_ = {<No data fields>}, static current_error_ = {kind = __asan::kErrorKindGeneric, {Base = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\375\177\000\000\002\000\000\000bluetoothd[5\000\212V\372\\\304\240\331nal] org0\241H\275\375\177\000\000\340\226H\275\375\177\000\000.<\032\276(\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\237H\275\375\177\000\000\211\035\021\276(\177\000\000\034\227H\275\375\177\000\000\034\227H\275\375\177\000\000\034\237H\275\375\177\000\000N\000\000\000\000\000\000\000\006\000\000\000(\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, DeadlySignal = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\375\177\000\000\002\000\000\000bluetoothd[5\000\212V\372\\\304\240\331nal] org0\241H\275\375\177\000\000\340\226H\275\375\177\000\000.<\032\276(\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\237H\275\375\177\000\000\211\035\021\276(\177\000\000\034\227H\275\375\177\000\000\034\227H\275\375\177\000\000\034\237H\275\375\177\000\000N\000\000\000\000\000\000\000\006\000\000\000(\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, signal = {siginfo = 0xffffffff00000002, context = 0x7c98bcde040b, addr = 0, pc = 0, sp = 11888469476927, bp = 136995445539851, is_memory_access = 11, write_flag = __sanitizer::SignalContext::Unknown, is_true_faulting_addr = false}}, DoubleFree = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\375\177\000\000\002\000\000\000bluetoothd[5\000\212V\372\\\304\240\331nal] org0\241H\275\375\177\000\000\340\226H\275\375\177\000\000.<\032\276(\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\237H\275\375\177\000\000\211\035\021\276(\177\000\000\034\227H\275\375\177\000\000\034\227H\275\375\177\000\000\034\237H\275\375\177\000\000N\000\000\000\000\000\000\000\006\000\000\000(\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, second_free_stack = 0xffffffff00000002, addr_description = {addr = 136995445539851, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1599, free_stack_id = 2768, chunk_access = {bad_addr = 136995445539851, offset = 11, chunk_begin = 136995445539840, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}}, NewDeleteTypeMismatch = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\375\177\000\000\002\000\000\000bluetoothd[5\000\212V\372\\\304\240\331nal] org0\241H\275\375\177\000\000\340\226H\275\375\177\000\000.<\032\276(\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\237H\275\375\177\000\000\211\035\021\276(\177\000\000\034\227H\275\375\177\000\000\034\227H\275\375\177\000\000\034\237H\275\375\177\000\000N\000\000\000\000\000\000\000\006\000\000\000(\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, free_stack = 0xffffffff00000002, addr_description = {addr = 136995445539851, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1599, free_stack_id = 2768, chunk_access = {bad_addr = 136995445539851, offset = 11, chunk_begin = 136995445539840, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, delete_size = 135414879003552, delete_alignment = 140727779105520}, FreeNotMalloced = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\375\177\000\000\002\000\000\000bluetoothd[5\000\212V\372\\\304\240\331nal] org0\241H\275\375\177\000\000\340\226H\275\375\177\000\000.<\032\276(\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\237H\275\375\177\000\000\211\035\021\276(\177\000\000\034\227H\275\375\177\000\000\034\227H\275\375\177\000\000\034\237H\275\375\177\000\000N\000\000\000\000\000\000\000\006\000\000\000(\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, free_stack = 0xffffffff00000002, addr_description = {data = {kind = 3168666635, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11888469476927, alloc_stack_id = 3168666635, free_stack_id = 31896, chunk_access = {bad_addr = 11, offset = 136995445539840, chunk_begin = 752, chunk_size = 140727779090440, user_requested_alignment = 928, access_type = 2, alloc_type = 2}}, stack = {addr = 0, tid = 0, offset = 11888469476927, frame_pc = 136995445539851, access_size = 11, frame_descr = 0x7c98bcde0400 "\320\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11888469476927, size_with_redzone = 136995445539851, name = 0xb <error: Cannot access memory at address 0xb>, module_name = 0x7c98bcde0400 "\320\n", has_dynamic_init = 752, gcc_location = 0x7ffdbd486008, odr_indicator = 135414879003552}, {beg = 140727779105520, size = 139812976524063, size_with_redzone = 1, name = 0x7b28bbc2a3a0 "", module_name = 0x7ffdbd48a340 "P\243H\275\375\177", has_dynamic_init = 139812977481170, gcc_location = 0x7f28bd5af0d0, odr_indicator = 132024671056}, {beg = 140727779105568, size = 3, size_with_redzone = 139812977481232, name = 0x7f28be111b8f <__vasprintf_internal+255> "I\211\004$H\205\300t(H\213\265\330\376\377\377L\211\352H\211\307\350\366\032\371\377H\211\301\353\212\350\254\346\n", module_name = 0x55f5d79085fb <bt_log_vprintf+171> "\205\300\017\210=\001", has_dynamic_init = 140727779108352, gcc_location = 0x7ffdbd489be0, odr_indicator = 2}, {beg = 139812978196416, size = 135827214920752, size_with_redzone = 140727779105712, name = 0x7f28becd5738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", module_name = 0x3e <error: Cannot access memory at address 0x3e>, has_dynamic_init = 135827214920752, gcc_location = 0x7f28bd5af0d0, odr_indicator = 140727779105744}}, reg_sites = {3169152064, 31624, 81, 0}, access_size = 140727779107904, size = 69 'E'}, wild = {addr = 0, access_size = 0}}}}}, AllocTypeMismatch = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\375\177\000\000\002\000\000\000bluetoothd[5\000\212V\372\\\304\240\331nal] org0\241H\275\375\177\000\000\340\226H\275\375\177\000\000.<\032\276(\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\237H\275\375\177\000\000\211\035\021\276(\177\000\000\034\227H\275\375\177\000\000\034\227H\275\375\177\000\000\034\237H\275\375\177\000\000N\000\000\000\000\000\000\000\006\000\000\000(\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, dealloc_stack = 0xffffffff00000002, alloc_type = 3168666635, dealloc_type = 31896, addr_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 0, kind = (__asan::kShadowKindGap | __asan::kShadowKindHigh | unknown: 0x3c), shadow_byte = 6 '\006'}, heap = {addr = 0, alloc_tid = 11888469476927, free_tid = 136995445539851, alloc_stack_id = 11, free_stack_id = 0, chunk_access = {bad_addr = 136995445539840, offset = 752, chunk_begin = 140727779090440, chunk_size = 135414879003552, user_requested_alignment = 2800, access_type = 1, alloc_type = 2}}, stack = {addr = 0, tid = 11888469476927, offset = 136995445539851, frame_pc = 11, access_size = 136995445539840, frame_descr = 0x2f0 <error: Cannot access memory at address 0x2f0>}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 11888469476927, size = 136995445539851, size_with_redzone = 11, name = 0x7c98bcde0400 "\320\n", module_name = 0x2f0 <error: Cannot access memory at address 0x2f0>, has_dynamic_init = 140727779090440, gcc_location = 0x7b28bbc2a3a0, odr_indicator = 140727779105520}, {beg = 139812976524063, size = 1, size_with_redzone = 135414879003552, name = 0x7ffdbd48a340 "P\243H\275\375\177", module_name = 0x7f28bedb95d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", has_dynamic_init = 139812952273104, gcc_location = 0x1ebd489b50, odr_indicator = 140727779105568}, {beg = 3, size = 139812977481232, size_with_redzone = 139812964211599, name = 0x55f5d79085fb <bt_log_vprintf+171> "\205\300\017\210=\001", module_name = 0x7ffdbd48a600 "\244\247H\275\375\177", has_dynamic_init = 140727779105760, gcc_location = 0x2, odr_indicator = 139812978196416}, {beg = 135827214920752, size = 140727779105712, size_with_redzone = 139812976547640, name = 0x3e <error: Cannot access memory at address 0x3e>, module_name = 0x7b88bce56c30 "\003\021", has_dynamic_init = 139812952273104, gcc_location = 0x7ffdbd489bd0, odr_indicator = 135827214920768}}, reg_sites = {81, 0, 3175654464, 32765}, access_size = 139812977226821, size = 96 '`'}, wild = {addr = 0, access_size = 11888469476927}}}}}, MallocUsableSizeNotOwned = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\375\177\000\000\002\000\000\000bluetoothd[5\000\212V\372\\\304\240\331nal] org0\241H\275\375\177\000\000\340\226H\275\375\177\000\000.<\032\276(\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\237H\275\375\177\000\000\211\035\021\276(\177\000\000\034\227H\275\375\177\000\000\034\227H\275\375\177\000\000\034\237H\275\375\177\000\000N\000\000\000\000\000\000\000\006\000\000\000(\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, addr_description = {data = {kind = 3168666635, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11888469476927, alloc_stack_id = 3168666635, free_stack_id = 31896, chunk_access = {bad_addr = 11, offset = 136995445539840, chunk_begin = 752, chunk_size = 140727779090440, user_requested_alignment = 928, access_type = 2, alloc_type = 2}}, stack = {addr = 0, tid = 0, offset = 11888469476927, frame_pc = 136995445539851, access_size = 11, frame_descr = 0x7c98bcde0400 "\320\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11888469476927, size_with_redzone = 136995445539851, name = 0xb <error: Cannot access memory at address 0xb>, module_name = 0x7c98bcde0400 "\320\n", has_dynamic_init = 752, gcc_location = 0x7ffdbd486008, odr_indicator = 135414879003552}, {beg = 140727779105520, size = 139812976524063, size_with_redzone = 1, name = 0x7b28bbc2a3a0 "", module_name = 0x7ffdbd48a340 "P\243H\275\375\177", has_dynamic_init = 139812977481170, gcc_location = 0x7f28bd5af0d0, odr_indicator = 132024671056}, {beg = 140727779105568, size = 3, size_with_redzone = 139812977481232, name = 0x7f28be111b8f <__vasprintf_internal+255> "I\211\004$H\205\300t(H\213\265\330\376\377\377L\211\352H\211\307\350\366\032\371\377H\211\301\353\212\350\254\346\n", module_name = 0x55f5d79085fb <bt_log_vprintf+171> "\205\300\017\210=\001", has_dynamic_init = 140727779108352, gcc_location = 0x7ffdbd489be0, odr_indicator = 2}, {beg = 139812978196416, size = 135827214920752, size_with_redzone = 140727779105712, name = 0x7f28becd5738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", module_name = 0x3e <error: Cannot access memory at address 0x3e>, has_dynamic_init = 135827214920752, gcc_location = 0x7f28bd5af0d0, odr_indicator = 140727779105744}}, reg_sites = {3169152064, 31624, 81, 0}, access_size = 140727779107904, size = 69 'E'}, wild = {addr = 0, access_size = 0}}}}}, SanitizerGetAllocatedSizeNotOwned = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\375\177\000\000\002\000\000\000bluetoothd[5\000\212V\372\\\304\240\331nal] org0\241H\275\375\177\000\000\340\226H\275\375\177\000\000.<\032\276(\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\237H\275\375\177\000\000\211\035\021\276(\177\000\000\034\227H\275\375\177\000\000\034\227H\275\375\177\000\000\034\237H\275\375\177\000\000N\000\000\000\000\000\000\000\006\000\000\000(\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, addr_description = {data = {kind = 3168666635, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11888469476927, alloc_stack_id = 3168666635, free_stack_id = 31896, chunk_access = {bad_addr = 11, offset = 136995445539840, chunk_begin = 752, chunk_size = 140727779090440, user_requested_alignment = 928, access_type = 2, alloc_type = 2}}, stack = {addr = 0, tid = 0, offset = 11888469476927, frame_pc = 136995445539851, access_size = 11, frame_descr = 0x7c98bcde0400 "\320\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11888469476927, size_with_redzone = 136995445539851, name = 0xb <error: Cannot access memory at address 0xb>, module_name = 0x7c98bcde0400 "\320\n", has_dynamic_init = 752, gcc_location = 0x7ffdbd486008, odr_indicator = 135414879003552}, {beg = 140727779105520, size = 139812976524063, size_with_redzone = 1, name = 0x7b28bbc2a3a0 "", module_name = 0x7ffdbd48a340 "P\243H\275\375\177", has_dynamic_init = 139812977481170, gcc_location = 0x7f28bd5af0d0, odr_indicator = 132024671056}, {beg = 140727779105568, size = 3, size_with_redzone = 139812977481232, name = 0x7f28be111b8f <__vasprintf_internal+255> "I\211\004$H\205\300t(H\213\265\330\376\377\377L\211\352H\211\307\350\366\032\371\377H\211\301\353\212\350\254\346\n", module_name = 0x55f5d79085fb <bt_log_vprintf+171> "\205\300\017\210=\001", has_dynamic_init = 140727779108352, gcc_location = 0x7ffdbd489be0, odr_indicator = 2}, {beg = 139812978196416, size = 135827214920752, size_with_redzone = 140727779105712, name = 0x7f28becd5738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", module_name = 0x3e <error: Cannot access memory at address 0x3e>, has_dynamic_init = 135827214920752, gcc_location = 0x7f28bd5af0d0, odr_indicator = 140727779105744}}, reg_sites = {3169152064, 31624, 81, 0}, access_size = 140727779107904, size = 69 'E'}, wild = {addr = 0, access_size = 0}}}}}, CallocOverflow = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\375\177\000\000\002\000\000\000bluetoothd[5\000\212V\372\\\304\240\331nal] org0\241H\275\375\177\000\000\340\226H\275\375\177\000\000.<\032\276(\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\237H\275\375\177\000\000\211\035\021\276(\177\000\000\034\227H\275\375\177\000\000\034\227H\275\375\177\000\000\034\237H\275\375\177\000\000N\000\000\000\000\000\000\000\006\000\000\000(\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, count = 136995445539851, size = 0}, ReallocArrayOverflow = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\375\177\000\000\002\000\000\000bluetoothd[5\000\212V\372\\\304\240\331nal] org0\241H\275\375\177\000\000\340\226H\275\375\177\000\000.<\032\276(\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\237H\275\375\177\000\000\211\035\021\276(\177\000\000\034\227H\275\375\177\000\000\034\227H\275\375\177\000\000\034\237H\275\375\177\000\000N\000\000\000\000\000\000\000\006\000\000\000(\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, count = 136995445539851, size = 0}, PvallocOverflow = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\375\177\000\000\002\000\000\000bluetoothd[5\000\212V\372\\\304\240\331nal] org0\241H\275\375\177\000\000\340\226H\275\375\177\000\000.<\032\276(\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\237H\275\375\177\000\000\211\035\021\276(\177\000\000\034\227H\275\375\177\000\000\034\227H\275\375\177\000\000\034\237H\275\375\177\000\000N\000\000\000\000\000\000\000\006\000\000\000(\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, size = 136995445539851}, InvalidAllocationAlignment = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\375\177\000\000\002\000\000\000bluetoothd[5\000\212V\372\\\304\240\331nal] org0\241H\275\375\177\000\000\340\226H\275\375\177\000\000.<\032\276(\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\237H\275\375\177\000\000\211\035\021\276(\177\000\000\034\227H\275\375\177\000\000\034\227H\275\375\177\000\000\034\237H\275\375\177\000\000N\000\000\000\000\000\000\000\006\000\000\000(\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, alignment = 136995445539851}, InvalidAlignedAllocAlignment = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\375\177\000\000\002\000\000\000bluetoothd[5\000\212V\372\\\304\240\331nal] org0\241H\275\375\177\000\000\340\226H\275\375\177\000\000.<\032\276(\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\237H\275\375\177\000\000\211\035\021\276(\177\000\000\034\227H\275\375\177\000\000\034\227H\275\375\177\000\000\034\237H\275\375\177\000\000N\000\000\000\000\000\000\000\006\000\000\000(\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, size = 136995445539851, alignment = 0}, InvalidPosixMemalignAlignment = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\375\177\000\000\002\000\000\000bluetoothd[5\000\212V\372\\\304\240\331nal] org0\241H\275\375\177\000\000\340\226H\275\375\177\000\000.<\032\276(\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\237H\275\375\177\000\000\211\035\021\276(\177\000\000\034\227H\275\375\177\000\000\034\227H\275\375\177\000\000\034\237H\275\375\177\000\000N\000\000\000\000\000\000\000\006\000\000\000(\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, alignment = 136995445539851}, AllocationSizeTooBig = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\375\177\000\000\002\000\000\000bluetoothd[5\000\212V\372\\\304\240\331nal] org0\241H\275\375\177\000\000\340\226H\275\375\177\000\000.<\032\276(\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\237H\275\375\177\000\000\211\035\021\276(\177\000\000\034\227H\275\375\177\000\000\034\227H\275\375\177\000\000\034\237H\275\375\177\000\000N\000\000\000\000\000\000\000\006\000\000\000(\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, user_size = 136995445539851, total_size = 0, max_size = 0}, RssLimitExceeded = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\375\177\000\000\002\000\000\000bluetoothd[5\000\212V\372\\\304\240\331nal] org0\241H\275\375\177\000\000\340\226H\275\375\177\000\000.<\032\276(\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\237H\275\375\177\000\000\211\035\021\276(\177\000\000\034\227H\275\375\177\000\000\034\227H\275\375\177\000\000\034\237H\275\375\177\000\000N\000\000\000\000\000\000\000\006\000\000\000(\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002}, OutOfMemory = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\375\177\000\000\002\000\000\000bluetoothd[5\000\212V\372\\\304\240\331nal] org0\241H\275\375\177\000\000\340\226H\275\375\177\000\000.<\032\276(\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\237H\275\375\177\000\000\211\035\021\276(\177\000\000\034\227H\275\375\177\000\000\034\227H\275\375\177\000\000\034\237H\275\375\177\000\000N\000\000\000\000\000\000\000\006\000\000\000(\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, requested_size = 136995445539851}, StringFunctionMemoryRangesOverlap = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\375\177\000\000\002\000\000\000bluetoothd[5\000\212V\372\\\304\240\331nal] org0\241H\275\375\177\000\000\340\226H\275\375\177\000\000.<\032\276(\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\237H\275\375\177\000\000\211\035\021\276(\177\000\000\034\227H\275\375\177\000\000\034\227H\275\375\177\000\000\034\237H\275\375\177\000\000N\000\000\000\000\000\000\000\006\000\000\000(\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, length1 = 136995445539851, length2 = 0, addr1_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 11888469476927, kind = (__asan::kShadowKindGap | __asan::kShadowKindHigh | unknown: 0x8), shadow_byte = 4 '\004'}, heap = {addr = 11888469476927, alloc_tid = 136995445539851, free_tid = 11, alloc_stack_id = 3168666624, free_stack_id = 31896, chunk_access = {bad_addr = 752, offset = 140727779090440, chunk_begin = 135414879003552, chunk_size = 140727779105520, user_requested_alignment = 2847, access_type = 3, alloc_type = 3}}, stack = {addr = 11888469476927, tid = 136995445539851, offset = 11, frame_pc = 136995445539840, access_size = 752, frame_descr = 0x7ffdbd486008 ""}, global = {addr = 11888469476927, static kMaxGlobals = 4, globals = {{beg = 136995445539851, size = 11, size_with_redzone = 136995445539840, name = 0x2f0 <error: Cannot access memory at address 0x2f0>, module_name = 0x7ffdbd486008 "", has_dynamic_init = 135414879003552, gcc_location = 0x7ffdbd489af0, odr_indicator = 139812976524063}, {beg = 1, size = 135414879003552, size_with_redzone = 140727779107648, name = 0x7f28bedb95d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", module_name = 0x7f28bd5af0d0 "", has_dynamic_init = 132024671056, gcc_location = 0x7ffdbd489b20, odr_indicator = 3}, {beg = 139812977481232, size = 139812964211599, size_with_redzone = 94514371921403, name = 0x7ffdbd48a600 "\244\247H\275\375\177", module_name = 0x7ffdbd489be0 "\030", has_dynamic_init = 2, gcc_location = 0x7f28bee67fc0 <__asan::instance>, odr_indicator = 135827214920752}, {beg = 140727779105712, size = 139812976547640, size_with_redzone = 62, name = 0x7b88bce56c30 "\003\021", module_name = 0x7f28bd5af0d0 "", has_dynamic_init = 140727779105744, gcc_location = 0x7b88bce56c40, odr_indicator = 81}}, reg_sites = {3175654464, 32765, 3201807429, 32552}, access_size = 140727779109728, size = 8 '\b'}, wild = {addr = 11888469476927, access_size = 136995445539851}}}}, addr2_description = {data = {kind = 6, {shadow = {addr = 139812977907607, kind = __asan::kShadowKindLow, shadow_byte = 253 '\375'}, heap = {addr = 139812977907607, alloc_tid = 139812978228480, free_tid = 140727779109280, alloc_stack_id = 3202061778, free_stack_id = 32552, chunk_access = {bad_addr = 8315162673665959470, offset = 130735371371, chunk_begin = 140727779107200, chunk_size = 3, user_requested_alignment = 1552, access_type = 1, alloc_type = 2}}, stack = {addr = 139812977907607, tid = 139812978228480, offset = 140727779109280, frame_pc = 139812977481170, access_size = 8315162673665959470, frame_descr = 0x1e706f746b <error: Cannot access memory at address 0x1e706f746b>}, global = {addr = 139812977907607, static kMaxGlobals = 4, globals = {{beg = 139812978228480, size = 140727779109280, size_with_redzone = 139812977481170, name = 0x736564656572662e <error: Cannot access memory at address 0x736564656572662e>, module_name = 0x1e706f746b <error: Cannot access memory at address 0x1e706f746b>, has_dynamic_init = 140727779107200, gcc_location = 0x3, odr_indicator = 139812977481232}, {beg = 139812964211599, size = 94514371921403, size_with_redzone = 140727779109984, name = 0x7ffdbd48a200 " \242H\275\375\177", module_name = 0x7f28bee61f78 "\001", has_dynamic_init = 140727779107392, gcc_location = 0x55f5d7a495a0, odr_indicator = 139812956166328}, {beg = 65535, size = 140727779107312, size_with_redzone = 139812977312601, name = 0x40 <error: Cannot access memory at address 0x40>, module_name = 0x7b28bbe56000 "\0166\340E", has_dynamic_init = 140727779107360, gcc_location = 0x7f28becdc74a <__asan_stack_malloc_0(__sanitizer::uptr)+234>, odr_indicator = 140727779107360}, {beg = 139812977737597, size = 140727779107392, size_with_redzone = 139812977581414, name = 0x7ffdbd48a2c0 "", module_name = 0x2 <error: Cannot access memory at address 0x2>, has_dynamic_init = 139812978196416, gcc_location = 0x7b68bce4c880, odr_indicator = 140727779107472}}, reg_sites = {3201128248, 32552, 40, 0}, access_size = 139812977687069, size = 208 '\320'}, wild = {addr = 139812977907607, access_size = 139812978228480}}}}, function = 0x7ffdbd48a2b0 "`\253H\275\375\177"}, StringFunctionSizeOverflow = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\375\177\000\000\002\000\000\000bluetoothd[5\000\212V\372\\\304\240\331nal] org0\241H\275\375\177\000\000\340\226H\275\375\177\000\000.<\032\276(\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\237H\275\375\177\000\000\211\035\021\276(\177\000\000\034\227H\275\375\177\000\000\034\227H\275\375\177\000\000\034\237H\275\375\177\000\000N\000\000\000\000\000\000\000\006\000\000\000(\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, addr_description = {data = {kind = 3168666635, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11888469476927, alloc_stack_id = 3168666635, free_stack_id = 31896, chunk_access = {bad_addr = 11, offset = 136995445539840, chunk_begin = 752, chunk_size = 140727779090440, user_requested_alignment = 928, access_type = 2, alloc_type = 2}}, stack = {addr = 0, tid = 0, offset = 11888469476927, frame_pc = 136995445539851, access_size = 11, frame_descr = 0x7c98bcde0400 "\320\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11888469476927, size_with_redzone = 136995445539851, name = 0xb <error: Cannot access memory at address 0xb>, module_name = 0x7c98bcde0400 "\320\n", has_dynamic_init = 752, gcc_location = 0x7ffdbd486008, odr_indicator = 135414879003552}, {beg = 140727779105520, size = 139812976524063, size_with_redzone = 1, name = 0x7b28bbc2a3a0 "", module_name = 0x7ffdbd48a340 "P\243H\275\375\177", has_dynamic_init = 139812977481170, gcc_location = 0x7f28bd5af0d0, odr_indicator = 132024671056}, {beg = 140727779105568, size = 3, size_with_redzone = 139812977481232, name = 0x7f28be111b8f <__vasprintf_internal+255> "I\211\004$H\205\300t(H\213\265\330\376\377\377L\211\352H\211\307\350\366\032\371\377H\211\301\353\212\350\254\346\n", module_name = 0x55f5d79085fb <bt_log_vprintf+171> "\205\300\017\210=\001", has_dynamic_init = 140727779108352, gcc_location = 0x7ffdbd489be0, odr_indicator = 2}, {beg = 139812978196416, size = 135827214920752, size_with_redzone = 140727779105712, name = 0x7f28becd5738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", module_name = 0x3e <error: Cannot access memory at address 0x3e>, has_dynamic_init = 135827214920752, gcc_location = 0x7f28bd5af0d0, odr_indicator = 140727779105744}}, reg_sites = {3169152064, 31624, 81, 0}, access_size = 140727779107904, size = 69 'E'}, wild = {addr = 0, access_size = 0}}}}, size = 140727779109728}, BadParamsToAnnotateContiguousContainer = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\375\177\000\000\002\000\000\000bluetoothd[5\000\212V\372\\\304\240\331nal] org0\241H\275\375\177\000\000\340\226H\275\375\177\000\000.<\032\276(\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\237H\275\375\177\000\000\211\035\021\276(\177\000\000\034\227H\275\375\177\000\000\034\227H\275\375\177\000\000\034\237H\275\375\177\000\000N\000\000\000\000\000\000\000\006\000\000\000(\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, beg = 136995445539851, end = 0, old_mid = 0, new_mid = 11888469476927}, BadParamsToAnnotateDoubleEndedContiguousContainer = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\375\177\000\000\002\000\000\000bluetoothd[5\000\212V\372\\\304\240\331nal] org0\241H\275\375\177\000\000\340\226H\275\375\177\000\000.<\032\276(\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\237H\275\375\177\000\000\211\035\021\276(\177\000\000\034\227H\275\375\177\000\000\034\227H\275\375\177\000\000\034\237H\275\375\177\000\000N\000\000\000\000\000\000\000\006\000\000\000(\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, storage_beg = 136995445539851, storage_end = 0, old_container_beg = 0, old_container_end = 11888469476927, new_container_beg = 136995445539851, new_container_end = 11}, BadParamsToCopyContiguousContainerAnnotations = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\375\177\000\000\002\000\000\000bluetoothd[5\000\212V\372\\\304\240\331nal] org0\241H\275\375\177\000\000\340\226H\275\375\177\000\000.<\032\276(\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\237H\275\375\177\000\000\211\035\021\276(\177\000\000\034\227H\275\375\177\000\000\034\227H\275\375\177\000\000\034\237H\275\375\177\000\000N\000\000\000\000\000\000\000\006\000\000\000(\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, old_storage_beg = 136995445539851, old_storage_end = 0, new_storage_beg = 0, new_storage_end = 11888469476927}, ODRViolation = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\375\177\000\000\002\000\000\000bluetoothd[5\000\212V\372\\\304\240\331nal] org0\241H\275\375\177\000\000\340\226H\275\375\177\000\000.<\032\276(\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\237H\275\375\177\000\000\211\035\021\276(\177\000\000\034\227H\275\375\177\000\000\034\227H\275\375\177\000\000\034\237H\275\375\177\000\000N\000\000\000\000\000\000\000\006\000\000\000(\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, global1 = {beg = 18446744069414584322, size = 136995445539851, size_with_redzone = 0, name = 0x0, module_name = 0xad00000063f <error: Cannot access memory at address 0xad00000063f>, has_dynamic_init = 136995445539851, gcc_location = 0xb, odr_indicator = 136995445539840}, global2 = {beg = 752, size = 140727779090440, size_with_redzone = 135414879003552, name = 0x7ffdbd489af0 "@\243H\275\375\177", module_name = 0x7f28beccfb1f <__asan::asan_malloc(unsigned long, __sanitizer::BufferedStackTrace*)+47> "H\205\300t\f\311\303f.\017\037\204", has_dynamic_init = 1, gcc_location = 0x7b28bbc2a3a0, odr_indicator = 140727779107648}, stack_id1 = 3202061778, stack_id2 = 32552}, InvalidPointerPair = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\375\177\000\000\002\000\000\000bluetoothd[5\000\212V\372\\\304\240\331nal] org0\241H\275\375\177\000\000\340\226H\275\375\177\000\000.<\032\276(\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\237H\275\375\177\000\000\211\035\021\276(\177\000\000\034\227H\275\375\177\000\000\034\227H\275\375\177\000\000\034\237H\275\375\177\000\000N\000\000\000\000\000\000\000\006\000\000\000(\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, pc = 18446744069414584322, bp = 136995445539851, sp = 0, addr1_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 11888469476927, kind = (__asan::kShadowKindGap | __asan::kShadowKindHigh | unknown: 0x8), shadow_byte = 4 '\004'}, heap = {addr = 11888469476927, alloc_tid = 136995445539851, free_tid = 11, alloc_stack_id = 3168666624, free_stack_id = 31896, chunk_access = {bad_addr = 752, offset = 140727779090440, chunk_begin = 135414879003552, chunk_size = 140727779105520, user_requested_alignment = 2847, access_type = 3, alloc_type = 3}}, stack = {addr = 11888469476927, tid = 136995445539851, offset = 11, frame_pc = 136995445539840, access_size = 752, frame_descr = 0x7ffdbd486008 ""}, global = {addr = 11888469476927, static kMaxGlobals = 4, globals = {{beg = 136995445539851, size = 11, size_with_redzone = 136995445539840, name = 0x2f0 <error: Cannot access memory at address 0x2f0>, module_name = 0x7ffdbd486008 "", has_dynamic_init = 135414879003552, gcc_location = 0x7ffdbd489af0, odr_indicator = 139812976524063}, {beg = 1, size = 135414879003552, size_with_redzone = 140727779107648, name = 0x7f28bedb95d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", module_name = 0x7f28bd5af0d0 "", has_dynamic_init = 132024671056, gcc_location = 0x7ffdbd489b20, odr_indicator = 3}, {beg = 139812977481232, size = 139812964211599, size_with_redzone = 94514371921403, name = 0x7ffdbd48a600 "\244\247H\275\375\177", module_name = 0x7ffdbd489be0 "\030", has_dynamic_init = 2, gcc_location = 0x7f28bee67fc0 <__asan::instance>, odr_indicator = 135827214920752}, {beg = 140727779105712, size = 139812976547640, size_with_redzone = 62, name = 0x7b88bce56c30 "\003\021", module_name = 0x7f28bd5af0d0 "", has_dynamic_init = 140727779105744, gcc_location = 0x7b88bce56c40, odr_indicator = 81}}, reg_sites = {3175654464, 32765, 3201807429, 32552}, access_size = 140727779109728, size = 8 '\b'}, wild = {addr = 11888469476927, access_size = 136995445539851}}}}, addr2_description = {data = {kind = 6, {shadow = {addr = 139812977907607, kind = __asan::kShadowKindLow, shadow_byte = 253 '\375'}, heap = {addr = 139812977907607, alloc_tid = 139812978228480, free_tid = 140727779109280, alloc_stack_id = 3202061778, free_stack_id = 32552, chunk_access = {bad_addr = 8315162673665959470, offset = 130735371371, chunk_begin = 140727779107200, chunk_size = 3, user_requested_alignment = 1552, access_type = 1, alloc_type = 2}}, stack = {addr = 139812977907607, tid = 139812978228480, offset = 140727779109280, frame_pc = 139812977481170, access_size = 8315162673665959470, frame_descr = 0x1e706f746b <error: Cannot access memory at address 0x1e706f746b>}, global = {addr = 139812977907607, static kMaxGlobals = 4, globals = {{beg = 139812978228480, size = 140727779109280, size_with_redzone = 139812977481170, name = 0x736564656572662e <error: Cannot access memory at address 0x736564656572662e>, module_name = 0x1e706f746b <error: Cannot access memory at address 0x1e706f746b>, has_dynamic_init = 140727779107200, gcc_location = 0x3, odr_indicator = 139812977481232}, {beg = 139812964211599, size = 94514371921403, size_with_redzone = 140727779109984, name = 0x7ffdbd48a200 " \242H\275\375\177", module_name = 0x7f28bee61f78 "\001", has_dynamic_init = 140727779107392, gcc_location = 0x55f5d7a495a0, odr_indicator = 139812956166328}, {beg = 65535, size = 140727779107312, size_with_redzone = 139812977312601, name = 0x40 <error: Cannot access memory at address 0x40>, module_name = 0x7b28bbe56000 "\0166\340E", has_dynamic_init = 140727779107360, gcc_location = 0x7f28becdc74a <__asan_stack_malloc_0(__sanitizer::uptr)+234>, odr_indicator = 140727779107360}, {beg = 139812977737597, size = 140727779107392, size_with_redzone = 139812977581414, name = 0x7ffdbd48a2c0 "", module_name = 0x2 <error: Cannot access memory at address 0x2>, has_dynamic_init = 139812978196416, gcc_location = 0x7b68bce4c880, odr_indicator = 140727779107472}}, reg_sites = {3201128248, 32552, 40, 0}, access_size = 139812977687069, size = 208 '\320'}, wild = {addr = 139812977907607, access_size = 139812978228480}}}}}, Generic = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\375\177\000\000\002\000\000\000bluetoothd[5\000\212V\372\\\304\240\331nal] org0\241H\275\375\177\000\000\340\226H\275\375\177\000\000.<\032\276(\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\237H\275\375\177\000\000\211\035\021\276(\177\000\000\034\227H\275\375\177\000\000\034\227H\275\375\177\000\000\034\237H\275\375\177\000\000N\000\000\000\000\000\000\000\006\000\000\000(\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, addr_description = {data = {kind = __asan::kAddressKindHeap, {shadow = {addr = 136995445539851, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 136995445539851, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1599, free_stack_id = 2768, chunk_access = {bad_addr = 136995445539851, offset = 11, chunk_begin = 136995445539840, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, stack = {addr = 136995445539851, tid = 0, offset = 0, frame_pc = 11888469476927, access_size = 136995445539851, frame_descr = 0xb <error: Cannot access memory at address 0xb>}, global = {addr = 136995445539851, static kMaxGlobals = 4, globals = {{beg = 0, size = 0, size_with_redzone = 11888469476927, name = 0x7c98bcde040b "B", module_name = 0xb <error: Cannot access memory at address 0xb>, has_dynamic_init = 136995445539840, gcc_location = 0x2f0, odr_indicator = 140727779090440}, {beg = 135414879003552, size = 140727779105520, size_with_redzone = 139812976524063, name = 0x1 <error: Cannot access memory at address 0x1>, module_name = 0x7b28bbc2a3a0 "", has_dynamic_init = 140727779107648, gcc_location = 0x7f28bedb95d2 <___interceptor_malloc(__sanitizer::uptr)+130>, odr_indicator = 139812952273104}, {beg = 132024671056, size = 140727779105568, size_with_redzone = 3, name = 0x7f28bedb9610 <___interceptor_malloc(__sanitizer::uptr)+192> "D\213\215\314\367\377\377E\205\311tTH\211m\330A\203\371\001t*E\017\276\3061\311H\211\352H\211\306H\215\275\320\367\377\377\350\"\004\001", module_name = 0x7f28be111b8f <__vasprintf_internal+255> "I\211\004$H\205\300t(H\213\265\330\376\377\377L\211\352H\211\307\350\366\032\371\377H\211\301\353\212\350\254\346\n", has_dynamic_init = 94514371921403, gcc_location = 0x7ffdbd48a600, odr_indicator = 140727779105760}, {beg = 2, size = 139812978196416, size_with_redzone = 135827214920752, name = 0x7ffdbd489bb0 "`\253H\275\375\177", module_name = 0x7f28becd5738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", has_dynamic_init = 62, gcc_location = 0x7b88bce56c30, odr_indicator = 139812952273104}}, reg_sites = {3175652304, 32765, 3169152064, 31624}, access_size = 81, size = 64 '@'}, wild = {addr = 136995445539851, access_size = 0}}}}, pc = 139812977226821, bp = 140727779109728, sp = 140727779107592, access_size = 6, bug_descr = 0x7f28bee21797 "heap-use-after-free", is_write = false, shadow_val = 253 '\375'}}}, halt_on_error_ = true}
error = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\375\177\000\000\002\000\000\000bluetoothd[5\000\212V\372\\\304\240\331nal] org0\241H\275\375\177\000\000\340\226H\275\375\177\000\000.<\032\276(\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\237H\275\375\177\000\000\211\035\021\276(\177\000\000\034\227H\275\375\177\000\000\034\227H\275\375\177\000\000\034\237H\275\375\177\000\000N\000\000\000\000\000\000\000\006\000\000\000(\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, addr_description = {data = {kind = __asan::kAddressKindHeap, {shadow = {addr = 136995445539851, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 136995445539851, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1599, free_stack_id = 2768, chunk_access = {bad_addr = 136995445539851, offset = 11, chunk_begin = 136995445539840, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, stack = {addr = 136995445539851, tid = 0, offset = 0, frame_pc = 11888469476927, access_size = 136995445539851, frame_descr = 0xb <error: Cannot access memory at address 0xb>}, global = {addr = 136995445539851, static kMaxGlobals = 4, globals = {{beg = 0, size = 0, size_with_redzone = 11888469476927, name = 0x7c98bcde040b "B", module_name = 0xb <error: Cannot access memory at address 0xb>, has_dynamic_init = 136995445539840, gcc_location = 0x2f0, odr_indicator = 140727779090440}, {beg = 135414879003552, size = 140727779105520, size_with_redzone = 139812976524063, name = 0x1 <error: Cannot access memory at address 0x1>, module_name = 0x7b28bbc2a3a0 "", has_dynamic_init = 140727779107648, gcc_location = 0x7f28bedb95d2 <___interceptor_malloc(__sanitizer::uptr)+130>, odr_indicator = 139812952273104}, {beg = 132024671056, size = 140727779105568, size_with_redzone = 3, name = 0x7f28bedb9610 <___interceptor_malloc(__sanitizer::uptr)+192> "D\213\215\314\367\377\377E\205\311tTH\211m\330A\203\371\001t*E\017\276\3061\311H\211\352H\211\306H\215\275\320\367\377\377\350\"\004\001", module_name = 0x7f28be111b8f <__vasprintf_internal+255> "I\211\004$H\205\300t(H\213\265\330\376\377\377L\211\352H\211\307\350\366\032\371\377H\211\301\353\212\350\254\346\n", has_dynamic_init = 94514371921403, gcc_location = 0x7ffdbd48a600, odr_indicator = 140727779105760}, {beg = 2, size = 139812978196416, size_with_redzone = 135827214920752, name = 0x7ffdbd489bb0 "`\253H\275\375\177", module_name = 0x7f28becd5738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", has_dynamic_init = 62, gcc_location = 0x7b88bce56c30, odr_indicator = 139812952273104}}, reg_sites = {3175652304, 32765, 3169152064, 31624}, access_size = 81, size = 64 '@'}, wild = {addr = 136995445539851, access_size = 0}}}}, pc = 139812977226821, bp = 140727779109728, sp = 140727779107592, access_size = 6, bug_descr = 0x7f28bee21797 "heap-use-after-free", is_write = false, shadow_val = 253 '\375'}
#9 0x00007f28bedc5f8d in __asan::ReportGenericError (pc=<optimized out>, bp=bp@entry=140727779109728, sp=sp@entry=140727779107592, addr=addr@entry=136995445539851, is_write=is_write@entry=false, access_size=access_size@entry=6, exp=<optimized out>, fatal=false) at ../../../../src/libsanitizer/asan/asan_report.cpp:536
in_report = <optimized out>
error = <optimized out>
enable_fp = <optimized out>
#10 0x00007f28bed7b468 in MemcmpInterceptorCommon (ctx=ctx@entry=0x7ffdbd48ab70, real_fn=<optimized out>, a1=a1@entry=0x7c98bcde040b, a2=a2@entry=0x7b28bbb8aba0, size=size@entry=6) at ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:848
bp = 140727779109728
pc = <optimized out>
local_stack = 136651848155200
sp = 140727779107592
_ctx = 0x7ffdbd48ab70
suppressed = <optimized out>
__offset = 136995445539851
__size = 6
__bad = <optimized out>
result = <optimized out>
#11 0x00007f28bed7b835 in ___interceptor_memcmp (a1=0x7c98bcde040b, a2=0x7b28bbb8aba0, size=6) at ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:880
ctx = 0x7ffdbd48ab70
_ctx = {interceptor_name = 0x7f28bee256b6 "memcmp"}
#12 ___interceptor_memcmp (a1=0x7c98bcde040b, a2=0x7b28bbb8aba0, size=6) at ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:875
ctx = <optimized out>
_ctx = <optimized out>
#13 0x000055f5d77ec0c8 in bacmp (ba1=0x7c98bcde040b, ba2=0x7b28bbb8aba0) at ./lib/bluetooth/bluetooth.h:438
No locals.
#14 device_addr_type_cmp (a=0x7c98bcde0400, b=0x7b28bbb8aba0) at src/device.c:5657
dev = 0x7c98bcde0400
addr = 0x7b28bbb8aba0
cmp = <optimized out>
#15 0x00007f28beaf54c2 in g_slist_find_custom () from /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
No symbol table info available.
#16 0x000055f5d776b6f4 in btd_adapter_find_device (adapter=<optimized out>, dst=dst@entry=0x7b68bce23718, bdaddr_type=1 '\001') at src/adapter.c:1055
addr = <optimized out>
device = <optimized out>
list = <optimized out>
#17 0x000055f5d770dc07 in att_disconnected (err=<optimized out>, user_data=0x7b68bce23710) at src/gatt-database.c:335
state = 0x7b68bce23710
device = <optimized out>
__func__ = "att_disconnected"
#18 0x000055f5d7724b34 in btd_gatt_database_att_disconnected (database=<optimized out>, device=<optimized out>) at src/gatt-database.c:4238
server = <optimized out>
att = <optimized out>
state = <optimized out>
addr = <optimized out>
type = <optimized out>
__func__ = "btd_gatt_database_att_disconnected"
#19 0x000055f5d77ce176 in gatt_server_cleanup (device=device@entry=0x7c98bcde0080) at src/device.c:842
No locals.
#20 0x000055f5d77e286c in attio_cleanup (device=0x7c98bcde0080) at src/device.c:862
No locals.
#21 0x000055f5d77e2eb7 in device_free (user_data=0x7c98bcde0080) at src/device.c:918
device = 0x7c98bcde0080
__func__ = "device_free"
#22 0x000055f5d7860aca in remove_interface (data=0x7b98bcdeb000, name=name@entry=0x55f5d7a6da60 "org.bluez.Device1") at gdbus/object.c:742
iface = 0x7b88bcdfe380
#23 0x000055f5d786368c in g_dbus_unregister_interface (connection=<optimized out>, path=<optimized out>, name=<optimized out>) at gdbus/object.c:1499
data = <optimized out>
#24 0x000055f5d779e1b3 in adapter_remove (adapter=adapter@entry=0x7c58bcde0200) at src/adapter.c:7313
l = 0x7b48bce0b410 = {0x7c98bcde0080}
db = <optimized out>
ranging_manager = <optimized out>
__func__ = "adapter_remove"
#25 0x000055f5d779ed48 in adapter_cleanup () at src/adapter.c:11269
adapter = 0x7c58bcde0200
#26 0x000055f5d75502f0 in main (argc=<optimized out>, argv=<optimized out>) at src/main.c:1723
context = <optimized out>
err = <optimized out>
sdp_mtu = 0
sdp_flags = <optimized out>
gdbus_flags = <optimized out>
__func__ = "main""
FAIL functional.test_bap::test_bap_unicast_set_transport_created[hosts8-vm3-legacy]: failed on setup with "pytest_bluezenv.rpc.RemoteTimeoutError: Connection recv timed out"
FAIL functional.test_bap::test_bap_unicast_set_transport_created[hosts8-vm3-legacy]: failed on teardown with "pytest_bluezenv.plugin.CoredumpWarning: Core dump: test-bluezenv-hosts8.0-bluetoothd-1789853892-71.core
/usr/bin/gdb: warning: Couldn't determine a path for the index cache directory.
[New LWP 71]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/usr/lib/x86_64-linux-gnu/libthread_db.so.1".
Core was generated by `/home/runner/work/bluez/bluez/src/src/src/bluetoothd --nodetach -f /run/bluetoo'.
Program terminated with signal SIGABRT, Aborted.
#0 __pthread_kill_implementation (threadid=<optimized out>, signo=6, no_tid=0) at ./nptl/pthread_kill.c:44
warning: 44 ./nptl/pthread_kill.c: No such file or directory
Thread 1 (Thread 0x7fee5b681900 (LWP 71)):
#0 __pthread_kill_implementation (threadid=<optimized out>, signo=6, no_tid=0) at ./nptl/pthread_kill.c:44
tid = <optimized out>
ret = 0
pd = <optimized out>
old_mask = {__val = {4412750543122677053}}
ret = <optimized out>
#1 __pthread_kill_internal (threadid=<optimized out>, signo=6) at ./nptl/pthread_kill.c:89
No locals.
#2 __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ./nptl/pthread_kill.c:100
No locals.
#3 0x00007fee5bddcb7e in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
ret = <optimized out>
#4 0x00007fee5bdbf8ec in __GI_abort () at ./stdlib/abort.c:77
act = {__sigaction_handler = {sa_handler = 0x4, sa_sigaction = 0x4}, sa_mask = {__val = {136263628754736, 136263628754592, 5554232649383238400, 140734971594320, 140734971594608, 140734971594464, 22, 140661717109712, 0, 140734971594400, 140661733955094, 140661707767808, 4096, 0, 5554232649383238400, 140661708447768}}, sa_flags = 1561362432, sa_restorer = 0x16}
#5 0x00007fee5c9e7a0f in __sanitizer::Abort () at ../../../../src/libsanitizer/sanitizer_common/sanitizer_posix_libcdep.cpp:165
No locals.
#6 0x00007fee5cb0dc2d in __sanitizer::Die () at ../../../../src/libsanitizer/sanitizer_common/sanitizer_termination.cpp:58
No locals.
#7 0x00007fee5cae293c in __asan::ScopedInErrorReport::~ScopedInErrorReport (this=0x7fff69fd4816) at ../../../../src/libsanitizer/asan/asan_report.cpp:221
buffer_copy = {buffer_ = {<__sanitizer::InternalMmapVectorNoCtor<char, false>> = {data_ = 0x7fee5b200000 '=' <repeats 65 times>, "\n==71==ERROR: AddressSanitizer: heap-use-after-free on address 0x7d5e5aae0208 at pc 0x56335c98ff2c bp 0x7fff69fd5490 sp 0x7fff69fd5480\n"..., capacity_bytes_ = 4096, size_ = 3419}, <No data fields>}}
buffer_copy = <optimized out>
l = <optimized out>
#8 0x00007fee5cae1e02 in __asan::ReportGenericError (pc=94778596851500, bp=140734971597968, sp=sp@entry=140734971597952, addr=137844201751048, is_write=is_write@entry=false, access_size=8, fatal=true, exp=<optimized out>) at ../../../../src/libsanitizer/asan/asan_report.cpp:536
in_report = {error_report_lock_ = {<No data fields>}, static current_error_ = {kind = __asan::kErrorKindGeneric, {Base = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\356{\000\000\377\000\000\000\000\000\000\000\240w\306\\3V\000\000f\335\256\\\356\177\000\000\000I\375i\377\177\000\000\002\000\000\000\000\000\000\000\300?\270\\\356\177\000\000\220\372\256Zn|\000\000\320H\375i\377\177\000\0008\027\237\\\356\177\000\000^\000\000\000\000\000\000\000\220\372\256Zn|\000\000\320\260,[\356\177\000\000\360H\375i\377\177\000\000\240\372\256Zn|\000\000q\000\000\000\000\000\000\000`Q\375i\377\177\000\000^\000\000\000\000\000\000\000 Q\375i\377\177\000\000\301C\255\\\356\177\000\000\"\232\277\\3V\000\000\270\377\377\377"...}, tid = 0}, DeadlySignal = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\356{\000\000\377\000\000\000\000\000\000\000\240w\306\\3V\000\000f\335\256\\\356\177\000\000\000I\375i\377\177\000\000\002\000\000\000\000\000\000\000\300?\270\\\356\177\000\000\220\372\256Zn|\000\000\320H\375i\377\177\000\0008\027\237\\\356\177\000\000^\000\000\000\000\000\000\000\220\372\256Zn|\000\000\320\260,[\356\177\000\000\360H\375i\377\177\000\000\240\372\256Zn|\000\000q\000\000\000\000\000\000\000`Q\375i\377\177\000\000^\000\000\000\000\000\000\000 Q\375i\377\177\000\000\301C\255\\\356\177\000\000\"\232\277\\3V\000\000\270\377\377\377"...}, tid = 0}, signal = {siginfo = 0x7fff00000002, context = 0x7d5e5aae0208, addr = 0, pc = 0, sp = 11098195494391, bp = 137844201751048, is_memory_access = 136, write_flag = __sanitizer::SignalContext::Unknown, is_true_faulting_addr = 128}}, DoubleFree = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\356{\000\000\377\000\000\000\000\000\000\000\240w\306\\3V\000\000f\335\256\\\356\177\000\000\000I\375i\377\177\000\000\002\000\000\000\000\000\000\000\300?\270\\\356\177\000\000\220\372\256Zn|\000\000\320H\375i\377\177\000\0008\027\237\\\356\177\000\000^\000\000\000\000\000\000\000\220\372\256Zn|\000\000\320\260,[\356\177\000\000\360H\375i\377\177\000\000\240\372\256Zn|\000\000q\000\000\000\000\000\000\000`Q\375i\377\177\000\000^\000\000\000\000\000\000\000 Q\375i\377\177\000\000\301C\255\\\356\177\000\000\"\232\277\\3V\000\000\270\377\377\377"...}, tid = 0}, second_free_stack = 0x7fff00000002, addr_description = {addr = 137844201751048, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1527, free_stack_id = 2584, chunk_access = {bad_addr = 137844201751048, offset = 392, chunk_begin = 137844201750656, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}}, NewDeleteTypeMismatch = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\356{\000\000\377\000\000\000\000\000\000\000\240w\306\\3V\000\000f\335\256\\\356\177\000\000\000I\375i\377\177\000\000\002\000\000\000\000\000\000\000\300?\270\\\356\177\000\000\220\372\256Zn|\000\000\320H\375i\377\177\000\0008\027\237\\\356\177\000\000^\000\000\000\000\000\000\000\220\372\256Zn|\000\000\320\260,[\356\177\000\000\360H\375i\377\177\000\000\240\372\256Zn|\000\000q\000\000\000\000\000\000\000`Q\375i\377\177\000\000^\000\000\000\000\000\000\000 Q\375i\377\177\000\000\301C\255\\\356\177\000\000\"\232\277\\3V\000\000\270\377\377\377"...}, tid = 0}, free_stack = 0x7fff00000002, addr_description = {addr = 137844201751048, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1527, free_stack_id = 2584, chunk_access = {bad_addr = 137844201751048, offset = 392, chunk_begin = 137844201750656, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, delete_size = 140661732850463, delete_alignment = 1}, FreeNotMalloced = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\356{\000\000\377\000\000\000\000\000\000\000\240w\306\\3V\000\000f\335\256\\\356\177\000\000\000I\375i\377\177\000\000\002\000\000\000\000\000\000\000\300?\270\\\356\177\000\000\220\372\256Zn|\000\000\320H\375i\377\177\000\0008\027\237\\\356\177\000\000^\000\000\000\000\000\000\000\220\372\256Zn|\000\000\320\260,[\356\177\000\000\360H\375i\377\177\000\000\240\372\256Zn|\000\000q\000\000\000\000\000\000\000`Q\375i\377\177\000\000^\000\000\000\000\000\000\000 Q\375i\377\177\000\000\301C\255\\\356\177\000\000\"\232\277\\3V\000\000\270\377\377\377"...}, tid = 0}, free_stack = 0x7fff00000002, addr_description = {data = {kind = 1521353224, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11098195494391, alloc_stack_id = 1521353224, free_stack_id = 32094, chunk_access = {bad_addr = 392, offset = 137844201750656, chunk_begin = 752, chunk_size = 140734971600904, user_requested_alignment = 2847, access_type = 3, alloc_type = 2}}, stack = {addr = 0, tid = 0, offset = 11098195494391, frame_pc = 137844201751048, access_size = 392, frame_descr = 0x7d5e5aae0080 "\030\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11098195494391, size_with_redzone = 137844201751048, name = 0x188 <error: Cannot access memory at address 0x188>, module_name = 0x7d5e5aae0080 "\030\n", has_dynamic_init = 752, gcc_location = 0x7fff69fd6008, odr_indicator = 140661732850463}, {beg = 1, size = 137088287654912, size_with_redzone = 140734971598048, name = 0x7fee5cad55d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", module_name = 0x3 <error: Cannot access memory at address 0x3>, has_dynamic_init = 130378674176, gcc_location = 0x7fff69fd4cc0, odr_indicator = 2}, {beg = 140661733807632, size = 94778597410598, size_with_redzone = 140734971596144, name = 0x7 <error: Cannot access memory at address 0x7>, module_name = 0x7fee5cb83fc0 <__asan::instance> "", has_dynamic_init = 136401093805120, gcc_location = 0x7fff69fd4d40, odr_indicator = 140661733907814}, {beg = 140734971596192, size = 6, size_with_redzone = 140661734522816, name = 0x7cae5ab18370 "\003\021", module_name = 0x7fff69fd4d70 "\b", has_dynamic_init = 140661732874040, gcc_location = 0x78, odr_indicator = 137088287736688}}, reg_sites = {1778208096, 32767, 1542189422, 32750}, access_size = 0, size = 44 ','}, wild = {addr = 0, access_size = 0}}}}}, AllocTypeMismatch = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\356{\000\000\377\000\000\000\000\000\000\000\240w\306\\3V\000\000f\335\256\\\356\177\000\000\000I\375i\377\177\000\000\002\000\000\000\000\000\000\000\300?\270\\\356\177\000\000\220\372\256Zn|\000\000\320H\375i\377\177\000\0008\027\237\\\356\177\000\000^\000\000\000\000\000\000\000\220\372\256Zn|\000\000\320\260,[\356\177\000\000\360H\375i\377\177\000\000\240\372\256Zn|\000\000q\000\000\000\000\000\000\000`Q\375i\377\177\000\000^\000\000\000\000\000\000\000 Q\375i\377\177\000\000\301C\255\\\356\177\000\000\"\232\277\\3V\000\000\270\377\377\377"...}, tid = 0}, dealloc_stack = 0x7fff00000002, alloc_type = 1521353224, dealloc_type = 32094, addr_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 0, kind = (__asan::kShadowKindGap | __asan::kShadowKindHigh | unknown: 0xf4), shadow_byte = 5 '\005'}, heap = {addr = 0, alloc_tid = 11098195494391, free_tid = 137844201751048, alloc_stack_id = 392, free_stack_id = 0, chunk_access = {bad_addr = 137844201750656, offset = 752, chunk_begin = 140734971600904, chunk_size = 140661732850463, user_requested_alignment = 1, access_type = 0, alloc_type = 0}}, stack = {addr = 0, tid = 11098195494391, offset = 137844201751048, frame_pc = 392, access_size = 137844201750656, frame_descr = 0x2f0 <error: Cannot access memory at address 0x2f0>}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 11098195494391, size = 137844201751048, size_with_redzone = 392, name = 0x7d5e5aae0080 "\030\n", module_name = 0x2f0 <error: Cannot access memory at address 0x2f0>, has_dynamic_init = 140734971600904, gcc_location = 0x7fee5c9ebb1f <__asan::asan_malloc(unsigned long, __sanitizer::BufferedStackTrace*)+47>, odr_indicator = 1}, {beg = 137088287654912, size = 140734971598048, size_with_redzone = 140661733807570, name = 0x3 <error: Cannot access memory at address 0x3>, module_name = 0x1e5b2cb000 <error: Cannot access memory at address 0x1e5b2cb000>, has_dynamic_init = 140734971595968, gcc_location = 0x2, odr_indicator = 140661733807632}, {beg = 94778597410598, size = 140734971596144, size_with_redzone = 7, name = 0x7fee5cb83fc0 <__asan::instance> "", module_name = 0x7c0e5abe4440 "\003\021", has_dynamic_init = 140734971596096, gcc_location = 0x7fee5caedd66 <__sanitizer::RunFreeHooks(void*)+86>, odr_indicator = 140734971596192}, {beg = 6, size = 140661734522816, size_with_redzone = 137088287736688, name = 0x7fff69fd4d70 "\b", module_name = 0x7fee5c9f1738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", has_dynamic_init = 120, gcc_location = 0x7cae5ab18370, odr_indicator = 140734971596128}}, reg_sites = {1542189422, 32750, 0, 0}, access_size = 94778596851500, size = 144 '\220'}, wild = {addr = 0, access_size = 11098195494391}}}}}, MallocUsableSizeNotOwned = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\356{\000\000\377\000\000\000\000\000\000\000\240w\306\\3V\000\000f\335\256\\\356\177\000\000\000I\375i\377\177\000\000\002\000\000\000\000\000\000\000\300?\270\\\356\177\000\000\220\372\256Zn|\000\000\320H\375i\377\177\000\0008\027\237\\\356\177\000\000^\000\000\000\000\000\000\000\220\372\256Zn|\000\000\320\260,[\356\177\000\000\360H\375i\377\177\000\000\240\372\256Zn|\000\000q\000\000\000\000\000\000\000`Q\375i\377\177\000\000^\000\000\000\000\000\000\000 Q\375i\377\177\000\000\301C\255\\\356\177\000\000\"\232\277\\3V\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7fff00000002, addr_description = {data = {kind = 1521353224, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11098195494391, alloc_stack_id = 1521353224, free_stack_id = 32094, chunk_access = {bad_addr = 392, offset = 137844201750656, chunk_begin = 752, chunk_size = 140734971600904, user_requested_alignment = 2847, access_type = 3, alloc_type = 2}}, stack = {addr = 0, tid = 0, offset = 11098195494391, frame_pc = 137844201751048, access_size = 392, frame_descr = 0x7d5e5aae0080 "\030\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11098195494391, size_with_redzone = 137844201751048, name = 0x188 <error: Cannot access memory at address 0x188>, module_name = 0x7d5e5aae0080 "\030\n", has_dynamic_init = 752, gcc_location = 0x7fff69fd6008, odr_indicator = 140661732850463}, {beg = 1, size = 137088287654912, size_with_redzone = 140734971598048, name = 0x7fee5cad55d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", module_name = 0x3 <error: Cannot access memory at address 0x3>, has_dynamic_init = 130378674176, gcc_location = 0x7fff69fd4cc0, odr_indicator = 2}, {beg = 140661733807632, size = 94778597410598, size_with_redzone = 140734971596144, name = 0x7 <error: Cannot access memory at address 0x7>, module_name = 0x7fee5cb83fc0 <__asan::instance> "", has_dynamic_init = 136401093805120, gcc_location = 0x7fff69fd4d40, odr_indicator = 140661733907814}, {beg = 140734971596192, size = 6, size_with_redzone = 140661734522816, name = 0x7cae5ab18370 "\003\021", module_name = 0x7fff69fd4d70 "\b", has_dynamic_init = 140661732874040, gcc_location = 0x78, odr_indicator = 137088287736688}}, reg_sites = {1778208096, 32767, 1542189422, 32750}, access_size = 0, size = 44 ','}, wild = {addr = 0, access_size = 0}}}}}, SanitizerGetAllocatedSizeNotOwned = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\356{\000\000\377\000\000\000\000\000\000\000\240w\306\\3V\000\000f\335\256\\\356\177\000\000\000I\375i\377\177\000\000\002\000\000\000\000\000\000\000\300?\270\\\356\177\000\000\220\372\256Zn|\000\000\320H\375i\377\177\000\0008\027\237\\\356\177\000\000^\000\000\000\000\000\000\000\220\372\256Zn|\000\000\320\260,[\356\177\000\000\360H\375i\377\177\000\000\240\372\256Zn|\000\000q\000\000\000\000\000\000\000`Q\375i\377\177\000\000^\000\000\000\000\000\000\000 Q\375i\377\177\000\000\301C\255\\\356\177\000\000\"\232\277\\3V\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7fff00000002, addr_description = {data = {kind = 1521353224, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11098195494391, alloc_stack_id = 1521353224, free_stack_id = 32094, chunk_access = {bad_addr = 392, offset = 137844201750656, chunk_begin = 752, chunk_size = 140734971600904, user_requested_alignment = 2847, access_type = 3, alloc_type = 2}}, stack = {addr = 0, tid = 0, offset = 11098195494391, frame_pc = 137844201751048, access_size = 392, frame_descr = 0x7d5e5aae0080 "\030\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11098195494391, size_with_redzone = 137844201751048, name = 0x188 <error: Cannot access memory at address 0x188>, module_name = 0x7d5e5aae0080 "\030\n", has_dynamic_init = 752, gcc_location = 0x7fff69fd6008, odr_indicator = 140661732850463}, {beg = 1, size = 137088287654912, size_with_redzone = 140734971598048, name = 0x7fee5cad55d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", module_name = 0x3 <error: Cannot access memory at address 0x3>, has_dynamic_init = 130378674176, gcc_location = 0x7fff69fd4cc0, odr_indicator = 2}, {beg = 140661733807632, size = 94778597410598, size_with_redzone = 140734971596144, name = 0x7 <error: Cannot access memory at address 0x7>, module_name = 0x7fee5cb83fc0 <__asan::instance> "", has_dynamic_init = 136401093805120, gcc_location = 0x7fff69fd4d40, odr_indicator = 140661733907814}, {beg = 140734971596192, size = 6, size_with_redzone = 140661734522816, name = 0x7cae5ab18370 "\003\021", module_name = 0x7fff69fd4d70 "\b", has_dynamic_init = 140661732874040, gcc_location = 0x78, odr_indicator = 137088287736688}}, reg_sites = {1778208096, 32767, 1542189422, 32750}, access_size = 0, size = 44 ','}, wild = {addr = 0, access_size = 0}}}}}, CallocOverflow = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\356{\000\000\377\000\000\000\000\000\000\000\240w\306\\3V\000\000f\335\256\\\356\177\000\000\000I\375i\377\177\000\000\002\000\000\000\000\000\000\000\300?\270\\\356\177\000\000\220\372\256Zn|\000\000\320H\375i\377\177\000\0008\027\237\\\356\177\000\000^\000\000\000\000\000\000\000\220\372\256Zn|\000\000\320\260,[\356\177\000\000\360H\375i\377\177\000\000\240\372\256Zn|\000\000q\000\000\000\000\000\000\000`Q\375i\377\177\000\000^\000\000\000\000\000\000\000 Q\375i\377\177\000\000\301C\255\\\356\177\000\000\"\232\277\\3V\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7fff00000002, count = 137844201751048, size = 0}, ReallocArrayOverflow = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\356{\000\000\377\000\000\000\000\000\000\000\240w\306\\3V\000\000f\335\256\\\356\177\000\000\000I\375i\377\177\000\000\002\000\000\000\000\000\000\000\300?\270\\\356\177\000\000\220\372\256Zn|\000\000\320H\375i\377\177\000\0008\027\237\\\356\177\000\000^\000\000\000\000\000\000\000\220\372\256Zn|\000\000\320\260,[\356\177\000\000\360H\375i\377\177\000\000\240\372\256Zn|\000\000q\000\000\000\000\000\000\000`Q\375i\377\177\000\000^\000\000\000\000\000\000\000 Q\375i\377\177\000\000\301C\255\\\356\177\000\000\"\232\277\\3V\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7fff00000002, count = 137844201751048, size = 0}, PvallocOverflow = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\356{\000\000\377\000\000\000\000\000\000\000\240w\306\\3V\000\000f\335\256\\\356\177\000\000\000I\375i\377\177\000\000\002\000\000\000\000\000\000\000\300?\270\\\356\177\000\000\220\372\256Zn|\000\000\320H\375i\377\177\000\0008\027\237\\\356\177\000\000^\000\000\000\000\000\000\000\220\372\256Zn|\000\000\320\260,[\356\177\000\000\360H\375i\377\177\000\000\240\372\256Zn|\000\000q\000\000\000\000\000\000\000`Q\375i\377\177\000\000^\000\000\000\000\000\000\000 Q\375i\377\177\000\000\301C\255\\\356\177\000\000\"\232\277\\3V\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7fff00000002, size = 137844201751048}, InvalidAllocationAlignment = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\356{\000\000\377\000\000\000\000\000\000\000\240w\306\\3V\000\000f\335\256\\\356\177\000\000\000I\375i\377\177\000\000\002\000\000\000\000\000\000\000\300?\270\\\356\177\000\000\220\372\256Zn|\000\000\320H\375i\377\177\000\0008\027\237\\\356\177\000\000^\000\000\000\000\000\000\000\220\372\256Zn|\000\000\320\260,[\356\177\000\000\360H\375i\377\177\000\000\240\372\256Zn|\000\000q\000\000\000\000\000\000\000`Q\375i\377\177\000\000^\000\000\000\000\000\000\000 Q\375i\377\177\000\000\301C\255\\\356\177\000\000\"\232\277\\3V\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7fff00000002, alignment = 137844201751048}, InvalidAlignedAllocAlignment = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\356{\000\000\377\000\000\000\000\000\000\000\240w\306\\3V\000\000f\335\256\\\356\177\000\000\000I\375i\377\177\000\000\002\000\000\000\000\000\000\000\300?\270\\\356\177\000\000\220\372\256Zn|\000\000\320H\375i\377\177\000\0008\027\237\\\356\177\000\000^\000\000\000\000\000\000\000\220\372\256Zn|\000\000\320\260,[\356\177\000\000\360H\375i\377\177\000\000\240\372\256Zn|\000\000q\000\000\000\000\000\000\000`Q\375i\377\177\000\000^\000\000\000\000\000\000\000 Q\375i\377\177\000\000\301C\255\\\356\177\000\000\"\232\277\\3V\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7fff00000002, size = 137844201751048, alignment = 0}, InvalidPosixMemalignAlignment = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\356{\000\000\377\000\000\000\000\000\000\000\240w\306\\3V\000\000f\335\256\\\356\177\000\000\000I\375i\377\177\000\000\002\000\000\000\000\000\000\000\300?\270\\\356\177\000\000\220\372\256Zn|\000\000\320H\375i\377\177\000\0008\027\237\\\356\177\000\000^\000\000\000\000\000\000\000\220\372\256Zn|\000\000\320\260,[\356\177\000\000\360H\375i\377\177\000\000\240\372\256Zn|\000\000q\000\000\000\000\000\000\000`Q\375i\377\177\000\000^\000\000\000\000\000\000\000 Q\375i\377\177\000\000\301C\255\\\356\177\000\000\"\232\277\\3V\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7fff00000002, alignment = 137844201751048}, AllocationSizeTooBig = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\356{\000\000\377\000\000\000\000\000\000\000\240w\306\\3V\000\000f\335\256\\\356\177\000\000\000I\375i\377\177\000\000\002\000\000\000\000\000\000\000\300?\270\\\356\177\000\000\220\372\256Zn|\000\000\320H\375i\377\177\000\0008\027\237\\\356\177\000\000^\000\000\000\000\000\000\000\220\372\256Zn|\000\000\320\260,[\356\177\000\000\360H\375i\377\177\000\000\240\372\256Zn|\000\000q\000\000\000\000\000\000\000`Q\375i\377\177\000\000^\000\000\000\000\000\000\000 Q\375i\377\177\000\000\301C\255\\\356\177\000\000\"\232\277\\3V\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7fff00000002, user_size = 137844201751048, total_size = 0, max_size = 0}, RssLimitExceeded = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\356{\000\000\377\000\000\000\000\000\000\000\240w\306\\3V\000\000f\335\256\\\356\177\000\000\000I\375i\377\177\000\000\002\000\000\000\000\000\000\000\300?\270\\\356\177\000\000\220\372\256Zn|\000\000\320H\375i\377\177\000\0008\027\237\\\356\177\000\000^\000\000\000\000\000\000\000\220\372\256Zn|\000\000\320\260,[\356\177\000\000\360H\375i\377\177\000\000\240\372\256Zn|\000\000q\000\000\000\000\000\000\000`Q\375i\377\177\000\000^\000\000\000\000\000\000\000 Q\375i\377\177\000\000\301C\255\\\356\177\000\000\"\232\277\\3V\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7fff00000002}, OutOfMemory = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\356{\000\000\377\000\000\000\000\000\000\000\240w\306\\3V\000\000f\335\256\\\356\177\000\000\000I\375i\377\177\000\000\002\000\000\000\000\000\000\000\300?\270\\\356\177\000\000\220\372\256Zn|\000\000\320H\375i\377\177\000\0008\027\237\\\356\177\000\000^\000\000\000\000\000\000\000\220\372\256Zn|\000\000\320\260,[\356\177\000\000\360H\375i\377\177\000\000\240\372\256Zn|\000\000q\000\000\000\000\000\000\000`Q\375i\377\177\000\000^\000\000\000\000\000\000\000 Q\375i\377\177\000\000\301C\255\\\356\177\000\000\"\232\277\\3V\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7fff00000002, requested_size = 137844201751048}, StringFunctionMemoryRangesOverlap = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\356{\000\000\377\000\000\000\000\000\000\000\240w\306\\3V\000\000f\335\256\\\356\177\000\000\000I\375i\377\177\000\000\002\000\000\000\000\000\000\000\300?\270\\\356\177\000\000\220\372\256Zn|\000\000\320H\375i\377\177\000\0008\027\237\\\356\177\000\000^\000\000\000\000\000\000\000\220\372\256Zn|\000\000\320\260,[\356\177\000\000\360H\375i\377\177\000\000\240\372\256Zn|\000\000q\000\000\000\000\000\000\000`Q\375i\377\177\000\000^\000\000\000\000\000\000\000 Q\375i\377\177\000\000\301C\255\\\356\177\000\000\"\232\277\\3V\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7fff00000002, length1 = 137844201751048, length2 = 0, addr1_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 11098195494391, kind = (unknown: 0x8), shadow_byte = 2 '\002'}, heap = {addr = 11098195494391, alloc_tid = 137844201751048, free_tid = 392, alloc_stack_id = 1521352832, free_stack_id = 32094, chunk_access = {bad_addr = 752, offset = 140734971600904, chunk_begin = 140661732850463, chunk_size = 1, user_requested_alignment = 1024, access_type = 0, alloc_type = 1}}, stack = {addr = 11098195494391, tid = 137844201751048, offset = 392, frame_pc = 137844201750656, access_size = 752, frame_descr = 0x7fff69fd6008 "\027"}, global = {addr = 11098195494391, static kMaxGlobals = 4, globals = {{beg = 137844201751048, size = 392, size_with_redzone = 137844201750656, name = 0x2f0 <error: Cannot access memory at address 0x2f0>, module_name = 0x7fff69fd6008 "\027", has_dynamic_init = 140661732850463, gcc_location = 0x1, odr_indicator = 137088287654912}, {beg = 140734971598048, size = 140661733807570, size_with_redzone = 3, name = 0x1e5b2cb000 <error: Cannot access memory at address 0x1e5b2cb000>, module_name = 0x7fff69fd4cc0 "\020V\255\\\356\177", has_dynamic_init = 2, gcc_location = 0x7fee5cad5610 <___interceptor_malloc(__sanitizer::uptr)+192>, odr_indicator = 94778597410598}, {beg = 140734971596144, size = 7, size_with_redzone = 140661734522816, name = 0x7c0e5abe4440 "\003\021", module_name = 0x7fff69fd4d40 "`M\375i\377\177", has_dynamic_init = 140661733907814, gcc_location = 0x7fff69fd4da0, odr_indicator = 6}, {beg = 140661734522816, size = 137088287736688, size_with_redzone = 140734971596144, name = 0x7fee5c9f1738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", module_name = 0x78 <error: Cannot access memory at address 0x78>, has_dynamic_init = 137088287736688, gcc_location = 0x7fff69fd4d60, odr_indicator = 140661721133422}}, reg_sites = {0, 0, 1553530668, 22067}, access_size = 140734971597968, size = 128 '\200'}, wild = {addr = 11098195494391, access_size = 137844201751048}}}}, addr2_description = {data = {kind = 8, {shadow = {addr = 140661734234007, kind = __asan::kShadowKindLow, shadow_byte = 253 '\375'}, heap = {addr = 140661734234007, alloc_tid = 140661730770176, free_tid = 140734971597616, alloc_stack_id = 1554651347, free_stack_id = 32750, chunk_access = {bad_addr = 140734971597616, offset = 1552026168, chunk_begin = 140734971597712, chunk_size = 140661730750038, user_requested_alignment = 384, access_type = 0, alloc_type = 0}}, stack = {addr = 140661734234007, tid = 140661730770176, offset = 140734971597616, frame_pc = 140661733595347, access_size = 140734971597616, frame_descr = 0x5c820a38 <error: Cannot access memory at address 0x5c820a38>}, global = {addr = 140661734234007, static kMaxGlobals = 4, globals = {{beg = 140661730770176, size = 140734971597616, size_with_redzone = 140661733595347, name = 0x7fff69fd5330 "\200\001\256Z\376|", module_name = 0x5c820a38 <error: Cannot access memory at address 0x5c820a38>, has_dynamic_init = 140734971597712, gcc_location = 0x7fee5c7eae56, odr_indicator = 137431884890496}, {beg = 140661730749988, size = 140734971597664, size_with_redzone = 7002318047904, name = 0x23 <error: Cannot access memory at address 0x23>, module_name = 0x2e8773f6 <error: Cannot access memory at address 0x2e8773f6>, has_dynamic_init = 140734971597696, gcc_location = 0x7c4e5aae0aa0, odr_indicator = 140734971597728}, {beg = 137088287736704, size = 137431884890496, size_with_redzone = 136538532162064, name = 0x56335cb70800 <watch_destroy> "\363\017\036\372SH\211\373H\203\354\020H\205\377\017\2049\002", module_name = 0x7fee5c84fdce "I\211\305L9\360tJH\205\300tUH\213E\310dH+\004%(", has_dynamic_init = 137088287736704, gcc_location = 0x7fee5c84fdce, odr_indicator = 94778598819840}, {beg = 0, size = 140734971597824, size_with_redzone = 140661731163598, name = 0x7cee5aae0f40 "\001", module_name = 0x7c2e5aaf84d0 "\002", has_dynamic_init = 44, gcc_location = 0x0, odr_indicator = 136538531792088}}, reg_sites = {1521822248, 31790, 1521452272, 31790}, access_size = 94778598821710, size = 16 '\020'}, wild = {addr = 140661734234007, access_size = 140661730770176}}}}, function = 0x4d14992ac25d5b00 <error: Cannot access memory at address 0x4d14992ac25d5b00>}, StringFunctionSizeOverflow = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\356{\000\000\377\000\000\000\000\000\000\000\240w\306\\3V\000\000f\335\256\\\356\177\000\000\000I\375i\377\177\000\000\002\000\000\000\000\000\000\000\300?\270\\\356\177\000\000\220\372\256Zn|\000\000\320H\375i\377\177\000\0008\027\237\\\356\177\000\000^\000\000\000\000\000\000\000\220\372\256Zn|\000\000\320\260,[\356\177\000\000\360H\375i\377\177\000\000\240\372\256Zn|\000\000q\000\000\000\000\000\000\000`Q\375i\377\177\000\000^\000\000\000\000\000\000\000 Q\375i\377\177\000\000\301C\255\\\356\177\000\000\"\232\277\\3V\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7fff00000002, addr_description = {data = {kind = 1521353224, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11098195494391, alloc_stack_id = 1521353224, free_stack_id = 32094, chunk_access = {bad_addr = 392, offset = 137844201750656, chunk_begin = 752, chunk_size = 140734971600904, user_requested_alignment = 2847, access_type = 3, alloc_type = 2}}, stack = {addr = 0, tid = 0, offset = 11098195494391, frame_pc = 137844201751048, access_size = 392, frame_descr = 0x7d5e5aae0080 "\030\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11098195494391, size_with_redzone = 137844201751048, name = 0x188 <error: Cannot access memory at address 0x188>, module_name = 0x7d5e5aae0080 "\030\n", has_dynamic_init = 752, gcc_location = 0x7fff69fd6008, odr_indicator = 140661732850463}, {beg = 1, size = 137088287654912, size_with_redzone = 140734971598048, name = 0x7fee5cad55d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", module_name = 0x3 <error: Cannot access memory at address 0x3>, has_dynamic_init = 130378674176, gcc_location = 0x7fff69fd4cc0, odr_indicator = 2}, {beg = 140661733807632, size = 94778597410598, size_with_redzone = 140734971596144, name = 0x7 <error: Cannot access memory at address 0x7>, module_name = 0x7fee5cb83fc0 <__asan::instance> "", has_dynamic_init = 136401093805120, gcc_location = 0x7fff69fd4d40, odr_indicator = 140661733907814}, {beg = 140734971596192, size = 6, size_with_redzone = 140661734522816, name = 0x7cae5ab18370 "\003\021", module_name = 0x7fff69fd4d70 "\b", has_dynamic_init = 140661732874040, gcc_location = 0x78, odr_indicator = 137088287736688}}, reg_sites = {1778208096, 32767, 1542189422, 32750}, access_size = 0, size = 44 ','}, wild = {addr = 0, access_size = 0}}}}, size = 140734971597968}, BadParamsToAnnotateContiguousContainer = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\356{\000\000\377\000\000\000\000\000\000\000\240w\306\\3V\000\000f\335\256\\\356\177\000\000\000I\375i\377\177\000\000\002\000\000\000\000\000\000\000\300?\270\\\356\177\000\000\220\372\256Zn|\000\000\320H\375i\377\177\000\0008\027\237\\\356\177\000\000^\000\000\000\000\000\000\000\220\372\256Zn|\000\000\320\260,[\356\177\000\000\360H\375i\377\177\000\000\240\372\256Zn|\000\000q\000\000\000\000\000\000\000`Q\375i\377\177\000\000^\000\000\000\000\000\000\000 Q\375i\377\177\000\000\301C\255\\\356\177\000\000\"\232\277\\3V\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7fff00000002, beg = 137844201751048, end = 0, old_mid = 0, new_mid = 11098195494391}, BadParamsToAnnotateDoubleEndedContiguousContainer = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\356{\000\000\377\000\000\000\000\000\000\000\240w\306\\3V\000\000f\335\256\\\356\177\000\000\000I\375i\377\177\000\000\002\000\000\000\000\000\000\000\300?\270\\\356\177\000\000\220\372\256Zn|\000\000\320H\375i\377\177\000\0008\027\237\\\356\177\000\000^\000\000\000\000\000\000\000\220\372\256Zn|\000\000\320\260,[\356\177\000\000\360H\375i\377\177\000\000\240\372\256Zn|\000\000q\000\000\000\000\000\000\000`Q\375i\377\177\000\000^\000\000\000\000\000\000\000 Q\375i\377\177\000\000\301C\255\\\356\177\000\000\"\232\277\\3V\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7fff00000002, storage_beg = 137844201751048, storage_end = 0, old_container_beg = 0, old_container_end = 11098195494391, new_container_beg = 137844201751048, new_container_end = 392}, BadParamsToCopyContiguousContainerAnnotations = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\356{\000\000\377\000\000\000\000\000\000\000\240w\306\\3V\000\000f\335\256\\\356\177\000\000\000I\375i\377\177\000\000\002\000\000\000\000\000\000\000\300?\270\\\356\177\000\000\220\372\256Zn|\000\000\320H\375i\377\177\000\0008\027\237\\\356\177\000\000^\000\000\000\000\000\000\000\220\372\256Zn|\000\000\320\260,[\356\177\000\000\360H\375i\377\177\000\000\240\372\256Zn|\000\000q\000\000\000\000\000\000\000`Q\375i\377\177\000\000^\000\000\000\000\000\000\000 Q\375i\377\177\000\000\301C\255\\\356\177\000\000\"\232\277\\3V\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7fff00000002, old_storage_beg = 137844201751048, old_storage_end = 0, new_storage_beg = 0, new_storage_end = 11098195494391}, ODRViolation = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\356{\000\000\377\000\000\000\000\000\000\000\240w\306\\3V\000\000f\335\256\\\356\177\000\000\000I\375i\377\177\000\000\002\000\000\000\000\000\000\000\300?\270\\\356\177\000\000\220\372\256Zn|\000\000\320H\375i\377\177\000\0008\027\237\\\356\177\000\000^\000\000\000\000\000\000\000\220\372\256Zn|\000\000\320\260,[\356\177\000\000\360H\375i\377\177\000\000\240\372\256Zn|\000\000q\000\000\000\000\000\000\000`Q\375i\377\177\000\000^\000\000\000\000\000\000\000 Q\375i\377\177\000\000\301C\255\\\356\177\000\000\"\232\277\\3V\000\000\270\377\377\377"...}, tid = 0}, global1 = {beg = 140733193388034, size = 137844201751048, size_with_redzone = 0, name = 0x0, module_name = 0xa18000005f7 <error: Cannot access memory at address 0xa18000005f7>, has_dynamic_init = 137844201751048, gcc_location = 0x188, odr_indicator = 137844201750656}, global2 = {beg = 752, size = 140734971600904, size_with_redzone = 140661732850463, name = 0x1 <error: Cannot access memory at address 0x1>, module_name = 0x7cae5ab04400 "\200\a\256Z^}", has_dynamic_init = 140734971598048, gcc_location = 0x7fee5cad55d2 <___interceptor_malloc(__sanitizer::uptr)+130>, odr_indicator = 3}, stack_id1 = 1529655296, stack_id2 = 30}, InvalidPointerPair = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\356{\000\000\377\000\000\000\000\000\000\000\240w\306\\3V\000\000f\335\256\\\356\177\000\000\000I\375i\377\177\000\000\002\000\000\000\000\000\000\000\300?\270\\\356\177\000\000\220\372\256Zn|\000\000\320H\375i\377\177\000\0008\027\237\\\356\177\000\000^\000\000\000\000\000\000\000\220\372\256Zn|\000\000\320\260,[\356\177\000\000\360H\375i\377\177\000\000\240\372\256Zn|\000\000q\000\000\000\000\000\000\000`Q\375i\377\177\000\000^\000\000\000\000\000\000\000 Q\375i\377\177\000\000\301C\255\\\356\177\000\000\"\232\277\\3V\000\000\270\377\377\377"...}, tid = 0}, pc = 140733193388034, bp = 137844201751048, sp = 0, addr1_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 11098195494391, kind = (unknown: 0x8), shadow_byte = 2 '\002'}, heap = {addr = 11098195494391, alloc_tid = 137844201751048, free_tid = 392, alloc_stack_id = 1521352832, free_stack_id = 32094, chunk_access = {bad_addr = 752, offset = 140734971600904, chunk_begin = 140661732850463, chunk_size = 1, user_requested_alignment = 1024, access_type = 0, alloc_type = 1}}, stack = {addr = 11098195494391, tid = 137844201751048, offset = 392, frame_pc = 137844201750656, access_size = 752, frame_descr = 0x7fff69fd6008 "\027"}, global = {addr = 11098195494391, static kMaxGlobals = 4, globals = {{beg = 137844201751048, size = 392, size_with_redzone = 137844201750656, name = 0x2f0 <error: Cannot access memory at address 0x2f0>, module_name = 0x7fff69fd6008 "\027", has_dynamic_init = 140661732850463, gcc_location = 0x1, odr_indicator = 137088287654912}, {beg = 140734971598048, size = 140661733807570, size_with_redzone = 3, name = 0x1e5b2cb000 <error: Cannot access memory at address 0x1e5b2cb000>, module_name = 0x7fff69fd4cc0 "\020V\255\\\356\177", has_dynamic_init = 2, gcc_location = 0x7fee5cad5610 <___interceptor_malloc(__sanitizer::uptr)+192>, odr_indicator = 94778597410598}, {beg = 140734971596144, size = 7, size_with_redzone = 140661734522816, name = 0x7c0e5abe4440 "\003\021", module_name = 0x7fff69fd4d40 "`M\375i\377\177", has_dynamic_init = 140661733907814, gcc_location = 0x7fff69fd4da0, odr_indicator = 6}, {beg = 140661734522816, size = 137088287736688, size_with_redzone = 140734971596144, name = 0x7fee5c9f1738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", module_name = 0x78 <error: Cannot access memory at address 0x78>, has_dynamic_init = 137088287736688, gcc_location = 0x7fff69fd4d60, odr_indicator = 140661721133422}}, reg_sites = {0, 0, 1553530668, 22067}, access_size = 140734971597968, size = 128 '\200'}, wild = {addr = 11098195494391, access_size = 137844201751048}}}}, addr2_description = {data = {kind = 8, {shadow = {addr = 140661734234007, kind = __asan::kShadowKindLow, shadow_byte = 253 '\375'}, heap = {addr = 140661734234007, alloc_tid = 140661730770176, free_tid = 140734971597616, alloc_stack_id = 1554651347, free_stack_id = 32750, chunk_access = {bad_addr = 140734971597616, offset = 1552026168, chunk_begin = 140734971597712, chunk_size = 140661730750038, user_requested_alignment = 384, access_type = 0, alloc_type = 0}}, stack = {addr = 140661734234007, tid = 140661730770176, offset = 140734971597616, frame_pc = 140661733595347, access_size = 140734971597616, frame_descr = 0x5c820a38 <error: Cannot access memory at address 0x5c820a38>}, global = {addr = 140661734234007, static kMaxGlobals = 4, globals = {{beg = 140661730770176, size = 140734971597616, size_with_redzone = 140661733595347, name = 0x7fff69fd5330 "\200\001\256Z\376|", module_name = 0x5c820a38 <error: Cannot access memory at address 0x5c820a38>, has_dynamic_init = 140734971597712, gcc_location = 0x7fee5c7eae56, odr_indicator = 137431884890496}, {beg = 140661730749988, size = 140734971597664, size_with_redzone = 7002318047904, name = 0x23 <error: Cannot access memory at address 0x23>, module_name = 0x2e8773f6 <error: Cannot access memory at address 0x2e8773f6>, has_dynamic_init = 140734971597696, gcc_location = 0x7c4e5aae0aa0, odr_indicator = 140734971597728}, {beg = 137088287736704, size = 137431884890496, size_with_redzone = 136538532162064, name = 0x56335cb70800 <watch_destroy> "\363\017\036\372SH\211\373H\203\354\020H\205\377\017\2049\002", module_name = 0x7fee5c84fdce "I\211\305L9\360tJH\205\300tUH\213E\310dH+\004%(", has_dynamic_init = 137088287736704, gcc_location = 0x7fee5c84fdce, odr_indicator = 94778598819840}, {beg = 0, size = 140734971597824, size_with_redzone = 140661731163598, name = 0x7cee5aae0f40 "\001", module_name = 0x7c2e5aaf84d0 "\002", has_dynamic_init = 44, gcc_location = 0x0, odr_indicator = 136538531792088}}, reg_sites = {1521822248, 31790, 1521452272, 31790}, access_size = 94778598821710, size = 16 '\020'}, wild = {addr = 140661734234007, access_size = 140661730770176}}}}}, Generic = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\356{\000\000\377\000\000\000\000\000\000\000\240w\306\\3V\000\000f\335\256\\\356\177\000\000\000I\375i\377\177\000\000\002\000\000\000\000\000\000\000\300?\270\\\356\177\000\000\220\372\256Zn|\000\000\320H\375i\377\177\000\0008\027\237\\\356\177\000\000^\000\000\000\000\000\000\000\220\372\256Zn|\000\000\320\260,[\356\177\000\000\360H\375i\377\177\000\000\240\372\256Zn|\000\000q\000\000\000\000\000\000\000`Q\375i\377\177\000\000^\000\000\000\000\000\000\000 Q\375i\377\177\000\000\301C\255\\\356\177\000\000\"\232\277\\3V\000\000\270\377\377\377"...}, tid = 0}, addr_description = {data = {kind = __asan::kAddressKindHeap, {shadow = {addr = 137844201751048, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 137844201751048, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1527, free_stack_id = 2584, chunk_access = {bad_addr = 137844201751048, offset = 392, chunk_begin = 137844201750656, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, stack = {addr = 137844201751048, tid = 0, offset = 0, frame_pc = 11098195494391, access_size = 137844201751048, frame_descr = 0x188 <error: Cannot access memory at address 0x188>}, global = {addr = 137844201751048, static kMaxGlobals = 4, globals = {{beg = 0, size = 0, size_with_redzone = 11098195494391, name = 0x7d5e5aae0208 "", module_name = 0x188 <error: Cannot access memory at address 0x188>, has_dynamic_init = 137844201750656, gcc_location = 0x2f0, odr_indicator = 140734971600904}, {beg = 140661732850463, size = 1, size_with_redzone = 137088287654912, name = 0x7fff69fd54e0 "\320\201\203\\3V", module_name = 0x7fee5cad55d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", has_dynamic_init = 3, gcc_location = 0x1e5b2cb000, odr_indicator = 140734971595968}, {beg = 2, size = 140661733807632, size_with_redzone = 94778597410598, name = 0x7fff69fd4d70 "\b", module_name = 0x7 <error: Cannot access memory at address 0x7>, has_dynamic_init = 140661734522816, gcc_location = 0x7c0e5abe4440, odr_indicator = 140734971596096}, {beg = 140661733907814, size = 140734971596192, size_with_redzone = 6, name = 0x7fee5cb83fc0 <__asan::instance> "", module_name = 0x7cae5ab18370 "\003\021", has_dynamic_init = 140734971596144, gcc_location = 0x7fee5c9f1738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248>, odr_indicator = 120}}, reg_sites = {1521582960, 31918, 1778208096, 32767}, access_size = 140661721133422, size = 0 '\000'}, wild = {addr = 137844201751048, access_size = 0}}}}, pc = 94778596851500, bp = 140734971597968, sp = 140734971597952, access_size = 8, bug_descr = 0x7fee5cb3d797 "heap-use-after-free", is_write = false, shadow_val = 253 '\375'}}}, halt_on_error_ = true}
error = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\356{\000\000\377\000\000\000\000\000\000\000\240w\306\\3V\000\000f\335\256\\\356\177\000\000\000I\375i\377\177\000\000\002\000\000\000\000\000\000\000\300?\270\\\356\177\000\000\220\372\256Zn|\000\000\320H\375i\377\177\000\0008\027\237\\\356\177\000\000^\000\000\000\000\000\000\000\220\372\256Zn|\000\000\320\260,[\356\177\000\000\360H\375i\377\177\000\000\240\372\256Zn|\000\000q\000\000\000\000\000\000\000`Q\375i\377\177\000\000^\000\000\000\000\000\000\000 Q\375i\377\177\000\000\301C\255\\\356\177\000\000\"\232\277\\3V\000\000\270\377\377\377"...}, tid = 0}, addr_description = {data = {kind = __asan::kAddressKindHeap, {shadow = {addr = 137844201751048, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 137844201751048, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1527, free_stack_id = 2584, chunk_access = {bad_addr = 137844201751048, offset = 392, chunk_begin = 137844201750656, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, stack = {addr = 137844201751048, tid = 0, offset = 0, frame_pc = 11098195494391, access_size = 137844201751048, frame_descr = 0x188 <error: Cannot access memory at address 0x188>}, global = {addr = 137844201751048, static kMaxGlobals = 4, globals = {{beg = 0, size = 0, size_with_redzone = 11098195494391, name = 0x7d5e5aae0208 "", module_name = 0x188 <error: Cannot access memory at address 0x188>, has_dynamic_init = 137844201750656, gcc_location = 0x2f0, odr_indicator = 140734971600904}, {beg = 140661732850463, size = 1, size_with_redzone = 137088287654912, name = 0x7fff69fd54e0 "\320\201\203\\3V", module_name = 0x7fee5cad55d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", has_dynamic_init = 3, gcc_location = 0x1e5b2cb000, odr_indicator = 140734971595968}, {beg = 2, size = 140661733807632, size_with_redzone = 94778597410598, name = 0x7fff69fd4d70 "\b", module_name = 0x7 <error: Cannot access memory at address 0x7>, has_dynamic_init = 140661734522816, gcc_location = 0x7c0e5abe4440, odr_indicator = 140734971596096}, {beg = 140661733907814, size = 140734971596192, size_with_redzone = 6, name = 0x7fee5cb83fc0 <__asan::instance> "", module_name = 0x7cae5ab18370 "\003\021", has_dynamic_init = 140734971596144, gcc_location = 0x7fee5c9f1738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248>, odr_indicator = 120}}, reg_sites = {1521582960, 31918, 1778208096, 32767}, access_size = 140661721133422, size = 0 '\000'}, wild = {addr = 137844201751048, access_size = 0}}}}, pc = 94778596851500, bp = 140734971597968, sp = 140734971597952, access_size = 8, bug_descr = 0x7fee5cb3d797 "heap-use-after-free", is_write = false, shadow_val = 253 '\375'}
#9 0x00007fee5cae1f8d in __asan::ReportGenericError (pc=<optimized out>, bp=bp@entry=140734971597968, sp=sp@entry=140734971597952, addr=<optimized out>, is_write=is_write@entry=false, access_size=access_size@entry=8, exp=<optimized out>, fatal=true) at ../../../../src/libsanitizer/asan/asan_report.cpp:536
in_report = <optimized out>
error = <optimized out>
enable_fp = <optimized out>
#10 0x00007fee5cae33f9 in __asan::__asan_report_load8 (addr=<optimized out>) at ../../../../src/libsanitizer/asan/asan_rtl.cpp:131
bp = 140734971597968
pc = <optimized out>
local_stack = 140734971598080
sp = 140734971597952
#11 0x000056335c98ff2c in device_get_adapter (device=<optimized out>) at src/device.c:6917
No locals.
#12 0x000056335c83820f in find_cig_session (data=0x7cae5ab0ba80, match_data=0x7bee59984d30) at profiles/audio/bap.c:2500
session = 0x7cae5ab0ba80
info = 0x7bee59984d30
#13 0x000056335ca17101 in queue_find (queue=<optimized out>, function=function@entry=0x56335c8381d0 <find_cig_session>, match_data=match_data@entry=0x7bee59984d30) at src/shared/queue.c:230
entry = 0x7c0e5ab98ef0
#14 0x000056335c83ecd4 in find_cig_enumerate (data=0x7cae5ab04400) at profiles/audio/bap.c:2539
info = <optimized out>
#15 bap_update_cigs_cb (user_data=0x7cae5ab04400) at profiles/audio/bap.c:2688
data = 0x7cae5ab04400
cigs = <optimized out>
unset = <optimized out>
#16 0x00007fee5c7edb9b in ?? () from /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
No symbol table info available.
#17 0x00007fee5c7ef1d7 in ?? () from /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
No symbol table info available.
#18 0x00007fee5c7ef577 in g_main_loop_run () from /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
No symbol table info available.
#19 0x000056335cb73029 in mainloop_run () at src/shared/mainloop-glib.c:65
No locals.
#20 0x000056335cb7395b in mainloop_run_with_signal (func=func@entry=0x56335c9d8a60 <signal_callback>, user_data=user_data@entry=0x0) at src/shared/mainloop-notify.c:196
data = 0x7c1e5aae3490
io = 0x7c2e5aaf9b10
ret = <optimized out>
#21 0x000056335c6f12cb in main (argc=<optimized out>, argv=<optimized out>) at src/main.c:1713
context = <optimized out>
err = <optimized out>
sdp_mtu = 0
sdp_flags = <optimized out>
gdbus_flags = <optimized out>
__func__ = "main""
FAIL functional.test_bap::test_bap_unicast_set_transport_acquire[hosts8-vm3]: failed on teardown with "pytest_bluezenv.plugin.CoredumpWarning: Core dump: test-bluezenv-hosts8.0-bluetoothd-1789853946-90.core
/usr/bin/gdb: warning: Couldn't determine a path for the index cache directory.
[New LWP 90]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/usr/lib/x86_64-linux-gnu/libthread_db.so.1".
Core was generated by `/home/runner/work/bluez/bluez/src/src/src/bluetoothd --nodetach -f /run/bluetoo'.
Program terminated with signal SIGABRT, Aborted.
#0 __pthread_kill_implementation (threadid=<optimized out>, signo=6, no_tid=0) at ./nptl/pthread_kill.c:44
warning: 44 ./nptl/pthread_kill.c: No such file or directory
Thread 1 (Thread 0x7ff45e78d900 (LWP 90)):
#0 __pthread_kill_implementation (threadid=<optimized out>, signo=6, no_tid=0) at ./nptl/pthread_kill.c:44
tid = <optimized out>
ret = 0
pd = <optimized out>
old_mask = {__val = {4412750543122677053}}
ret = <optimized out>
#1 __pthread_kill_internal (threadid=<optimized out>, signo=6) at ./nptl/pthread_kill.c:89
No locals.
#2 __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ./nptl/pthread_kill.c:100
No locals.
#3 0x00007ff45eee8b7e in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
ret = <optimized out>
#4 0x00007ff45eecb8ec in __GI_abort () at ./stdlib/abort.c:77
act = {__sigaction_handler = {sa_handler = 0x0, sa_sigaction = 0x0}, sa_mask = {__val = {0, 136289449938592, 6879831482604898816, 140727741172736, 140727741173024, 140727741172880, 22, 140687538342864, 0, 140727741172816, 140687555188246, 140687528972288, 4096, 0, 6879831482604898816, 140687529680920}}, sa_flags = 1612791808, sa_restorer = 0x16}
#5 0x00007ff45faf3a0f in __sanitizer::Abort () at ../../../../src/libsanitizer/sanitizer_common/sanitizer_posix_libcdep.cpp:165
No locals.
#6 0x00007ff45fc19c2d in __sanitizer::Die () at ../../../../src/libsanitizer/sanitizer_common/sanitizer_termination.cpp:58
No locals.
#7 0x00007ff45fbee93c in __asan::ScopedInErrorReport::~ScopedInErrorReport (this=0x7ffdbb05cdc6) at ../../../../src/libsanitizer/asan/asan_report.cpp:221
buffer_copy = {buffer_ = {<__sanitizer::InternalMmapVectorNoCtor<char, false>> = {data_ = 0x7ff45e305000 '=' <repeats 65 times>, "\n==90==ERROR: AddressSanitizer: heap-use-after-free on address 0x7d645dbe040b at pc 0x7ff45fba3445 bp 0x7ffdbb05e2c0 sp 0x7ffdbb05da68\n"..., capacity_bytes_ = 4096, size_ = 3838}, <No data fields>}}
buffer_copy = <optimized out>
l = <optimized out>
#8 0x00007ff45fbede02 in __asan::ReportGenericError (pc=140687554786373, bp=140727741178560, sp=sp@entry=140727741176424, addr=addr@entry=137870022935563, is_write=is_write@entry=false, access_size=6, fatal=false, exp=<optimized out>) at ../../../../src/libsanitizer/asan/asan_report.cpp:536
in_report = {error_report_lock_ = {<No data fields>}, static current_error_ = {kind = __asan::kErrorKindGeneric, {Base = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\375\177\000\000\002\000\000\000bluetoothd[9\000\3126SH\022z_nal] org\220\330\005\273\375\177\000\000@\316\005\273\375\177\000\000.\274\374^\364\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\300\326\005\273\375\177\000\000\211\235\363^\364\177\000\000|\316\005\273\375\177\000\000|\316\005\273\375\177\000\000|\326\005\273\375\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\364\177\000\000\002\000\000\000bluetoothd[90]: [signal] org.fre"...}, tid = 0}, DeadlySignal = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\375\177\000\000\002\000\000\000bluetoothd[9\000\3126SH\022z_nal] org\220\330\005\273\375\177\000\000@\316\005\273\375\177\000\000.\274\374^\364\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\300\326\005\273\375\177\000\000\211\235\363^\364\177\000\000|\316\005\273\375\177\000\000|\316\005\273\375\177\000\000|\326\005\273\375\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\364\177\000\000\002\000\000\000bluetoothd[90]: [signal] org.fre"...}, tid = 0}, signal = {siginfo = 0xffffffff00000002, context = 0x7d645dbe040b, addr = 0, pc = 0, sp = 11935714117160, bp = 137870022935563, is_memory_access = 11, write_flag = __sanitizer::SignalContext::Unknown, is_true_faulting_addr = false}}, DoubleFree = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\375\177\000\000\002\000\000\000bluetoothd[9\000\3126SH\022z_nal] org\220\330\005\273\375\177\000\000@\316\005\273\375\177\000\000.\274\374^\364\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\300\326\005\273\375\177\000\000\211\235\363^\364\177\000\000|\316\005\273\375\177\000\000|\316\005\273\375\177\000\000|\326\005\273\375\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\364\177\000\000\002\000\000\000bluetoothd[90]: [signal] org.fre"...}, tid = 0}, second_free_stack = 0xffffffff00000002, addr_description = {addr = 137870022935563, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1576, free_stack_id = 2779, chunk_access = {bad_addr = 137870022935563, offset = 11, chunk_begin = 137870022935552, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}}, NewDeleteTypeMismatch = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\375\177\000\000\002\000\000\000bluetoothd[9\000\3126SH\022z_nal] org\220\330\005\273\375\177\000\000@\316\005\273\375\177\000\000.\274\374^\364\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\300\326\005\273\375\177\000\000\211\235\363^\364\177\000\000|\316\005\273\375\177\000\000|\316\005\273\375\177\000\000|\326\005\273\375\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\364\177\000\000\002\000\000\000bluetoothd[90]: [signal] org.fre"...}, tid = 0}, free_stack = 0xffffffff00000002, addr_description = {addr = 137870022935563, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1576, free_stack_id = 2779, chunk_access = {bad_addr = 137870022935563, offset = 11, chunk_begin = 137870022935552, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, delete_size = 136289456428704, delete_alignment = 140727741174352}, FreeNotMalloced = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\375\177\000\000\002\000\000\000bluetoothd[9\000\3126SH\022z_nal] org\220\330\005\273\375\177\000\000@\316\005\273\375\177\000\000.\274\374^\364\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\300\326\005\273\375\177\000\000\211\235\363^\364\177\000\000|\316\005\273\375\177\000\000|\316\005\273\375\177\000\000|\326\005\273\375\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\364\177\000\000\002\000\000\000bluetoothd[90]: [signal] org.fre"...}, tid = 0}, free_stack = 0xffffffff00000002, addr_description = {data = {kind = 1572733963, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11935714117160, alloc_stack_id = 1572733963, free_stack_id = 32100, chunk_access = {bad_addr = 11, offset = 137870022935552, chunk_begin = 752, chunk_size = 140727741145096, user_requested_alignment = 1696, access_type = 1, alloc_type = 0}}, stack = {addr = 0, tid = 0, offset = 11935714117160, frame_pc = 137870022935563, access_size = 11, frame_descr = 0x7d645dbe0400 "\333\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11935714117160, size_with_redzone = 137870022935563, name = 0xb <error: Cannot access memory at address 0xb>, module_name = 0x7d645dbe0400 "\333\n", has_dynamic_init = 752, gcc_location = 0x7ffdbb056008, odr_indicator = 136289456428704}, {beg = 140727741174352, size = 140687554083615, size_with_redzone = 1, name = 0x7bf45ca316a0 " \211\305]T|", module_name = 0x7ffdbb05daa0 "\260\332\005\273\375\177", has_dynamic_init = 140687555040722, gcc_location = 0x7ff45e3d70d0, odr_indicator = 131986739888}, {beg = 140727741174400, size = 3, size_with_redzone = 140687555040784, name = 0x7ff45ef39b8f <__vasprintf_internal+255> "I\211\004$H\205\300t(H\213\265\330\376\377\377L\211\352H\211\307\350\366\032\371\377H\211\301\353\212\350\254\346\n", module_name = 0x55dd8f3de5fb <bt_log_vprintf+171> "\205\300\017\210=\001", has_dynamic_init = 140727741177184, gcc_location = 0x7ffdbb05d340, odr_indicator = 2}, {beg = 140687555755968, size = 136701792323664, size_with_redzone = 140727741174544, name = 0x7ff45fafd738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", module_name = 0x3e <error: Cannot access memory at address 0x3e>, has_dynamic_init = 136701792323664, gcc_location = 0x7ff45e3d70d0, odr_indicator = 140727741174576}}, reg_sites = {1573226592, 31828, 81, 0}, access_size = 140727741176736, size = 69 'E'}, wild = {addr = 0, access_size = 0}}}}}, AllocTypeMismatch = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\375\177\000\000\002\000\000\000bluetoothd[9\000\3126SH\022z_nal] org\220\330\005\273\375\177\000\000@\316\005\273\375\177\000\000.\274\374^\364\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\300\326\005\273\375\177\000\000\211\235\363^\364\177\000\000|\316\005\273\375\177\000\000|\316\005\273\375\177\000\000|\326\005\273\375\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\364\177\000\000\002\000\000\000bluetoothd[90]: [signal] org.fre"...}, tid = 0}, dealloc_stack = 0xffffffff00000002, alloc_type = 1572733963, dealloc_type = 32100, addr_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 0, kind = (unknown: 0x28), shadow_byte = 6 '\006'}, heap = {addr = 0, alloc_tid = 11935714117160, free_tid = 137870022935563, alloc_stack_id = 11, free_stack_id = 0, chunk_access = {bad_addr = 137870022935552, offset = 752, chunk_begin = 140727741145096, chunk_size = 136289456428704, user_requested_alignment = 592, access_type = 1, alloc_type = 3}}, stack = {addr = 0, tid = 11935714117160, offset = 137870022935563, frame_pc = 11, access_size = 137870022935552, frame_descr = 0x2f0 <error: Cannot access memory at address 0x2f0>}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 11935714117160, size = 137870022935563, size_with_redzone = 11, name = 0x7d645dbe0400 "\333\n", module_name = 0x2f0 <error: Cannot access memory at address 0x2f0>, has_dynamic_init = 140727741145096, gcc_location = 0x7bf45ca316a0, odr_indicator = 140727741174352}, {beg = 140687554083615, size = 1, size_with_redzone = 136289456428704, name = 0x7ffdbb05daa0 "\260\332\005\273\375\177", module_name = 0x7ff45fbe15d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", has_dynamic_init = 140687529832656, gcc_location = 0x1ebb05d2b0, odr_indicator = 140727741174400}, {beg = 3, size = 140687555040784, size_with_redzone = 140687541771151, name = 0x55dd8f3de5fb <bt_log_vprintf+171> "\205\300\017\210=\001", module_name = 0x7ffdbb05dd60 "\004\337\005\273\375\177", has_dynamic_init = 140727741174592, gcc_location = 0x2, odr_indicator = 140687555755968}, {beg = 136701792323664, size = 140727741174544, size_with_redzone = 140687554107192, name = 0x3e <error: Cannot access memory at address 0x3e>, module_name = 0x7c545dc58850 "\003\021", has_dynamic_init = 140687529832656, gcc_location = 0x7ffdbb05d330, odr_indicator = 136701792323680}}, reg_sites = {81, 0, 3137723296, 32765}, access_size = 140687554786373, size = 192 '\300'}, wild = {addr = 0, access_size = 11935714117160}}}}}, MallocUsableSizeNotOwned = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\375\177\000\000\002\000\000\000bluetoothd[9\000\3126SH\022z_nal] org\220\330\005\273\375\177\000\000@\316\005\273\375\177\000\000.\274\374^\364\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\300\326\005\273\375\177\000\000\211\235\363^\364\177\000\000|\316\005\273\375\177\000\000|\316\005\273\375\177\000\000|\326\005\273\375\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\364\177\000\000\002\000\000\000bluetoothd[90]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, addr_description = {data = {kind = 1572733963, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11935714117160, alloc_stack_id = 1572733963, free_stack_id = 32100, chunk_access = {bad_addr = 11, offset = 137870022935552, chunk_begin = 752, chunk_size = 140727741145096, user_requested_alignment = 1696, access_type = 1, alloc_type = 0}}, stack = {addr = 0, tid = 0, offset = 11935714117160, frame_pc = 137870022935563, access_size = 11, frame_descr = 0x7d645dbe0400 "\333\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11935714117160, size_with_redzone = 137870022935563, name = 0xb <error: Cannot access memory at address 0xb>, module_name = 0x7d645dbe0400 "\333\n", has_dynamic_init = 752, gcc_location = 0x7ffdbb056008, odr_indicator = 136289456428704}, {beg = 140727741174352, size = 140687554083615, size_with_redzone = 1, name = 0x7bf45ca316a0 " \211\305]T|", module_name = 0x7ffdbb05daa0 "\260\332\005\273\375\177", has_dynamic_init = 140687555040722, gcc_location = 0x7ff45e3d70d0, odr_indicator = 131986739888}, {beg = 140727741174400, size = 3, size_with_redzone = 140687555040784, name = 0x7ff45ef39b8f <__vasprintf_internal+255> "I\211\004$H\205\300t(H\213\265\330\376\377\377L\211\352H\211\307\350\366\032\371\377H\211\301\353\212\350\254\346\n", module_name = 0x55dd8f3de5fb <bt_log_vprintf+171> "\205\300\017\210=\001", has_dynamic_init = 140727741177184, gcc_location = 0x7ffdbb05d340, odr_indicator = 2}, {beg = 140687555755968, size = 136701792323664, size_with_redzone = 140727741174544, name = 0x7ff45fafd738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", module_name = 0x3e <error: Cannot access memory at address 0x3e>, has_dynamic_init = 136701792323664, gcc_location = 0x7ff45e3d70d0, odr_indicator = 140727741174576}}, reg_sites = {1573226592, 31828, 81, 0}, access_size = 140727741176736, size = 69 'E'}, wild = {addr = 0, access_size = 0}}}}}, SanitizerGetAllocatedSizeNotOwned = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\375\177\000\000\002\000\000\000bluetoothd[9\000\3126SH\022z_nal] org\220\330\005\273\375\177\000\000@\316\005\273\375\177\000\000.\274\374^\364\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\300\326\005\273\375\177\000\000\211\235\363^\364\177\000\000|\316\005\273\375\177\000\000|\316\005\273\375\177\000\000|\326\005\273\375\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\364\177\000\000\002\000\000\000bluetoothd[90]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, addr_description = {data = {kind = 1572733963, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11935714117160, alloc_stack_id = 1572733963, free_stack_id = 32100, chunk_access = {bad_addr = 11, offset = 137870022935552, chunk_begin = 752, chunk_size = 140727741145096, user_requested_alignment = 1696, access_type = 1, alloc_type = 0}}, stack = {addr = 0, tid = 0, offset = 11935714117160, frame_pc = 137870022935563, access_size = 11, frame_descr = 0x7d645dbe0400 "\333\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11935714117160, size_with_redzone = 137870022935563, name = 0xb <error: Cannot access memory at address 0xb>, module_name = 0x7d645dbe0400 "\333\n", has_dynamic_init = 752, gcc_location = 0x7ffdbb056008, odr_indicator = 136289456428704}, {beg = 140727741174352, size = 140687554083615, size_with_redzone = 1, name = 0x7bf45ca316a0 " \211\305]T|", module_name = 0x7ffdbb05daa0 "\260\332\005\273\375\177", has_dynamic_init = 140687555040722, gcc_location = 0x7ff45e3d70d0, odr_indicator = 131986739888}, {beg = 140727741174400, size = 3, size_with_redzone = 140687555040784, name = 0x7ff45ef39b8f <__vasprintf_internal+255> "I\211\004$H\205\300t(H\213\265\330\376\377\377L\211\352H\211\307\350\366\032\371\377H\211\301\353\212\350\254\346\n", module_name = 0x55dd8f3de5fb <bt_log_vprintf+171> "\205\300\017\210=\001", has_dynamic_init = 140727741177184, gcc_location = 0x7ffdbb05d340, odr_indicator = 2}, {beg = 140687555755968, size = 136701792323664, size_with_redzone = 140727741174544, name = 0x7ff45fafd738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", module_name = 0x3e <error: Cannot access memory at address 0x3e>, has_dynamic_init = 136701792323664, gcc_location = 0x7ff45e3d70d0, odr_indicator = 140727741174576}}, reg_sites = {1573226592, 31828, 81, 0}, access_size = 140727741176736, size = 69 'E'}, wild = {addr = 0, access_size = 0}}}}}, CallocOverflow = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\375\177\000\000\002\000\000\000bluetoothd[9\000\3126SH\022z_nal] org\220\330\005\273\375\177\000\000@\316\005\273\375\177\000\000.\274\374^\364\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\300\326\005\273\375\177\000\000\211\235\363^\364\177\000\000|\316\005\273\375\177\000\000|\316\005\273\375\177\000\000|\326\005\273\375\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\364\177\000\000\002\000\000\000bluetoothd[90]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, count = 137870022935563, size = 0}, ReallocArrayOverflow = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\375\177\000\000\002\000\000\000bluetoothd[9\000\3126SH\022z_nal] org\220\330\005\273\375\177\000\000@\316\005\273\375\177\000\000.\274\374^\364\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\300\326\005\273\375\177\000\000\211\235\363^\364\177\000\000|\316\005\273\375\177\000\000|\316\005\273\375\177\000\000|\326\005\273\375\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\364\177\000\000\002\000\000\000bluetoothd[90]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, count = 137870022935563, size = 0}, PvallocOverflow = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\375\177\000\000\002\000\000\000bluetoothd[9\000\3126SH\022z_nal] org\220\330\005\273\375\177\000\000@\316\005\273\375\177\000\000.\274\374^\364\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\300\326\005\273\375\177\000\000\211\235\363^\364\177\000\000|\316\005\273\375\177\000\000|\316\005\273\375\177\000\000|\326\005\273\375\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\364\177\000\000\002\000\000\000bluetoothd[90]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, size = 137870022935563}, InvalidAllocationAlignment = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\375\177\000\000\002\000\000\000bluetoothd[9\000\3126SH\022z_nal] org\220\330\005\273\375\177\000\000@\316\005\273\375\177\000\000.\274\374^\364\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\300\326\005\273\375\177\000\000\211\235\363^\364\177\000\000|\316\005\273\375\177\000\000|\316\005\273\375\177\000\000|\326\005\273\375\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\364\177\000\000\002\000\000\000bluetoothd[90]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, alignment = 137870022935563}, InvalidAlignedAllocAlignment = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\375\177\000\000\002\000\000\000bluetoothd[9\000\3126SH\022z_nal] org\220\330\005\273\375\177\000\000@\316\005\273\375\177\000\000.\274\374^\364\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\300\326\005\273\375\177\000\000\211\235\363^\364\177\000\000|\316\005\273\375\177\000\000|\316\005\273\375\177\000\000|\326\005\273\375\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\364\177\000\000\002\000\000\000bluetoothd[90]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, size = 137870022935563, alignment = 0}, InvalidPosixMemalignAlignment = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\375\177\000\000\002\000\000\000bluetoothd[9\000\3126SH\022z_nal] org\220\330\005\273\375\177\000\000@\316\005\273\375\177\000\000.\274\374^\364\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\300\326\005\273\375\177\000\000\211\235\363^\364\177\000\000|\316\005\273\375\177\000\000|\316\005\273\375\177\000\000|\326\005\273\375\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\364\177\000\000\002\000\000\000bluetoothd[90]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, alignment = 137870022935563}, AllocationSizeTooBig = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\375\177\000\000\002\000\000\000bluetoothd[9\000\3126SH\022z_nal] org\220\330\005\273\375\177\000\000@\316\005\273\375\177\000\000.\274\374^\364\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\300\326\005\273\375\177\000\000\211\235\363^\364\177\000\000|\316\005\273\375\177\000\000|\316\005\273\375\177\000\000|\326\005\273\375\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\364\177\000\000\002\000\000\000bluetoothd[90]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, user_size = 137870022935563, total_size = 0, max_size = 0}, RssLimitExceeded = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\375\177\000\000\002\000\000\000bluetoothd[9\000\3126SH\022z_nal] org\220\330\005\273\375\177\000\000@\316\005\273\375\177\000\000.\274\374^\364\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\300\326\005\273\375\177\000\000\211\235\363^\364\177\000\000|\316\005\273\375\177\000\000|\316\005\273\375\177\000\000|\326\005\273\375\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\364\177\000\000\002\000\000\000bluetoothd[90]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002}, OutOfMemory = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\375\177\000\000\002\000\000\000bluetoothd[9\000\3126SH\022z_nal] org\220\330\005\273\375\177\000\000@\316\005\273\375\177\000\000.\274\374^\364\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\300\326\005\273\375\177\000\000\211\235\363^\364\177\000\000|\316\005\273\375\177\000\000|\316\005\273\375\177\000\000|\326\005\273\375\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\364\177\000\000\002\000\000\000bluetoothd[90]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, requested_size = 137870022935563}, StringFunctionMemoryRangesOverlap = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\375\177\000\000\002\000\000\000bluetoothd[9\000\3126SH\022z_nal] org\220\330\005\273\375\177\000\000@\316\005\273\375\177\000\000.\274\374^\364\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\300\326\005\273\375\177\000\000\211\235\363^\364\177\000\000|\316\005\273\375\177\000\000|\316\005\273\375\177\000\000|\326\005\273\375\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\364\177\000\000\002\000\000\000bluetoothd[90]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, length1 = 137870022935563, length2 = 0, addr1_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 11935714117160, kind = (__asan::kShadowKindGap | __asan::kShadowKindHigh | unknown: 0x8), shadow_byte = 4 '\004'}, heap = {addr = 11935714117160, alloc_tid = 137870022935563, free_tid = 11, alloc_stack_id = 1572733952, free_stack_id = 32100, chunk_access = {bad_addr = 752, offset = 140727741145096, chunk_begin = 136289456428704, chunk_size = 140727741174352, user_requested_alignment = 2847, access_type = 3, alloc_type = 1}}, stack = {addr = 11935714117160, tid = 137870022935563, offset = 11, frame_pc = 137870022935552, access_size = 752, frame_descr = 0x7ffdbb056008 ""}, global = {addr = 11935714117160, static kMaxGlobals = 4, globals = {{beg = 137870022935563, size = 11, size_with_redzone = 137870022935552, name = 0x2f0 <error: Cannot access memory at address 0x2f0>, module_name = 0x7ffdbb056008 "", has_dynamic_init = 136289456428704, gcc_location = 0x7ffdbb05d250, odr_indicator = 140687554083615}, {beg = 1, size = 136289456428704, size_with_redzone = 140727741176480, name = 0x7ff45fbe15d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", module_name = 0x7ff45e3d70d0 "", has_dynamic_init = 131986739888, gcc_location = 0x7ffdbb05d280, odr_indicator = 3}, {beg = 140687555040784, size = 140687541771151, size_with_redzone = 94410079331835, name = 0x7ffdbb05dd60 "\004\337\005\273\375\177", module_name = 0x7ffdbb05d340 "\030", has_dynamic_init = 2, gcc_location = 0x7ff45fc8ffc0 <__asan::instance>, odr_indicator = 136701792323664}, {beg = 140727741174544, size = 140687554107192, size_with_redzone = 62, name = 0x7c545dc58850 "\003\021", module_name = 0x7ff45e3d70d0 "", has_dynamic_init = 140727741174576, gcc_location = 0x7c545dc58860, odr_indicator = 81}}, reg_sites = {3137723296, 32765, 1606038597, 32756}, access_size = 140727741178560, size = 104 'h'}, wild = {addr = 11935714117160, access_size = 137870022935563}}}}, addr2_description = {data = {kind = 6, {shadow = {addr = 140687555467159, kind = __asan::kShadowKindLow, shadow_byte = 253 '\375'}, heap = {addr = 140687555467159, alloc_tid = 140687555755264, free_tid = 140727741178112, alloc_stack_id = 1606292946, free_stack_id = 32756, chunk_access = {bad_addr = 8315162673665959470, offset = 130735371371, chunk_begin = 140727741176032, chunk_size = 3, user_requested_alignment = 1552, access_type = 1, alloc_type = 0}}, stack = {addr = 140687555467159, tid = 140687555755264, offset = 140727741178112, frame_pc = 140687555040722, access_size = 8315162673665959470, frame_descr = 0x1e706f746b <error: Cannot access memory at address 0x1e706f746b>}, global = {addr = 140687555467159, static kMaxGlobals = 4, globals = {{beg = 140687555755264, size = 140727741178112, size_with_redzone = 140687555040722, name = 0x736564656572662e <error: Cannot access memory at address 0x736564656572662e>, module_name = 0x1e706f746b <error: Cannot access memory at address 0x1e706f746b>, has_dynamic_init = 140727741176032, gcc_location = 0x3, odr_indicator = 140687555040784}, {beg = 140687541771151, size = 94410079331835, size_with_redzone = 140727741178816, name = 0x7ffdbb05d960 "\200\331\005\273\375\177", module_name = 0x7ff45fc89f78 "\001", has_dynamic_init = 140727741176224, gcc_location = 0x55dd8f51f5a0, odr_indicator = 140687533725880}, {beg = 65535, size = 140727741176144, size_with_redzone = 140687554872153, name = 0x40 <error: Cannot access memory at address 0x40>, module_name = 0x7bf45cc62a00 "\0166\340E", has_dynamic_init = 140727741176192, gcc_location = 0x7ff45fb0474a <__asan_stack_malloc_0(__sanitizer::uptr)+234>, odr_indicator = 140727741176192}, {beg = 140687555297149, size = 140727741176224, size_with_redzone = 140687555140966, name = 0x7ffdbb05da20 "", module_name = 0x2 <error: Cannot access memory at address 0x2>, has_dynamic_init = 140687555755968, gcc_location = 0x7c345dc4df00, odr_indicator = 140727741176304}}, reg_sites = {1605359416, 32756, 40, 0}, access_size = 140687555246621, size = 208 '\320'}, wild = {addr = 140687555467159, access_size = 140687555755264}}}}, function = 0x7ffdbb05da10 "\300\342\005\273\375\177"}, StringFunctionSizeOverflow = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\375\177\000\000\002\000\000\000bluetoothd[9\000\3126SH\022z_nal] org\220\330\005\273\375\177\000\000@\316\005\273\375\177\000\000.\274\374^\364\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\300\326\005\273\375\177\000\000\211\235\363^\364\177\000\000|\316\005\273\375\177\000\000|\316\005\273\375\177\000\000|\326\005\273\375\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\364\177\000\000\002\000\000\000bluetoothd[90]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, addr_description = {data = {kind = 1572733963, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11935714117160, alloc_stack_id = 1572733963, free_stack_id = 32100, chunk_access = {bad_addr = 11, offset = 137870022935552, chunk_begin = 752, chunk_size = 140727741145096, user_requested_alignment = 1696, access_type = 1, alloc_type = 0}}, stack = {addr = 0, tid = 0, offset = 11935714117160, frame_pc = 137870022935563, access_size = 11, frame_descr = 0x7d645dbe0400 "\333\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11935714117160, size_with_redzone = 137870022935563, name = 0xb <error: Cannot access memory at address 0xb>, module_name = 0x7d645dbe0400 "\333\n", has_dynamic_init = 752, gcc_location = 0x7ffdbb056008, odr_indicator = 136289456428704}, {beg = 140727741174352, size = 140687554083615, size_with_redzone = 1, name = 0x7bf45ca316a0 " \211\305]T|", module_name = 0x7ffdbb05daa0 "\260\332\005\273\375\177", has_dynamic_init = 140687555040722, gcc_location = 0x7ff45e3d70d0, odr_indicator = 131986739888}, {beg = 140727741174400, size = 3, size_with_redzone = 140687555040784, name = 0x7ff45ef39b8f <__vasprintf_internal+255> "I\211\004$H\205\300t(H\213\265\330\376\377\377L\211\352H\211\307\350\366\032\371\377H\211\301\353\212\350\254\346\n", module_name = 0x55dd8f3de5fb <bt_log_vprintf+171> "\205\300\017\210=\001", has_dynamic_init = 140727741177184, gcc_location = 0x7ffdbb05d340, odr_indicator = 2}, {beg = 140687555755968, size = 136701792323664, size_with_redzone = 140727741174544, name = 0x7ff45fafd738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", module_name = 0x3e <error: Cannot access memory at address 0x3e>, has_dynamic_init = 136701792323664, gcc_location = 0x7ff45e3d70d0, odr_indicator = 140727741174576}}, reg_sites = {1573226592, 31828, 81, 0}, access_size = 140727741176736, size = 69 'E'}, wild = {addr = 0, access_size = 0}}}}, size = 140727741178560}, BadParamsToAnnotateContiguousContainer = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\375\177\000\000\002\000\000\000bluetoothd[9\000\3126SH\022z_nal] org\220\330\005\273\375\177\000\000@\316\005\273\375\177\000\000.\274\374^\364\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\300\326\005\273\375\177\000\000\211\235\363^\364\177\000\000|\316\005\273\375\177\000\000|\316\005\273\375\177\000\000|\326\005\273\375\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\364\177\000\000\002\000\000\000bluetoothd[90]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, beg = 137870022935563, end = 0, old_mid = 0, new_mid = 11935714117160}, BadParamsToAnnotateDoubleEndedContiguousContainer = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\375\177\000\000\002\000\000\000bluetoothd[9\000\3126SH\022z_nal] org\220\330\005\273\375\177\000\000@\316\005\273\375\177\000\000.\274\374^\364\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\300\326\005\273\375\177\000\000\211\235\363^\364\177\000\000|\316\005\273\375\177\000\000|\316\005\273\375\177\000\000|\326\005\273\375\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\364\177\000\000\002\000\000\000bluetoothd[90]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, storage_beg = 137870022935563, storage_end = 0, old_container_beg = 0, old_container_end = 11935714117160, new_container_beg = 137870022935563, new_container_end = 11}, BadParamsToCopyContiguousContainerAnnotations = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\375\177\000\000\002\000\000\000bluetoothd[9\000\3126SH\022z_nal] org\220\330\005\273\375\177\000\000@\316\005\273\375\177\000\000.\274\374^\364\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\300\326\005\273\375\177\000\000\211\235\363^\364\177\000\000|\316\005\273\375\177\000\000|\316\005\273\375\177\000\000|\326\005\273\375\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\364\177\000\000\002\000\000\000bluetoothd[90]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, old_storage_beg = 137870022935563, old_storage_end = 0, new_storage_beg = 0, new_storage_end = 11935714117160}, ODRViolation = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\375\177\000\000\002\000\000\000bluetoothd[9\000\3126SH\022z_nal] org\220\330\005\273\375\177\000\000@\316\005\273\375\177\000\000.\274\374^\364\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\300\326\005\273\375\177\000\000\211\235\363^\364\177\000\000|\316\005\273\375\177\000\000|\316\005\273\375\177\000\000|\326\005\273\375\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\364\177\000\000\002\000\000\000bluetoothd[90]: [signal] org.fre"...}, tid = 0}, global1 = {beg = 18446744069414584322, size = 137870022935563, size_with_redzone = 0, name = 0x0, module_name = 0xadb00000628 <error: Cannot access memory at address 0xadb00000628>, has_dynamic_init = 137870022935563, gcc_location = 0xb, odr_indicator = 137870022935552}, global2 = {beg = 752, size = 140727741145096, size_with_redzone = 136289456428704, name = 0x7ffdbb05d250 "\240\332\005\273\375\177", module_name = 0x7ff45faf7b1f <__asan::asan_malloc(unsigned long, __sanitizer::BufferedStackTrace*)+47> "H\205\300t\f\311\303f.\017\037\204", has_dynamic_init = 1, gcc_location = 0x7bf45ca316a0, odr_indicator = 140727741176480}, stack_id1 = 1606292946, stack_id2 = 32756}, InvalidPointerPair = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\375\177\000\000\002\000\000\000bluetoothd[9\000\3126SH\022z_nal] org\220\330\005\273\375\177\000\000@\316\005\273\375\177\000\000.\274\374^\364\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\300\326\005\273\375\177\000\000\211\235\363^\364\177\000\000|\316\005\273\375\177\000\000|\316\005\273\375\177\000\000|\326\005\273\375\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\364\177\000\000\002\000\000\000bluetoothd[90]: [signal] org.fre"...}, tid = 0}, pc = 18446744069414584322, bp = 137870022935563, sp = 0, addr1_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 11935714117160, kind = (__asan::kShadowKindGap | __asan::kShadowKindHigh | unknown: 0x8), shadow_byte = 4 '\004'}, heap = {addr = 11935714117160, alloc_tid = 137870022935563, free_tid = 11, alloc_stack_id = 1572733952, free_stack_id = 32100, chunk_access = {bad_addr = 752, offset = 140727741145096, chunk_begin = 136289456428704, chunk_size = 140727741174352, user_requested_alignment = 2847, access_type = 3, alloc_type = 1}}, stack = {addr = 11935714117160, tid = 137870022935563, offset = 11, frame_pc = 137870022935552, access_size = 752, frame_descr = 0x7ffdbb056008 ""}, global = {addr = 11935714117160, static kMaxGlobals = 4, globals = {{beg = 137870022935563, size = 11, size_with_redzone = 137870022935552, name = 0x2f0 <error: Cannot access memory at address 0x2f0>, module_name = 0x7ffdbb056008 "", has_dynamic_init = 136289456428704, gcc_location = 0x7ffdbb05d250, odr_indicator = 140687554083615}, {beg = 1, size = 136289456428704, size_with_redzone = 140727741176480, name = 0x7ff45fbe15d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", module_name = 0x7ff45e3d70d0 "", has_dynamic_init = 131986739888, gcc_location = 0x7ffdbb05d280, odr_indicator = 3}, {beg = 140687555040784, size = 140687541771151, size_with_redzone = 94410079331835, name = 0x7ffdbb05dd60 "\004\337\005\273\375\177", module_name = 0x7ffdbb05d340 "\030", has_dynamic_init = 2, gcc_location = 0x7ff45fc8ffc0 <__asan::instance>, odr_indicator = 136701792323664}, {beg = 140727741174544, size = 140687554107192, size_with_redzone = 62, name = 0x7c545dc58850 "\003\021", module_name = 0x7ff45e3d70d0 "", has_dynamic_init = 140727741174576, gcc_location = 0x7c545dc58860, odr_indicator = 81}}, reg_sites = {3137723296, 32765, 1606038597, 32756}, access_size = 140727741178560, size = 104 'h'}, wild = {addr = 11935714117160, access_size = 137870022935563}}}}, addr2_description = {data = {kind = 6, {shadow = {addr = 140687555467159, kind = __asan::kShadowKindLow, shadow_byte = 253 '\375'}, heap = {addr = 140687555467159, alloc_tid = 140687555755264, free_tid = 140727741178112, alloc_stack_id = 1606292946, free_stack_id = 32756, chunk_access = {bad_addr = 8315162673665959470, offset = 130735371371, chunk_begin = 140727741176032, chunk_size = 3, user_requested_alignment = 1552, access_type = 1, alloc_type = 0}}, stack = {addr = 140687555467159, tid = 140687555755264, offset = 140727741178112, frame_pc = 140687555040722, access_size = 8315162673665959470, frame_descr = 0x1e706f746b <error: Cannot access memory at address 0x1e706f746b>}, global = {addr = 140687555467159, static kMaxGlobals = 4, globals = {{beg = 140687555755264, size = 140727741178112, size_with_redzone = 140687555040722, name = 0x736564656572662e <error: Cannot access memory at address 0x736564656572662e>, module_name = 0x1e706f746b <error: Cannot access memory at address 0x1e706f746b>, has_dynamic_init = 140727741176032, gcc_location = 0x3, odr_indicator = 140687555040784}, {beg = 140687541771151, size = 94410079331835, size_with_redzone = 140727741178816, name = 0x7ffdbb05d960 "\200\331\005\273\375\177", module_name = 0x7ff45fc89f78 "\001", has_dynamic_init = 140727741176224, gcc_location = 0x55dd8f51f5a0, odr_indicator = 140687533725880}, {beg = 65535, size = 140727741176144, size_with_redzone = 140687554872153, name = 0x40 <error: Cannot access memory at address 0x40>, module_name = 0x7bf45cc62a00 "\0166\340E", has_dynamic_init = 140727741176192, gcc_location = 0x7ff45fb0474a <__asan_stack_malloc_0(__sanitizer::uptr)+234>, odr_indicator = 140727741176192}, {beg = 140687555297149, size = 140727741176224, size_with_redzone = 140687555140966, name = 0x7ffdbb05da20 "", module_name = 0x2 <error: Cannot access memory at address 0x2>, has_dynamic_init = 140687555755968, gcc_location = 0x7c345dc4df00, odr_indicator = 140727741176304}}, reg_sites = {1605359416, 32756, 40, 0}, access_size = 140687555246621, size = 208 '\320'}, wild = {addr = 140687555467159, access_size = 140687555755264}}}}}, Generic = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\375\177\000\000\002\000\000\000bluetoothd[9\000\3126SH\022z_nal] org\220\330\005\273\375\177\000\000@\316\005\273\375\177\000\000.\274\374^\364\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\300\326\005\273\375\177\000\000\211\235\363^\364\177\000\000|\316\005\273\375\177\000\000|\316\005\273\375\177\000\000|\326\005\273\375\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\364\177\000\000\002\000\000\000bluetoothd[90]: [signal] org.fre"...}, tid = 0}, addr_description = {data = {kind = __asan::kAddressKindHeap, {shadow = {addr = 137870022935563, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 137870022935563, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1576, free_stack_id = 2779, chunk_access = {bad_addr = 137870022935563, offset = 11, chunk_begin = 137870022935552, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, stack = {addr = 137870022935563, tid = 0, offset = 0, frame_pc = 11935714117160, access_size = 137870022935563, frame_descr = 0xb <error: Cannot access memory at address 0xb>}, global = {addr = 137870022935563, static kMaxGlobals = 4, globals = {{beg = 0, size = 0, size_with_redzone = 11935714117160, name = 0x7d645dbe040b "B", module_name = 0xb <error: Cannot access memory at address 0xb>, has_dynamic_init = 137870022935552, gcc_location = 0x2f0, odr_indicator = 140727741145096}, {beg = 136289456428704, size = 140727741174352, size_with_redzone = 140687554083615, name = 0x1 <error: Cannot access memory at address 0x1>, module_name = 0x7bf45ca316a0 " \211\305]T|", has_dynamic_init = 140727741176480, gcc_location = 0x7ff45fbe15d2 <___interceptor_malloc(__sanitizer::uptr)+130>, odr_indicator = 140687529832656}, {beg = 131986739888, size = 140727741174400, size_with_redzone = 3, name = 0x7ff45fbe1610 <___interceptor_malloc(__sanitizer::uptr)+192> "D\213\215\314\367\377\377E\205\311tTH\211m\330A\203\371\001t*E\017\276\3061\311H\211\352H\211\306H\215\275\320\367\377\377\350\"\004\001", module_name = 0x7ff45ef39b8f <__vasprintf_internal+255> "I\211\004$H\205\300t(H\213\265\330\376\377\377L\211\352H\211\307\350\366\032\371\377H\211\301\353\212\350\254\346\n", has_dynamic_init = 94410079331835, gcc_location = 0x7ffdbb05dd60, odr_indicator = 140727741174592}, {beg = 2, size = 140687555755968, size_with_redzone = 136701792323664, name = 0x7ffdbb05d310 "\300\342\005\273\375\177", module_name = 0x7ff45fafd738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", has_dynamic_init = 62, gcc_location = 0x7c545dc58850, odr_indicator = 140687529832656}}, reg_sites = {3137721136, 32765, 1573226592, 31828}, access_size = 81, size = 160 '\240'}, wild = {addr = 137870022935563, access_size = 0}}}}, pc = 140687554786373, bp = 140727741178560, sp = 140727741176424, access_size = 6, bug_descr = 0x7ff45fc49797 "heap-use-after-free", is_write = false, shadow_val = 253 '\375'}}}, halt_on_error_ = true}
error = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\375\177\000\000\002\000\000\000bluetoothd[9\000\3126SH\022z_nal] org\220\330\005\273\375\177\000\000@\316\005\273\375\177\000\000.\274\374^\364\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000\300\326\005\273\375\177\000\000\211\235\363^\364\177\000\000|\316\005\273\375\177\000\000|\316\005\273\375\177\000\000|\326\005\273\375\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\364\177\000\000\002\000\000\000bluetoothd[90]: [signal] org.fre"...}, tid = 0}, addr_description = {data = {kind = __asan::kAddressKindHeap, {shadow = {addr = 137870022935563, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 137870022935563, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1576, free_stack_id = 2779, chunk_access = {bad_addr = 137870022935563, offset = 11, chunk_begin = 137870022935552, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, stack = {addr = 137870022935563, tid = 0, offset = 0, frame_pc = 11935714117160, access_size = 137870022935563, frame_descr = 0xb <error: Cannot access memory at address 0xb>}, global = {addr = 137870022935563, static kMaxGlobals = 4, globals = {{beg = 0, size = 0, size_with_redzone = 11935714117160, name = 0x7d645dbe040b "B", module_name = 0xb <error: Cannot access memory at address 0xb>, has_dynamic_init = 137870022935552, gcc_location = 0x2f0, odr_indicator = 140727741145096}, {beg = 136289456428704, size = 140727741174352, size_with_redzone = 140687554083615, name = 0x1 <error: Cannot access memory at address 0x1>, module_name = 0x7bf45ca316a0 " \211\305]T|", has_dynamic_init = 140727741176480, gcc_location = 0x7ff45fbe15d2 <___interceptor_malloc(__sanitizer::uptr)+130>, odr_indicator = 140687529832656}, {beg = 131986739888, size = 140727741174400, size_with_redzone = 3, name = 0x7ff45fbe1610 <___interceptor_malloc(__sanitizer::uptr)+192> "D\213\215\314\367\377\377E\205\311tTH\211m\330A\203\371\001t*E\017\276\3061\311H\211\352H\211\306H\215\275\320\367\377\377\350\"\004\001", module_name = 0x7ff45ef39b8f <__vasprintf_internal+255> "I\211\004$H\205\300t(H\213\265\330\376\377\377L\211\352H\211\307\350\366\032\371\377H\211\301\353\212\350\254\346\n", has_dynamic_init = 94410079331835, gcc_location = 0x7ffdbb05dd60, odr_indicator = 140727741174592}, {beg = 2, size = 140687555755968, size_with_redzone = 136701792323664, name = 0x7ffdbb05d310 "\300\342\005\273\375\177", module_name = 0x7ff45fafd738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", has_dynamic_init = 62, gcc_location = 0x7c545dc58850, odr_indicator = 140687529832656}}, reg_sites = {3137721136, 32765, 1573226592, 31828}, access_size = 81, size = 160 '\240'}, wild = {addr = 137870022935563, access_size = 0}}}}, pc = 140687554786373, bp = 140727741178560, sp = 140727741176424, access_size = 6, bug_descr = 0x7ff45fc49797 "heap-use-after-free", is_write = false, shadow_val = 253 '\375'}
#9 0x00007ff45fbedf8d in __asan::ReportGenericError (pc=<optimized out>, bp=bp@entry=140727741178560, sp=sp@entry=140727741176424, addr=addr@entry=137870022935563, is_write=is_write@entry=false, access_size=access_size@entry=6, exp=<optimized out>, fatal=false) at ../../../../src/libsanitizer/asan/asan_report.cpp:536
in_report = <optimized out>
error = <optimized out>
enable_fp = <optimized out>
#10 0x00007ff45fba3468 in MemcmpInterceptorCommon (ctx=ctx@entry=0x7ffdbb05e2d0, real_fn=<optimized out>, a1=a1@entry=0x7d645dbe040b, a2=a2@entry=0x7bf45c98e260, size=size@entry=6) at ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:848
bp = 140727741178560
pc = <optimized out>
local_stack = 137526425550912
sp = 140727741176424
_ctx = 0x7ffdbb05e2d0
suppressed = <optimized out>
__offset = 137870022935563
__size = 6
__bad = <optimized out>
result = <optimized out>
#11 0x00007ff45fba3835 in ___interceptor_memcmp (a1=0x7d645dbe040b, a2=0x7bf45c98e260, size=6) at ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:880
ctx = 0x7ffdbb05e2d0
_ctx = {interceptor_name = 0x7ff45fc4d6b6 "memcmp"}
#12 ___interceptor_memcmp (a1=0x7d645dbe040b, a2=0x7bf45c98e260, size=6) at ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:875
ctx = <optimized out>
_ctx = <optimized out>
#13 0x000055dd8f2c20c8 in bacmp (ba1=0x7d645dbe040b, ba2=0x7bf45c98e260) at ./lib/bluetooth/bluetooth.h:438
No locals.
#14 device_addr_type_cmp (a=0x7d645dbe0400, b=0x7bf45c98e260) at src/device.c:5657
dev = 0x7d645dbe0400
addr = 0x7bf45c98e260
cmp = <optimized out>
#15 0x00007ff45f91d4c2 in g_slist_find_custom () from /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
No symbol table info available.
#16 0x000055dd8f2416f4 in btd_adapter_find_device (adapter=<optimized out>, dst=dst@entry=0x7c345dc23c18, bdaddr_type=1 '\001') at src/adapter.c:1055
addr = <optimized out>
device = <optimized out>
list = <optimized out>
#17 0x000055dd8f1e3c07 in att_disconnected (err=<optimized out>, user_data=0x7c345dc23c10) at src/gatt-database.c:335
state = 0x7c345dc23c10
device = <optimized out>
__func__ = "att_disconnected"
#18 0x000055dd8f1fab34 in btd_gatt_database_att_disconnected (database=<optimized out>, device=<optimized out>) at src/gatt-database.c:4238
server = <optimized out>
att = <optimized out>
state = <optimized out>
addr = <optimized out>
type = <optimized out>
__func__ = "btd_gatt_database_att_disconnected"
#19 0x000055dd8f2a4176 in gatt_server_cleanup (device=device@entry=0x7d645dbe0080) at src/device.c:842
No locals.
#20 0x000055dd8f2b886c in attio_cleanup (device=0x7d645dbe0080) at src/device.c:862
No locals.
#21 0x000055dd8f2b8eb7 in device_free (user_data=0x7d645dbe0080) at src/device.c:918
device = 0x7d645dbe0080
__func__ = "device_free"
#22 0x000055dd8f336aca in remove_interface (data=0x7c645dbeac80, name=name@entry=0x55dd8f543a60 "org.bluez.Device1") at gdbus/object.c:742
iface = 0x7c545dbfe560
#23 0x000055dd8f33968c in g_dbus_unregister_interface (connection=<optimized out>, path=<optimized out>, name=<optimized out>) at gdbus/object.c:1499
data = <optimized out>
#24 0x000055dd8f2741b3 in adapter_remove (adapter=adapter@entry=0x7d245dbe0200) at src/adapter.c:7313
l = 0x7c145dc0b2f0 = {0x7d645dbe0080}
db = <optimized out>
ranging_manager = <optimized out>
__func__ = "adapter_remove"
#25 0x000055dd8f274d48 in adapter_cleanup () at src/adapter.c:11269
adapter = 0x7d245dbe0200
#26 0x000055dd8f0262f0 in main (argc=<optimized out>, argv=<optimized out>) at src/main.c:1723
context = <optimized out>
err = <optimized out>
sdp_mtu = 0
sdp_flags = <optimized out>
gdbus_flags = <optimized out>
__func__ = "main""
https://github.com/bluez/bluez/pull/2554
---
Regards,
Linux Bluetooth
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-09-19 22:05 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-09-19 18:44 [PATCH BlueZ] adapter: Fix crash on short start discovery reply Iaroslav Voitovych
2026-09-19 22:05 ` [BlueZ] " bluez.test.bot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).